bg

Data Privacy

Last updated: 07/05/23

The protection of personal data and provision of transparency in relation to the processing of personal data are important for Allatra HR OOD (Allatra/the Company). In this regard, and in compliance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), we bring to your attention general information about us and our processing of personal data in the various relationships in which we are involved.

Contact details

Allatra HR OOD, UIC: 206840846, registered in the Commercial Register and the Register of Non-Profit Legal Entities is controller of personal data within the meaning of the General Data Protection Regulation. The address of the Company is 1421 Sofia, Lozenets region, 123 Arsenalski boulevard, fl.1, ap. office 2.

Data Protection Officer

The data protection officer of Allatra is Nevena Temelkova (AMATAS EAD, UIC: 204235460). If you have questions regarding the processing of personal data by Allatra, you can contact the data protection officer via email at dpo@amatas.eu and via telephone at +359 87 9580 777.

Data protection rights

Data subjects have the following rights in the processing of their personal data:

  • right of access – you have the right to obtain information from us about whether personal data relating to you is being processed; you have the right to obtain access to the data and information relating to the processing;
  • right to rectification – you have the right to ask us to rectify inaccurate personal data related to you and to provide additional data;
  • right to erasure – you have the right to ask us to erase your personal data and this data to be erased; the data may not be erased despite your request, where there is a legitimate ground for processing, and each case is considered separately and data subjects are informed of the decision taken;
  • right to restriction of processing – this right you may exercise in the following situations: a) when you dispute the accuracy of the personal data, for a period that allows the Company to verify its accuracy; b) when the processing is unlawful, but you do not wish the personal data to be erased, but request instead that their use be restricted; c) when the Company no longer needs the personal data for processing purposes, but you require it for the establishment, exercise or defence of legal claims; d) you have objected to processing pending verification that the Company's legitimate grounds override your interests;
  • right to object to processing – you have the right to object to processing if we are processing your personal data on the ground of our legitimate interests (ex. marketing purpose);  
  • right to data portability – you have the right to ask that we transfer the information you gave us from one organization to another or give it to you. The right only applies if we are processing information based on your consent or a contract and the processing is automated;
  • right to withdraw consent – you have the right to withdraw your consent to personal data processing at any time (when the legal basis for personal data processing is consent); the withdrawal of consent is effective prospectively and does not affect consent given prior to the withdrawal;
  • rights when automated decision-making, including profiling, is taking place –you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affecting you;
  • right to submit a complaint to the Commission for personal data protection – if you consider that we process your personal data unlawfully, you have the right to lodge a complaint to the Commission for personal data protection. The contact details can be found on its webpage: https://www.cpdp.bg/; address: 1592 Sofia, 2 Prof. Tsvetan Lazarov boulevard, email: kzld@cpdp.bg; please contact us first so we can take action immediately.

Generally, you are not required to pay any charge for exercising your rights. We have one month to respond to you.

You can exercise your rights under the General Data Protection Regulation in the following ways:

  • by submitting a written request to Allatra electronically via the dedicated platform HERE; or
  • by submitting a written request electronically to: DPO@amatas.eu; or
  • by submitting a written request to Allatra in person or via mail at the following address: 1421 Sofia, Lozenets district, 123 Arsenalski boulevard, fl.1, ap. office 2.

Allatra applies proper technical and organisational data protection measures when processing data.

Information about processing of personal data by our side in the various relationships in which we are involved can be found in the following references.

Processing of personal data of Allatra clients

Allatra processes personal data of its customers or representatives of its customers - legal entities, in connection with contractual relations and the provision of services, for the following purposes:

  • administering the relationship for the provision of services and the receipt of payments for amounts due;
  • exercising the Company's legal rights - for example to receive payments and enforce contracts;
  • the pursuit of legitimate interests - carrying out marketing activities, protecting the Company's assets at its premises or customer sites by implementing CCTV for security purposes;
  • tax, accounting purposes, including the issue of invoices, the performance of obligations related to the implementation of statutory obligations, etc.;
  • contact purposes;
  • examining and responding to letters and requests to exercise rights under the General Data Protection Regulation;
  • providing of services.

The legal grounds for processing the relevant data in different cases may be the data subject's consent, performance of a contract to which the data subject is a party, taking steps at the request of the data subject before entering into a contract, compliance with legal obligations to which the Company is subject, Allatra's legitimate interests as set out in this notice. The legal grounds are based on the applicable legislation, for example, the regulations concerning the provision of employment agency services, the Accounting Act, the Tax and Social Security Procedural Code, the Obligations and Contracts Act, the Electronic Commerce Act, the Electronic Communications Act, the General Data Protection Regulation, the Data Protection Act, other laws and applicable regulations.

The data shall be stored for the following periods/periods calculated according to the following criteria:

  • for accounting and tax purposes - in accordance with applicable law;
  • for video surveillance for security purposes - for a period of 60 days in accordance with the Private Security Act; 
  • for marketing purposes - until objection (where the basis is the legitimate interest of the Company to advertise and market its services) or withdrawal of consent (where the processing is based on consent);
  • for the purposes of debt collection and the exercise of legal claims - in accordance with applicable law.

Personal data for which there is no explicit legal obligation to retain shall be deleted after the purposes for which the personal data was collected have been achieved.

The categories of personal data that Allatra may collect about its customers or their representatives - in the case of legal entities - are as follows:

  • identification data for accounting and tax purposes, e.g. names, unique personal number, addresses;
  • contact details, e.g. for the delivery of services and for communication in relation to requests - correspondence address, telephone numbers, e-mail addresses;
  • video images - for video surveillance;
  • name, address, telephone, e-mail address - for processing requests;
  • data required in connection with the electronic signature of documents;
  • data on place of work and positions in certain companies, as well as work experience and employment history - when providing intermediary services;
  • data on age and legal capacity - for the performance of legal obligations applicable to Allatra;
  • other data which become known in the course of providing services.

The personal data will be collected directly from the customer or his representative. Data from public sources such as the Trade Register and the Register of Non-Profit Legal Entities may be used where necessary.

The data is accessible to employees of the company who should process the relevant information in the performance of their duties, in accordance with the need-to-know principle. Allatra's employees are obliged to protect the confidentiality of the data that come to their knowledge in connection with their duties.

Data may also be provided to personal data processors and their subcontractors (providing services necessary for the Company's activities) with whom contracts have been concluded that provide for the guarantee of the relevant protection of personal data. Data may be provided to operators providing postal services in connection with these services, to banks, to institutions for the purpose of debt collection, such provision being made after a case-by-case assessment of the necessity of their provision and after taking the necessary data protection measures.

Data may also be disclosed to public authorities where there is a legal basis to do so, e.g. for tax purposes to the National Revenue Agency, to public authorities performing functions in relation to recruitment intermediary services, etc.

If data required by law or for a specific purpose is not provided to Allatra, you may not be provided with a service, a document may not be issued (e.g., an invoice), a sale may not take place and a service may not be delivered (e.g., in the case of a request where you have not provided the necessary data for the request). You will be informed of other consequences of not providing data in each individual case.

Your personal data will not be transferred to countries or legal entities outside the European Economic Area (EEA), nor to international organisations, and if such processing takes place, the requirements of the General Data Protection Regulation will be complied with.

It is possible that, in view of Allatra's legitimate interests in improving the quality of our services, data subjects to be subject to profiling in order to improve business processes and the quality of performance of services. Such profiling will be carried out on the basis of special rules that will be clarified in each case. The Company will not make automated decisions with legal implications based on such profiling.

Processing of personal data in connection with relationships with counterparties

Allatra is a legal entity and an employer. In carrying out its activities, fulfilling its legal obligations and for its needs, the Company cooperates mainly with other legal entities (companies providing services to Allatra, banks and other financial institutions, suppliers), which in these relationships are represented by individuals for whom personal data is processed. The personal data of such persons is processed for the following purposes:

  • in connection with the conclusion, performance and termination of contracts, for the receipt of services, for payments under contracts, for contacts on operational and other matters;
  • administration of contractual relationships;
  • provision and receipt of communication services (postal, telecommunications, etc.);
  • providing and receiving banking and insurance services;
  • improving processes in relation to the execution of contracts;
  • fulfilling the Company's legal obligations;
  • providing benefits to the Company's employees;
  • using the services of subcontractors where applicable;
  • investigating the integrity of our employees.

The legal grounds for processing of data are compliance with legal obligations applicable to the Company and the legitimate interest of the controller related to the performance of its activities as a legal entity and employer, including to obtain services to support its activities. The grounds derive from the applicable legislation, for example, the Law on Obligations and Contracts, the Commercial Law, the Tax and Social Security Procedural Code, the Accounting Law, the Law on Measures against Money Laundering, the Law on Measures against Terrorist Financing, the Law on Electronic Communications, the Law on Electronic Commerce, the Law on Consumer Protection and other laws and applicable regulations.

Allatra processes personal data of representatives of counterparties according to the specific case and the need. The data that may be processed are names, unique personal number (in some specific cases under service contracts where employees of the co-contractors provide certain services or where such data is specified in authorisations), correspondence address, telephone number, e-mail address, other contact details, place of work and employer details. The information that such persons share when communicating with us (in meetings, exchanges of letters and emails, telephone conversations, chats, sending short text messages, emails, etc.), which may contain personal data, may be processed if it is relevant to the relationship between the parties.

The data will be collected from our counterparties or from you. If necessary, public sources may be used, e.g. the website of the co-contractor, the Trade Register and the Register of Non-Profit Legal Entities, etc.

In the event that personal data is requested from data subjects and they do not provide it voluntarily, other lawful means may be used to obtain that data, including contacting counterparties. Individuals shall be informed of the consequences of not providing data on a case-by-case basis.

The data is processed by employees of the Company who have undertaken to protect the confidentiality of the information that has become known to them in the performance of their duties and who have received this information specifically in connection with their duties in the Company. In compliance with the legislation in force and in the cases provided for by law, data may be provided to competent administrative and judicial authorities and institutions. Data may also be provided to data processors and their subcontractors (providing services necessary for Allatra's activities) with whom contracts have been concluded which provide for the guarantee of the relevant protection of personal data. Data may be provided to operators providing postal services, in connection with these services, to banks, credit bureaus and collection agencies, etc., to software developers, etc., and the provision to third parties is subject to a case-by-case assessment of the necessity of their provision.

Allatra will not provide personal data to representatives of its counterparties of countries or organizations outside the European Economic Area. Data may be processed outside the European Economic Area when using communication platforms, subject to the requirements of the Regulation and ensuring transparency. Should the need arise in the future for other operations involving the transfer of personal data processed by the Company to third countries or international organisations, the provisions of the General Data Protection Regulation will be complied with, including any subsequent transfer of personal data from the third country or international organisation to another third country or organisation.

Personal data of natural persons - representatives of legal entities - counterparties, will be processed by Allatra for a period no longer than necessary to achieve the relevant purpose for which the data were collected or until the expiration of the statutory period.

Allatra does not profile the representatives of its counterparties and does not make automated decisions that have legal consequences for these persons.

Processing of personal data of job applicants

Allatra is an employer. In this regard, the Company processes personal data of job applicants.

In recruitment procedures, Allatra obtains job applicants' personal data from them in person or via job application platforms. In the latter case, before the data is received by Allatra, it is processed by the respective platform without Allatra having any involvement in this processing. It is also possible to process public information on the applicant's LinkedIn professional network profile.

The following categories of personal data are processed in the recruitment process: identification data, data on educational qualifications and additional qualifications obtained, data on work experience and seniority, telephone number and e-mail contact address, data from skills and integrity tests carried out for certain job positions, CCTV recordings of certain such tests or on-site interviews at premises where CCTV is carried out.

Applicants' personal data are processed on the basis of Art. 6, para 1. "b" of the General Data Protection Regulation - to take steps at the request of the applicant before the conclusion of a contract (pre-contractual relationship between the applicant and the company), Art. 6, para.1 "f" of the General Data Protection Regulation - Allatra's legitimate interest in selecting employees who meet the requirements for the position applied for, and on the basis of Art. 6 par. 1 "c" of the General Data Protection Regulation - to comply with legal obligations applicable to the company under employment law, for example the Labour Code.

The processing is carried out for the following purposes: selection of suitable personnel for the vacant positions in Allatra, as well as for the purpose of preparing the employment documents of the approved candidates.

In the first stage of the recruitment procedure, the company processes the personal data of the job applicants as indicated in the CVs, as well as possibly data on the employee's LinkedIn profile and in completed forms on the company's website sent to Allatra by the applicants. Data indicated in cover letters are also processed, if any are sent by candidates.

Allatra has not established a specific resume form and does not restrict applicants to one. The CV may be submitted in a format of the candidate's choice and should contain information in accordance with the company's stated requirements for the vacancy. Using standard European CV formats, candidates may provide the following personal data: three names, address, contact details (telephone number, fax, e-mail), nationality, date of birth, details of work experience, education, qualifications and training, information on personal, social, organisational, technical and other competences. CVs must be accompanied by a recent photograph in accordance with the standard templates. Persons may include other information in their CVs as they wish. The data in the CV submitted by the applicant will be processed in its entirety when the application is examined.

When submitting an application via the Allatra platform on the Company's website, the data specified there is processed.

The data in the CVs sent by candidates or submitted online are processed by the Company's employees performing recruitment functions or by a data processor on behalf of and for the account of Allatra, as well as by persons in managerial positions in the Company, for example, the director of the department in which the vacant position is located. Candidate data may also be disclosed to public authorities where there is a legal basis for doing so.

After reviewing the CVs received, Allatra contacts the candidates who have passed the first stage of the selection process and invites them to participate in the second stage - an interview. This second stage involves an interview in conjunction with the information provided at the first stage and aims to further analyse the candidate's potential ability to perform the job for which they are applying, as well as compliance with the set criteria. The interviews will be conducted by a team of company employees who are competent to assess the applicant's ability to perform the job and by the department in which the vacant post applied for is located. For some positions involving access to information sensitive to the company and its customers, additional tests such as skills and orientation, integrity, etc., may also be applied, depending on the position applied for. Interviews may take place both before and after the relevant tests.

If job applicants do not provide Allatra with information at any stage of the selection process on the basis of which applications are judged to be suitable, they may not be invited to take part in the next stage. It is also possible that candidates may be formally eligible but not be invited to continue in the selection process because other applications are more suitable for the specific post.

Once the second stage of the selection process is completed, the company will contact the relevant individuals to provide them with information on whether they have been approved to commence employment with Allatra. In the process of concluding the contract, the approved persons are asked to provide additional data necessary for the conclusion of the contract, in accordance with the requirements of employment law and the specifics of the job applied for.

Allatra does not disclose applicants' personal data to countries or legal entities outside the European Economic Area or to international organisations.

Allatra does not perform automated decision making. Some profiling may take place at some stages of the selection process, according to information previously provided to the candidate, but the decision on whether the vacancy meets the employer's requirements is always made after a detailed analysis of all the data and by humans rather than by machine, taking into account all relevant factors.

The personal data of job applicants is stored by Allatra until the following periods have expired:

  1. in the case of an approved application and the conclusion of an employment contract, the necessary data is stored for the duration of the employment contract, and after this period - only if necessary (e.g. legal claims) or if there is a legal basis;
  2. for unsuccessful candidates, the data submitted at the time of application shall be kept for a period of up to 6 months from the end of the selection procedure, unless the candidate has consented to their retention for a longer period.