Mandatory information about the Privacy Rights
Information about the organization processing your data:
Name: Foundation “STUDY IN BULGARIA”
Registration number: 177037884
Headquarters and address: 74, Gen. Gurko Str., Sofia 1142, Bulgaria
Address for correspondence: 74, Gen. Gurko Str., Sofia 1142, Bulgaria
Phone: +359 879 122 340
E-mail: office@edus.bg
Website: https://studyinbulgaria.bg
Information about the competent supervisory authority on the protection of personal data:
Commission for Personal Data Protection
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +359 2 915 3 518
Website: www.cpdp.bg
1. Using our system requires personal details.The provided personal data is processed by Foundation „Study in Bulgaria“ for the purpose of my Application and enrolment as a student in Bulgaria. Foundation “STUDY IN BULGARIA” (hereinafter referred to as the “Foundation” only) collects and processes your personal data to provide information on the provision of its education services under Regulation (EU) 2016/679 and in particular on the following grounds:
• Your explicit consent as a user (applicant);
• Implementation of the Foundation's obligations;
• For the legitimate interests of the Foundation or a third party
Objectives and principles of collecting, processing and storing your personal data
2. 1. We collect and process the personal data you provide to the Foundation for the provision of its services, including for the following purposes:
• Individualization of the application process;
• Accounting purposes;
• Statistical purposes;
• Protection of information security;
• Ensuring the fulfillment of the contract for the provision of the respective service;
• Sending a newsletter or catalog at your request.
2.2. We comply with the following principles when processing your personal information:
• Legality, good faith and transparency;
• Limitation of processing goals;
• Relevance to processing goals and minimization of collected data;
• Accuracy and timeliness of the data;
• Restriction of storage in order to achieve the objectives;
• Integrity and confidentiality of processing and ensuring an adequate level of security of personal data.
2.3. In the processing and storage of personal data, the Foundation may process and store personal data in order to protect its legitimate interests:
• Fulfilling its obligations to the National Revenue Agency, the Ministry of Interior and other state and municipal authorities.
• It is possible, at the request of a state or judicial authority, and subject to a legal obligation, for the Foundation to disclose the personal data, including for national security purposes.
What kind of personal data collects, processes and stores our Foundation
3. The Foundation carries out the following operations with the personal data you provide for the following purposes:
• Service delivery – the purpose of the operation is to provide a service and administer it. When the Foundation must perform its admission service at https://studyinbulgaria.bg for the purposes of the service you provide, these data are inevitably needed. In some cases, the purpose of the operation may also be to protect the legitimate interests of the Service Implementation of the Foundation. The Foundation collects and processes data of applicants / users for application at an educational establishment, and in the current operation, the Foundation collects and processes your personal data as a processor.
Conclusion of the Impact Assessment: Based on the Impact Assessment carried out, the Service Execution operation is eligible and provides sufficient safeguards to protect the rights and legitimate interests of the data subjects in line with the GDPR requirements.
• Processing requests sent through the website https://studyinbulgaria.bg - the Foundation processes as your administrator your personal data for the purpose of contacting the applicant by email or telephone for the purpose of responding to the request, identifying the data subject as requesting and responding to a request.
• Sending a Newsletter (Newsletter) - the Foundation processes your data as an administrator for the purpose of administering the bulletin sending process to the persons who have declared they wish to receive.
• Sending a catalog - the Foundation processes your data as an administrator to administer the process of sending a catalog to those who have declared they wish to receive.
4.1. The Foundation processes the following categories of personal data and information for the following purposes:
• Service data (names, address, telephone, email, educational grade, gender, personal picture, birth date, age, place of birth, school / class data, language proficiency, health status, nationality data, native language data, identity card details, race data):
- Purpose for which data is collected: 1) identification of the person as an applicant (user), 2) contact with him and 3) performance of the services;
- Reason for processing your personal data – sending an application form creates a contractual relationship on which we process your personal data - Article 6 para 1 b EU-GDPR; Health data and data on racial or ethnic origin are processed on the basis of an explicit consent - Article 9 para 2 b (a) EU-GDPR.
• Online request (names, email, phone number)
• Newsletter Receipt (e-mail):
- Purpose for which data is collected: 1) contacting and sending information to the person, 2) for the purpose of sending a subscription request to receive a newsletter on the website, and 3) sending a newsletter.
- Reason for handling your personal data - your data for submitting a newsletter is processed based on your explicit consent - Article 6 para 1 b EU-GDPR.
• Data to receive a catalog:
- Purpose for which data is collected: 1) contacting and sending information to the person, 2) for the purpose of sending a subscription request for the receipt of a catalog, and 3) for sending an information catalog.
- Reason for processing your personal data - your data for submitting an information catalog is processed based on your explicit consent - Article 6 para 1 b EU-GDPR.
4.2. The Foundation does not collect or process personal data that relate to the following:
• Reveal racial or ethnic origin;
• Disclose political, religious or philosophical beliefs, or membership of trade unions;
• Genetic and biometric data, health data or data on sexual life or sexual orientation other than those provided for in Article 9 para 2 EU-GDPR.
4.3. Personal data are collected by the Foundation from the persons to whom they refer or from their legal representatives.
4.4. The Foundation does not make automated decision-making with data.
4.5. The Foundation may collect and process personal data for persons under the age of 16 only with the explicit consent of their parent or legal representative.
Term of storage of your personal data
5. 1. The Foundation keeps your personal data for up to 5 years after termination for the purposes of the legitimate interests of the Foundation in legal or administrative disputes and the accounting documents are kept for the relevant statutory term.
5.2. The Foundation shall store the personal data of persons who have made a request via the website, until the explicit withdrawal of the given consent by the person or a period of up to 5 years after the processing of the application.
5.3. The Foundation keeps the personal data of the persons subscribed to a newsletter or catalog until the consent is withdrawn by the person.
5.4. The Foundation keeps the personal data of the persons who have made comments on the Foundation's website until the person has withdrawn the consent.
Transmission of your personal data for processing
6. The Foundation provides part or all of your personal data to another administrator or processor of personal data.
6.1. The Foundation may transfer some or all of your personal data to another administrator or processor of the personal data for the fulfillment of the processing objectives you have agreed to, subject to the requirements of Regulation (EU) 2016/679.
Your rights in collecting, processing and storing your personal data
Withdrawal of consent to process your personal data
7.1. If you do not wish all or any of your personal data to continue to be processed by the Foundation for any particular or for any processing purpose, you may at any time withdraw your consent to process the data processed on the basis of consent by request in free text, addressed to the Foundation at the above address and / or e-mail address.
7.2. Withdrawal of consent does not affect the merits of processing the personal data you provide until the withdrawal of the consent.
7.3. You may withdraw at any time your consent to process your personal data for the purposes of direct marketing.
7.4 The Foundation may continue to process some or all of your data if there is a legal obligation to do so or for the purpose of preserving their legitimate interests.
Right of access
8.1. You have the right to request and obtain from the Foundation a confirmation that personal data relating to you are being processed.
8.2. You have the right to access the data relating to you as well as the information relating to the collection, processing and storage of your personal data.
8.3. Upon receipt of the request, within a reasonable and sufficient time, but not more than one month, the Foundation will provide you with a copy of the personal data processed with you in electronic or other appropriate form upon request.
8.4. Providing access to the data is free of charge, but the Foundation reserves the right to impose an administrative fee in the event of recurrence or disproportionate claims.
8.5. A request to see or change your data or to have your data removed is free of charge, unless it is manifestly unfounded. If that is the case, the Foundation can decide not to process your request, or charge you a fee for administrative costs.
Right of adjustment or replenishment
9. You have the right to request from the Foundation, by free text request, the Foundation to:
• correct inaccurate personal data associated with you;
• fill in the incomplete personal data associated with you.
Right to erasure (“right to be forgotten”)
10.1. You have the right to request the Foundation to erasure some or all personal data related to you and the Foundation as Administrator has the obligation to erasure them without undue delay when any of the following reasons exists:
• Personal data are no longer needed for the purposes for which they were collected or otherwise processed;
• You withdraw your consent on which the processing of the data is based and there is no other legal basis for the processing;
• You object to the processing of personal data related to you, including for the purposes of direct marketing, and there are no legitimate grounds for processing that have an advantage;
• Personal data were processed unlawfully;
• Personal data must be deleted in order to comply with a legal obligation under EU law or the law of Bulgaria that applies to the Foundation;
• Personal data have been gathered in connection with the provision of information society services.
10.2. The Foundation is not obliged to erasure personal data if it stores and processes it:
• exercising the right to freedom of expression and the right to information;
• compliance with a legal obligation that requires treatment provided for under EU law or the law of Bulgaria applicable to the Foundation as an administrator or for the performance of a public interest task or the exercise of official authority conferred on it;
• for reasons of public interest in the field of public health;
• for purposes of archiving in the public interest, for scientific or historical research or for statistical purposes;
• for the establishment, exercise or protection of legal claims.
10.3. In the event that you exercise your right to be forgotten, the Foundation will delete all your data, except for the information that is necessary to verify that your right to be forgotten is fulfilled.
10.4. To exercise your right to be forgotten, you need to submit a request in free text.
Right of limitation
11. You have the right to request from the Foundation to limit the processing of related data when:
• question the accuracy of personal data for a period that allows the Foundation to verify the accuracy of personal data;
• processing is illegal, but you do not want personal data to be erased, but only to be restricted;
• The Foundation no longer requires personal data for the purposes of processing, but you require them to establish, exercise or protect your legal claims;
• You have objected to the treatment pending verification that the Foundation's legitimate grounds have an advantage over your interests.
Right of portability
12. 1. You may at any time receive in a machine-readable format the data stored and processed for you in connection with the use of the Foundation's services.
12.2. You can ask the Foundation as an administrator to directly transfer your personal data to an administrator you specify when it is technically feasible.
12.3. The Foundation may ask you to verify your identity and identity with the person to whom the data relate.
Right to receive information
13. 1. You may request the Foundation to inform you of all recipients to whom personal data for which correction, deletion or limitation of the processing has been requested has been disclosed. The Foundation may refuse to provide this information if this would be impossible or requires a disproportionate effort.
13.2. Upon receipt of a request in connection with any of the above rights under Art. 7 - 13, the Foundation may require You to certify your identity and identity with the data subject.
Right of objection
14. You may object at any time to the processing of personal data by the Foundation that apply to you, including whether processed for profiling or direct marketing purposes.
Your rights in violation of the security of your personal data
15.1. If the Foundation detects a breach of security of your personal data that may pose a high risk to your rights and freedoms, it shall inform you without undue delay of the violation and of the measures taken or to be taken.
15.2. The Foundation is not required to notify you if:
• has taken appropriate technical and organizational protection measures with respect to the data affected by the security breach;
• has subsequently taken measures to ensure that the violation will not lead to a high risk for your rights;
• notification would require disproportionate efforts.
16. The Foundation does not transfer your data to third countries.
17. If you are not satisfied with the use of your personal data and/or in case of violation of your rights under the above or applicable data protection laws, you are entitled to file a complaint with the Personal Data Protection Commission as follows:
Commission for Personal Data Protection
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Phone: +359 2 915 3 518
Website: www.cpdp.bg
18. You may use all of your rights to protect your personal data in the forms enclosed with this information, these forms being optional and you may also make your claim in any other form that contains a statement and identifies you as an owner of the data.
Please note that if you do not wish to process your personal information in the manner described in this document, you are entitled not to provide it to us. Your provision of personal data is entirely voluntary and in order to provide full quality service on our part.
Please be advised that any possible future changes to this Privacy Policy will be posted on this page and brought to your knowledge in a timely and proper manner.
Date: 21st April 2019