Notice on data protection to applicants for obtaining a license to drive a motor vehicle, for training in ADR - dangerous goods courses and for professional competence from "POLICAR RUSE" OOD
What is the purpose of this document?
For "POLICAR RUSE" OOD, the protection of your privacy and the security of your personal information are top priorities.
This notice describes how we collect and use your personal information before, during and after you complete your training for a professional qualification. All activities described here are in compliance with the General Data Protection Regulation (Regulation 2016/679) (GDPR).
"POLICAR RUSE" OOD is the administrator of personal data. This means that we are responsible for the decisions we make about the storage and use of your personal information. We have an obligation under data protection legislation to provide you with the information contained in this notice.
It is important that you read this notice carefully to understand how and why we use your personal information.
I. Principles of data protection
We will comply with data protection legislation as follows:
1. to be processed lawfully, in good faith and transparently;
2. to be collected only for valid purposes that we have clearly explained and not to be used in any other way that is not compatible with those purposes;
3. be appropriate, related to and not exceeding what is necessary for the purposes we have specified;
4. to be in an accurate and up-to-date form;
5. to be stored for a period not longer than necessary for the purposes we have indicated;
6. to be properly protected.
II. What information do we have about you?
"Personal data" or "personal information" means any information about an individual by which that individual is or can be identified.
There are special categories of more sensitive personal data that also require a higher level of protection.
We will collect, store and use the following categories of personal data about you:
• Name, address, telephone number and email address;
• Date of birth, social security number;
• ID card number and date of issue;
• Information on health status/medical certificate/;
• Document of completed education;
• Photographs;
III. How do we collect your personal data?
We collect your personal data before starting the training. The provision of this information is carried out directly by you as a candidate. Sometimes we may also receive personal data from third parties – for example, employers, etc.
IV. How will we use your personal data?
We will only use your personal data where permitted by law. We will most often use your personal data on the following grounds:
1. for the performance of our contract with you;
2. to comply with a legal obligation - according to the type of training, respectively: IA"AA", NRA, MT, according to their respective requirements.
V. Situations in which we will use your personal data
We will use the categories of personal data listed above primarily to fulfill our contractual obligations to you and to comply with our legal obligations. In some cases, we may use your personal data for our legitimate interests or those of third parties, but only if your interests or fundamental rights do not override those interests.
The situations in which we will process your personal data include:
• Issuance of documents related to certification of completed training for the specified type of professional qualification.
VI. If you do not provide us with the personal data that we request
Failure to provide the personal information requested by you may prevent us from fulfilling our contract with you (for example, we may not be able to issue you the relevant document).
Your refusal to provide the necessary information for the fulfillment of the rights and obligations under the contract may be the reason for its not being concluded or for its termination.
VII. Changing goals
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason, and that reason is compatible with the original purpose. If we need to use your personal data for another purpose, we will notify you and explain the legal basis for this use.
VIII. Data sharing
We may share your personal data with third parties, including service providers.
We require all third parties to respect data security and comply with data protection legislation.
We will share your personal data with third parties when required by law.
These third parties may include: companies, IA "AA".
IX. How do we ensure the security of your information when we provide it to third parties?
All service providers [and other companies – part of our corporate group] are required to take appropriate security measures to protect your personal information. They may not use your personal data for their own purposes, but only for the purposes we have determined and in accordance with our instructions.
X. Data Security
We have implemented appropriate measures to prevent the accidental loss, use or unauthorized access, alteration or disclosure of your personal data. In addition, we limit access to your personal data to those employees and third parties who have a need to receive this information. They will only process personal data based on our instructions and in accordance with their obligation of confidentiality.
XI. How long will we use your personal data?
We will only keep your personal data for the period for which we need it to fulfill the purposes for which we collected it, including to comply with the requirements of employment, social security and accounting legislation.
To determine the appropriate retention period, we take into account the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of the data, the purposes for which we process it or whether we could achieve those purposes with others funds, as well as applicable legal requirements.
In some situations, we may anonymize your personal data so that it can no longer be associated with you. As a result, we may continue to use the anonymized data without notifying you. After the termination of your contractual relationship with us, we will store your information in accordance with our policies and legal requirements and destroy it in a secure manner after the retention period described in our policy and regulated by law has expired.
XII. Right of access, correction, erasure and restriction
Your obligation to notify us of a change:
It is important that we keep your personal information accurate and up-to-date. Please notify us of any changes to your personal data.
Your rights in relation to your personal data:
• Access to information: this right gives you the opportunity to obtain a copy of the personal data we hold about you and to check whether we have a legal basis for processing it.
• Correction: this right enables you to ask us to correct any incomplete or inaccurate information about you.
• Erasure: this right enables you to ask us to delete or remove your personal data when we have no valid reason to continue processing it. You also have the right to request that your data be deleted or removed when you have exercised your right to object to its processing.
• Object to processing: in cases where we rely on our legitimate interests as a basis for processing, you can object to this processing.
• Restriction of processing: this right enables you to ask us to temporarily stop processing your personal data if, for example, you want to establish the accuracy of the data or the reasons for its processing.
• Data portability: this right is limited to cases where the data has been provided by you to us for the purposes of a contract and enables you to require us to provide your data stored in electronic form to a third party.
Upon such request by you, we may need you to provide us with information confirming your identity. This requirement is part of our data protection measures and aims to ensure that personal information is not provided to a person who does not have the right to receive it.
You have the right to file a complaint at any time with the Commission for Personal Data Protection - the Bulgarian data protection regulatory body.
XIII. Right to withdraw your consent
In case you have provided your express consent to the processing of your personal data for a specific purpose, you have the right to withdraw this consent. Upon receipt of your request, we will cease processing the data for the purpose(s) for which you originally consented, unless we have another legal basis to continue processing, of which we will notify you in a timely manner.