Who is responsible
The controller for the personal data described in this notice is the company below. It decides why and how that data is processed, within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).
- Controller
- VSG 80 EOOD, UIC 207093802
- Registered address
- 3 Petko Karavelov Street
7000 Ruse, Bulgaria - Represented by
- Veselin Georgiev, director
- Telephone
- +359 87 791 4005
The company is not required to appoint a data protection officer under Article 37 GDPR and has not appointed one. Data protection requests and questions go to the contact details above.
What this notice covers
This notice covers personal data processed when you visit this website and when you contact VSG 80 EOOD by telephone or email, and personal data processed while the company prepares and carries out work for you. It does not cover websites operated by other organisations that you reach through a link from this site.
What is processed, why, and on what legal basis
Delivering and securing the website
When a page is requested, the hosting infrastructure processes the technical data every web request carries: the IP address, the date and time, the requested address, the referring address, the browser and operating system identification, the amount of data transferred, the response status and events relevant to security. The purpose is to deliver the site and to protect it against misuse, overload and attack. The legal basis is Article 6(1)(f) GDPR, the legitimate interest in a website that works and is not abused. This data is kept for the short period applied by the hosting provider, and longer only where a specific security incident is being examined. No profile is built from it and it is not combined with other data.
Answering a telephone enquiry
If you call, the company processes your telephone number, the name you give and what you describe about the property and the work. The purpose is to answer your enquiry and discuss possible work. The legal basis is Article 6(1)(b) GDPR, steps taken at your request before a contract, or Article 6(1)(f) GDPR where you are calling for an organisation rather than for yourself. Notes on an enquiry that leads to nothing further are kept only as long as they are needed for that enquiry and any follow-up.
Answering an email enquiry
If you write, the company processes your email address, your name, the content of your message and any attachments you send, for the same purposes and on the same legal bases as a telephone enquiry. The company’s mailbox is operated by an external email provider, which therefore processes the content of the correspondence. Please do not send health data, identification document scans or other sensitive information by email unless the company has asked you to.
Preparing and carrying out agreed work
To prepare and carry out work, the company processes your contact details, the address and relevant characteristics of the property, the agreed scope, appointment details and the correspondence connected to the job. The legal basis is Article 6(1)(b) GDPR, performance of the contract with you.
Invoicing, accounting and tax
Invoices and the accompanying accounting records contain the details required by Bulgarian law. The legal basis is Article 6(1)(c) GDPR, compliance with legal obligations under the Bulgarian Accountancy Act and tax and social-security legislation.
Establishing, exercising or defending legal claims
Where it is necessary, records may be kept to establish, exercise or defend a legal claim. The legal basis is Article 6(1)(f) GDPR, the legitimate interest in being able to defend the company’s legal position.
No processing described in this notice relies on your consent, so there is currently no consent for you to withdraw. If consent is ever needed, it will be asked for separately and can then be withdrawn at any time with effect for the future.
How long data is kept
Personal data is kept only for as long as the purpose it was collected for requires, and then deleted, unless a longer period is required by law.
- Enquiries that do not lead to work: deleted once it is clear that nothing further will follow and no follow-up is expected.
- Records relating to work carried out: for the duration of the engagement and afterwards until the limitation periods that apply under Bulgarian law have expired.
- Accounting registers and financial statements: ten years, counted from 1 January of the year following the reporting period, under Article 12 of the Bulgarian Accountancy Act. Other accounting information carriers are kept for three years, and tax and social-security documents for the periods set by the applicable tax and social-security legislation.
- Website request and security logs: the short period applied by the hosting provider.
Who else may receive the data
Personal data is disclosed only where it is necessary. The categories of recipient are:
- the email service provider that operates the company mailbox, which processes the content of email correspondence;
- the website hosting and content-delivery provider, which processes request and security data;
- the accountant engaged by the company, for invoicing and accounting;
- suppliers or subcontractors, only where they need a detail to deliver or install something for your project;
- public authorities, courts and professional advisers, where a legal obligation or the defence of a legal claim requires it.
Personal data is never sold or rented, and it is not used for advertising or shared for advertising purposes. Providers who process data on the company’s behalf do so under a processing agreement as required by Article 28 GDPR. The identity of the current providers is given on request.
Transfers outside the EEA
Some providers, in particular email and content-delivery providers, may process data on infrastructure located outside the European Economic Area or may be part of a group with entities outside it. Where personal data is transferred outside the EEA, the transfer is based on an adequacy decision of the European Commission under Article 45 GDPR, or on standard contractual clauses or other appropriate safeguards under Article 46 GDPR. You may ask the company for information about the safeguards applied to a specific transfer.
Whether you have to provide data
You are not under a statutory or contractual obligation to give the company your personal data. Without contact details and a description of the property, however, the company cannot answer an enquiry or prepare work for you. Once work is agreed, the details needed for invoicing are required by Bulgarian accounting and tax law.
Automated decision-making
No automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR, takes place. No profiling is carried out. The website is not directed at children, and the company does not knowingly collect personal data from them.
Your rights
Subject to the conditions set out in the GDPR, you have the following rights in relation to your personal data:
- access to your personal data and to the information about how it is processed (Article 15);
- rectification of inaccurate or incomplete data (Article 16);
- erasure of your data where one of the grounds in Article 17 applies;
- restriction of processing in the cases in Article 18;
- notification of rectification, erasure or restriction to the recipients of your data (Article 19);
- portability of the data you provided, in a structured, commonly used and machine-readable format, where processing is based on consent or on a contract and is carried out by automated means (Article 20);
- objection, on grounds relating to your particular situation, to processing based on a legitimate interest (Article 21). Where you object, the processing stops unless there are compelling legitimate grounds that override your interests, or the data is needed for legal claims;
- withdrawal of consent at any time, with effect for the future, for any processing that is ever based on consent (Article 7(3));
- not to be subject to a decision based solely on automated processing (Article 22);
- to lodge a complaint with a supervisory authority (Article 77).
How to exercise your rights
Write to georgiev.vsg80@gmail.com or to 3 Petko Karavelov Street, 7000 Ruse, Bulgaria, and say which right you want to exercise.
You will receive a reply without undue delay and in any case within one month of the request. That period may be extended by up to two further months where the request is complex or where several requests have been made, in which case you will be told of the extension and the reasons for it within the first month. Where there is reasonable doubt about who is making a request, the company may ask for further information to confirm your identity. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
Complaint to a supervisory authority
If you believe your data has been processed unlawfully, you may lodge a complaint with the Bulgarian supervisory authority:
- Authority
- Commission for Personal Data Protection (Komisia za zashtita na lichnite danni)
- Address
- 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
- kzld@cpdp.bg
- Telephone
- +359 2 915 3580
- Website
- www.cpdp.bg/en/
You may also complain to the supervisory authority of the EU Member State where you live, where you work, or where you believe the infringement took place, and you have the right to an effective judicial remedy.
Changes to this notice
This notice is updated when the website or the way the company handles personal data changes. The date shown at the top of the page identifies the current version. Company identification details are also set out in the legal notice.