Information about the company processing your data:

Name: Lotse Ltd 

UIC: 131427108

Headquarters and Address of Administration: Sofia (Capital), Municipality: Sofia, Settlement: Sofia city, P.O. Box 1408, Triaditsa District, 19 Enos Str.

Correspondence Details: Sofia – 1616
Goljama mogila Str. Nu. 61, email: bulgaria@lotse.org, phone number +359 2 9515999

(2) Commission for Personal Data Protection:

Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2

Phone: 02/915 35 18, 02/915 35 15, 02/915 35 19

Fax: 02/915 35 25

е-mail kzld@cpdp.bg

Website: www.cpdp.bg

Lotse Ltd (Hereinafter referred to as “the Administrator” or Lotse) carries out its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. This information aims to inform you about all aspects of the processing of your personal data by the Company and the rights you have in relation to this processing.

Basis for the collection, processing, and storage of your personal data

Article 1. Lotse collects and processes your personal data in connection with the conclusion and execution of contracts with the Company based on Article 6, paragraph 1, Regulation (EU) 2016/679 (GDPR), and specifically on the following grounds:

• For taking steps at your request to conclude a contract, if you are a job applicant with us;
• For the performance of a contract or taking steps to conclude such a contract with a business partner;
• To comply with a legal obligation applicable to the Administrator;
• For the legitimate interests of the Administrator or a third party.

Purposes and principles of collecting, processing, and storing your personal data

Article 2. (1) When entering into a contract with a business partner or a business entity-client, we collect and process personal data regarding the name of the legal representative of the legal entity – the contracting party, for the purpose of identifying the contracting party and fulfilling the contract.

(2) Contact details of the legal representative or the contact employee are considered business information and, as such, are not regarded as personal data.

Article 3. (1) We collect and process the personal data that you provide when applying for a job at Lotse, including for the following purposes:

• Identifying the candidate;
• Contacting you and maintaining communication;
• Conducting candidate selection.

(2) We retain your personal data that you have provided for the entire duration of the job advertisement. If we wish to continue storing your data beyond this period for the purpose of further communication, we will send you an email inquiry asking for your explicit consent to keep your data stored.

Article 4. We adhere to the following principles when processing your personal data:

• Lawfulness, fairness, and transparency;
• Limitation of the processing purposes;
• Relevance to the purposes of processing and minimizing the data collected;
• Accuracy and up-to-date data;
• Limitation of storage for achieving the purposes;
• Integrity and confidentiality of processing, ensuring an appropriate level of security for personal data.

Article 5. In the processing and storage of personal data, the Administrator may process and store personal data for the purpose of protecting the following legitimate interests: fulfilling obligations to the National Revenue Agency, Ministry of Internal Affairs, and other state and municipal authorities.

What types of personal data does our company collect, process, and store?

Article 6. (1) Lotse performs the following operations with the personal data provided by you as job applicants for the following purposes:

• Conclusion and performance of an employment or civil contract with an individual: For the purpose of candidate selection, we process the personal data you have sent us in your CV.
• Conclusion from impact assessment: Due to the small number of individuals whose data is processed and the limited volume of personal data collected, conducting an impact assessment is not required for this operation.

(2) The Administrator does not collect or process personal data that relates to the following:

• Reveals racial or ethnic origin;
• Reveals political, religious, or philosophical beliefs, or membership in trade unions;
• Genetic and biometric data, health data, or data regarding sexual life or sexual orientation.

(3) The personal data is collected by the Administrator from the individuals to whom it pertains.

(4) The Administrator does not perform automated decision-making with data.

Article 7. (1) Lotse performs the following operations with the personal data provided by you as legal representatives or authorized persons of legal entities—business partners and clients—for the following purposes:

• Conclusion and performance of a business transaction with a counterparty or a contract with a client: For concluding and executing a business transaction with a company, we process only the full name of the legal representative or the authorized person of the company.
• Conclusion from impact assessment: Due to the small number of individuals whose data is processed and the limited volume of personal data collected, conducting an impact assessment is not required for this operation.

(2) The personal data is collected by the Administrator from the individuals to whom it pertains and from the Commercial Register at the Registry Agency.

(3) The Administrator does not perform automated decision-making with data.

Article 8. (1) Lotse performs the following operations with the personal data provided by you as participants in events organized by the Administrator, for the following purposes:

• Registration of a participant in events and sending information: For participation in events organized by Lotse, we process the full name, email address, and phone number of the individual participant.
• Conclusion from impact assessment: Due to the small number of individuals whose data is processed and the limited volume of personal data collected, conducting an impact assessment is not required for this operation.

(3) The personal data is collected by the Administrator from the individuals to whom it pertains.

(4) The Administrator does not perform automated decision-making with data.

Article 9. (1) Lotse performs the following operations with the personal data you provide as an individual requesting to receive the newsletter, for the following purposes:

• Sending the newsletter: To send the newsletter, we process the full name and email address of the individual.
• Conclusion from impact assessment: Due to the small number of individuals whose data is processed and the limited volume of personal data collected, conducting an impact assessment is not required for this operation.

Article 10. (1) Lotse performs the following operations with the personal data you provide as individuals who have submitted an inquiry through the form on the Company’s website www.lotse.org:

• Processing of inquiries sent through the form on the website www.lotse.org – the purpose of this operation is to establish contact with the inquirer via email for the purpose of responding to the inquiry, identifying the data subject as the inquirer, and sending a response to the inquiry or offer.
• Conclusion from impact assessment: Given the limited scope of the personal data collected, conducting an impact assessment for this operation is not necessary.

(2) The personal data is collected by the Administrator from the individuals to whom it pertains.

(3) The Administrator does not perform automated decision-making with data.

Retention Period of Your Personal Data

Article 11. (1) Lotse retains your personal data as a job applicant for no longer than the duration of the active job advertisement published on our website or elsewhere. After the advertisement period expires or the selection process is completed, Lotse will take the necessary steps to delete and destroy all your data without undue delay, or anonymize it (i.e., convert it into a form that does not reveal your identity), unless you explicitly consent to your data being stored and processed further.

(2) Lotse retains the personal data of legal representatives of legal entities – contracting parties with the company indefinitely, for the purpose of protecting Lotse ‘s legitimate interests and fulfilling its legal obligations to state authorities and institutions.

(3) The Administrator will notify you if the retention period of the data needs to be extended in order to fulfill a legal obligation or for the legitimate interests of the Administrator or others.

Transfer of your personal data for processing

Article 12. (1) The Administrator may, at its discretion, transfer part or all of your personal data to data processors for the fulfillment of the processing purposes to which you have consented, in compliance with the requirements of Regulation (EU) 2016/679 (GDPR).

(2) The Administrator will notify you in case of an intention to transfer part or all of your personal data to third countries or international organizations.

Your Rights in Relation to the Collection, Processing, and Storage of Your Personal Data

Withdrawal of Consent for the Processing of Your Personal Data

Article 13. (1) If you do not wish all or part of your personal data to continue being processed by Lotse for a specific or all processing purposes, you may withdraw your consent for processing at any time by sending a request in free text.

(2) The Administrator may request that you verify your identity and the identity of the individual to whom the data pertains by presenting an identification document in person.

(3) Withdrawing consent does not affect the lawfulness of the processing of your personal data up to the point of withdrawal of consent.

(4) Lotse may continue processing part or all of your data if there is a legal obligation to do so or for the purpose of protecting its legitimate interests.

(5) For legal representatives and individual contract partners with the company, paragraph (4) applies.

Right of Access

Article 14. (1) You have the right to request and receive confirmation from the Administrator as to whether personal data related to you is being processed.

(2) You have the right to access the data related to you, as well as the information regarding the collection, processing, and storage of your personal data.

(3) The Administrator will provide, upon request, a copy of the personal data being processed related to you, in electronic or other appropriate form.

(4) Providing access to the data is free of charge; however, the Administrator reserves the right to impose an administrative fee in case of repeated or excessive requests.

Right to Rectification or Completion

Article 15. You have the right to request that the Administrator:

• Correct inaccurate personal data related to you;
• Complete incomplete personal data related to you.

Right to Deletion (“Right to be Forgotten”)

Article 16. (1) You have the right to request that the Administrator delete part or all of the personal data related to you, and the Administrator is obligated to delete them without undue delay when one of the following grounds applies:

• The personal data is no longer necessary for the purposes for which it was collected or processed in another way;
• You withdraw your consent on which the processing of the data is based and there is no other legal basis for the processing;
• You object to the processing of your personal data, including for direct marketing purposes, and there are no overriding legitimate grounds for the processing;
• The personal data has been processed unlawfully;
• The personal data must be deleted in order to comply with a legal obligation under EU law or the law of a member state that applies to the Administrator;
• The personal data was collected in connection with the offering of information society services.

(2) The Administrator is not obliged to delete personal data if it retains and processes it:

• for exercising the right to freedom of expression and the right to information;
• to comply with a legal obligation requiring processing under EU law or the law of a member state that applies to the Administrator, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Administrator;
• for reasons of public interest in the field of public health;
• for archival purposes in the public interest, for scientific or historical research, or for statistical purposes;
• for the establishment, exercise, or defense of legal claims.

(3) In the case of exercising your right to be forgotten, the Company will delete all your data except for your full name as a job applicant, for accountability purposes.

(4) The data of legal representatives of commercial companies – partners and clients under contract with the company will continue to be stored and processed, despite a request for deletion, based on compliance with the company’s legal obligations, the protection of legitimate interests, and the establishment, exercise, or defense of legal claims.

(5) To exercise your right to be forgotten, you must send a request in free text and verify your identity with an identification document in person.

Right to Restriction

Article 17. You have the right to request that the Administrator restrict the processing of data related to you when:

• You contest the accuracy of the personal data for a period that allows the Administrator to verify the accuracy of the personal data;
• The processing is unlawful, but you do not wish for the personal data to be deleted, only for its use to be restricted;
• The Administrator no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defense of your legal claims;
• You have objected to the processing, awaiting verification of whether the legitimate grounds of the Administrator override your interests.

Right to Data Portability

Article 18. (1) If you have given consent for the processing of your personal data, or if processing is necessary for the performance of the contract with the Administrator, or if your data is processed automatically, you may, after verifying your identity with the Administrator:

• Request that the Administrator provide your personal data in a readable format and transfer it to another Administrator;
• Request that the Administrator directly transfer your personal data to another administrator specified by you, where technically feasible.

(2) You can exercise your right to data portability by sending a request in free text.

Right to Receive Information

Article 19. You may request from the Administrator to inform you of all recipients to whom the personal data for which correction, deletion, or restriction of processing has been requested, have been disclosed. The Administrator may refuse to provide this information if it is impossible or would require disproportionate effort.

Right to Object

Article 20. You may object at any time to the processing of personal data by the Administrator related to you, including if it is processed for profiling or direct marketing purposes.

Your Rights in the Event of a Personal Data Security Breach

Article 21. (1) If the Administrator detects a personal data security breach that may result in a high risk to your rights and freedoms, they will notify you without undue delay of the breach and the measures that have been or will be taken.

(2) The Administrator is not obligated to notify you if:

• Appropriate technical and organizational measures have been taken to protect the data affected by the security breach;
• Subsequent measures have been taken to ensure that the breach will not result in a high risk to your rights;
• Notification would require disproportionate effort.

Persons to Whom Your Personal Data Is Provided

Article 22. For the purposes of processing your personal data and fulfilling the concluded contract, Lotse may provide your data to third parties – data processors who comply with all legal and security requirements regarding the processing and storage of your personal data.

Article 23. The Administrator does not transfer your data to third countries.

Other Provisions

Article 24. In the event of a violation of your rights under the above or applicable data protection legislation, you have the right to file a complaint with the Commission for the Protection of Personal Data as follows:

Name: Commission for the Protection of Personal Data

Headquarters and Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2

Correspondence Address: Sofia 1592, Prof. Tsvetan Lazarov Blvd. No. 2

Phone: 02 915 35 18

Website: www.cpdp.bg

Article 25. You can exercise all your rights regarding the protection of your personal data through the forms attached to this information. Of course, these forms are not mandatory, and you may submit your requests in any form that contains a statement and identifies you as the data subject.

Article 26. (1) When you instruct Lotse to process personal data of a third party for the purposes of using the service, Lotse acts as the data processor.

(2) In the cases mentioned in paragraph 1, Lotse acts solely according to your instructions as the service user and only to the extent that it can control the personal data you process. Lotse has no control over the content and data that you, as the service user, choose to upload into the service (including whether or not these data include personal data). In this case, Lotse has no role in deciding whether the user uses the service to process personal data, for what purposes, and whether the data is protected. Accordingly, Lotse ‘s responsibility in this case is limited to 1) complying with the service user’s instructions as per the contract, and 2) providing information about the service and its functionalities through its interface.

Lotse ensures that it will refer to this Mandatory Information with a link to its website, providing the necessary details or in any other appropriate manner that guarantees you have the opportunity to familiarize yourself with its content. In case of any discrepancies between the English translation and the Bulgarian version, the Bulgarian text shall take precedence and be considered the binding version for any claims or disputes.