We value your privacy. This Privacy Statement explains how we collect, use, share, and protect your personal data in connection with the provision of individual career consulting, strategic consulting, organizational analyses, and training for organizations.
1. Who are we? (Data Controller)
[Enter Company/Individual Name], with registered office and management address: [Enter address], UIC: [Enter UIC], hereinafter referred to as the “Controller” or “We”.
For questions related to your data, you can contact us and our data protection officer here: Gergana Ilieva Ancheva, [Enter email address], [Enter phone number].
2. What personal data do we collect, from what sources, and why do we do it?
In order to provide our professional services with quality, we collect and process various volumes of information depending on whether you are an individual client or an employee of an organization that has hired us.
- For individual career consultations: To help you find the right professional direction and position yourself in the labor market, you provide us with your professional biography (CV), details of your education, work experience, skills, and a link to your LinkedIn profile. For communication purposes, we use your name, email, and phone number. During sessions, we keep professional notes to track your progress.
- For corporate training and strategic consulting (corporate clients): When we work with organizations to develop their employer brand or conduct internal training, we process business contact data (names, work email, and phone number) of company representatives and training participants. During projects, we collect data from surveys, tests, or session notes in order to prepare final organizational analyses for your management.
- For payment and issuance of documents: Regardless of whether you are an individual or a legal entity, in order to process payment and issue you a legitimate invoice, we may collect the legally required data necessary for issuing accounting documents and making and verifying payments, including bank details, where applicable.
- When visiting our website: To ensure the security of our digital infrastructure and improve the site’s performance, our systems automatically process basic online identifiers such as your IP address, cookies, and location data. This data is processed on the basis of legitimate interest under Art. 6(1)(f) GDPR for the security and normal functioning of the site. Necessary cookies are used on the same basis and do not require consent, while optional cookies are used only after prior consent under Art. 6(1)(a) GDPR.
Outside of cases with a legal, contractual, or other legitimate basis, the processing of your personal data will only be carried out after obtaining your explicit written consent.
We do not carry out automated decision-making or profiling within the meaning of the General Data Protection Regulation (GDPR) that would produce legal effects for data subjects.
We do not process special categories of personal data within the meaning of Art. 9 GDPR and Art. 51 of the Bulgarian Personal Data Protection Act.
The data is obtained directly from you (forms, email, contracts, etc.), from your employer (for example, upon a request for corporate training or when included in contracts we sign), or from publicly available professional networks (e.g., LinkedIn), where this is strictly necessary for the provision of the service.
Below is a personal data processing matrix, in accordance with the requirements of Art. 13 GDPR:
| Category of personal data | Specific types of personal data | Purpose of processing | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Physical and social identity | Full name, photo, CV/professional biography, education and work experience, LinkedIn profile. | Provision of individual career consulting, professional development and market positioning, conclusion and performance of contracts. | Art. 6(1)(b) (Performance of a contract or pre-contractual relations). |
| Contact details | Email address, phone number, physical correspondence address. | Correspondence, organizing training, conducting sessions and strategic consulting. | Art. 6(1)(b) (Contract) and Art. 6(1)(f) (Legitimate interest). |
| Financial information | Bank account, financial data, payment details. | Invoicing of services, payment processing, and fulfillment of accounting obligations. | Art. 6(1)(c) (Compliance with a legal obligation under the Accountancy Act). |
| Digital identity (Online identifiers) | IP address, cookies, location data. | Technical support of the systems used and platform security. | Art. 6(1)(f) (Legitimate interest in maintaining IT systems). |
| Professional notes and analyses | Session and training notes, participant data, organizational analyses for employer branding. | Conducting training for organizations, preparing analyses for corporate clients, and tracking progress. | Art. 6(1)(b) (Performance of the concluded training/consulting contract). |
3. Personal data retention periods
We will process and store the categories of personal data described above for no longer than necessary to achieve the purposes for which they were collected, and in accordance with applicable legal requirements. Where legislation provides for mandatory retention periods for certain documents or information, personal data will be stored for the respective statutory period. Where no such period is provided, the data will be stored for a reasonable period, determined according to the nature of the service, the purposes of processing, and the need to protect the company’s legitimate interests.
Personal data processed in connection with individual career consultations, including CVs, professional profiles, questionnaire results, and work notes, are stored until the completion of the service provided and are then deleted or anonymized without undue delay, except where, for the specific case, their retention is necessary for the fulfillment of a legal obligation or for the establishment, exercise, or defense of legal claims.
Contracts, correspondence related to their performance, and related documentation are stored for the duration of the contractual relationship and for a 5-year period after its termination, insofar as this is necessary for the establishment, exercise, or defense of legal claims, as well as for compliance with applicable legal requirements.
Accounting documents and information necessary for the fulfillment of tax, accounting, and other regulatory obligations are stored for the periods provided for in the applicable legislation.
When visiting the website, data may be processed through cookies and similar technologies. The retention periods for this data are specified in the Cookie Policy and in the settings of the cookies used. Data in server logs is stored in accordance with the policies and periods of the hosting service provider.
Upon expiry of the applicable retention periods, personal data is destroyed, anonymized, or other appropriate measures are taken to stop identifying the data subjects.
4. How do we protect your personal data?
We process your personal data in accordance with the requirements of the General Data Protection Regulation (GDPR), the Personal Data Protection Act, and applicable Bulgarian and European legislation. We take the necessary technical and organizational measures to ensure an appropriate level of security for the personal data processed and to prevent its accidental or unlawful loss, destruction, alteration, disclosure, or unauthorized access.
We apply protective measures that may include:
- use of secure and encrypted connections for data transfer;
- access control through passwords and other authentication means;
- limiting access to personal data only to persons for whom this is necessary in connection with the performance of their job duties;
- storage of paper documents in secure and controlled premises;
- use of reliable cloud and information service providers;
- periodic review of the security measures applied.
We make reasonable efforts to keep personal data accurate, up to date, and protected throughout the entire period of its processing.
5. Who do we share your data with?
Your trust is important to us, which is why we do not sell or share your data with third parties for marketing purposes.
In order to fulfill our commitments to you, comply with the law, or protect our legitimate interests, we share personal information only with verified partners and institutions:
- Accounting firms and accountants: For financial and accounting services related to payments and invoices.
- Information service providers: For maintenance of the software, website, and system security.
- Government authorities (National Revenue Agency, National Social Security Institute, law enforcement authorities): Only when we are legally obligated to provide information.
- Lawyers, legal advisors, and courts: When necessary for legal protection or dispute resolution.
6. Transfer of data outside the EU and EEA
In connection with the provision of our services, the Controller may use external providers of email, cloud data storage, video conferencing, online training, communication, and other technological solutions.
Due to the nature of these services, personal data may be processed or stored in countries outside the European Union and the European Economic Area. When choosing such providers, the Controller strives to use established and reliable providers that apply measures to protect personal data and declare compliance with the applicable data protection requirements (Google, Microsoft, Dropbox Sign, etc.).
7. Your rights under the GDPR
As a data subject, at any time while we store or process your personal data, you have the following rights:
- you have the right to request a copy of your personal data from us and the right of access to your personal data at any time;
- you have the right to request from us your personal data in a format convenient for transfer to another data controller, or to request that we do so, without being hindered by us;
- you have the right to request that we correct, without undue delay, your inaccurate personal data, as well as data that is no longer up to date;
- you have the right to request that we erase your personal data without undue delay where one of the following grounds applies: the personal data is no longer necessary for the purposes for which it was collected; where you have withdrawn your consent; where you have objected to the processing; where the processing is unlawful; where the personal data must be erased for compliance with a legal obligation under EU or Member State law applicable to us as data controller; or where the personal data was collected in relation to the offer of information society services.
We may refuse to erase your personal data for the following reasons:
- exercising the right to freedom of expression and information;
- compliance with a legal obligation on our part or for the performance of a task carried out in the public interest;
- reasons of public interest in the area of public health;
- for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
- or for the establishment, exercise, or defense of legal claims.
- you have the right to request that we restrict the processing of your personal data, in which case the data will only be stored but not processed. Our refusal to restrict will be provided explicitly in writing only, and we are obliged to justify it with a lawful reason;
- you have the right to withdraw your consent to the processing of your personal data at any time, by a separate request submitted to the Controller;
- you have the right to object to certain types of processing, such as direct marketing (unsolicited commercial communications);
- you have the right to object to automated processing, including profiling;
- you have the right not to be subject to a decision based solely on automated processing, including profiling;
- if we need to use your personal data for a new purpose not covered by this Privacy Statement, we will provide you with a new data protection notice and, where and when necessary, will request your prior consent for the new processing.
To exercise these rights, please send a written request to the email: [Enter email address].
You also have the right to lodge a complaint with the Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., Sofia), and you may submit the complaint in person or through us.