Who are we?
Road company EAD is a company with its own accredited road construction laboratory and offers a full range of laboratory testing services for the construction of infrastructure projects. Data protection is of great importance, and in this regard, the personal data processing procedure is fully open and conducted in a transparent manner.
Definitions
- “personal data” means any information relating to an identified natural person or a natural person who can be identified (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, psychological, economic, cultural, or social identity
- “processing” means any operation or set of operations performed on personal data or a set of personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction
- “controller” means a natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller or the specific criteria for its designation may be laid down in Union law or the law of a Member State
- “processor” means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller
- “recipient” means a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, whether a third party or not. However, public authorities that may receive personal data in the context of a specific investigation in accordance with Union law or the law of a Member State are not considered “recipients”; the processing of such data by those public authorities complies with the applicable data protection rules in accordance with the purposes of the processing
- “supervisory authority” means an independent public authority established by a Member State and responsible for monitoring the application of Regulation (EU) 2016/679
Purposes of This Policy and Principles of Personal Data Processing
The purpose of this POLICY is to inform all data subjects who have a relationship with ROAD COMPANY about how their personal data is processed, what personal data is processed, when it is necessary to disclose it to third parties, as well as the rights of data subjects, in accordance with the Regulation.
Personal data at Road company EAD is collected, processed, stored, and transferred lawfully, in good faith, and transparently, in compliance with the following principles:
1. The data subject is informed in advance about the processing of their personal data
2. Personal data shall be collected for specific, clearly defined, and legitimate purposes and shall not be further processed in a manner incompatible with those purposes
3. The amount of personal data shall be proportionate to the purposes for which it is collected
4. Personal data must be accurate and, where necessary, kept up to date
5. Personal data shall be erased or rectified when it is determined that it is inaccurate or no longer relevant to the purposes for which it is processed
6. Personal data shall be kept in a form that allows for the identification of the relevant individuals for a period no longer than is necessary for the purposes for which such data is processed
Data Subjects and Categories of Personal Data
Road company EAD collects, processes, and stores personal data in its capacity as an employer, supplier, and contracting party, in compliance with the requirements of applicable law, legitimate interests, and contractual terms.
The data subjects whose personal data is processed by Road company EAD are primarily job applicants, employees, persons entrusted with management or oversight, owners, contractors, and suppliers.
1. The following personal data is collected from job applicants for the purposes of recruitment and coordination with the applicant:
- Identification: name, permanent and/or current address, phone number, email address.
- Education and professional qualifications: data related to education, work experience, professional and personal qualifications, and skills (CV).
- Other data, if expressly provided for in the internal rules and procedures of the respective company.
2. individuals employed under employment relationships and management and control contracts with the company, and for the purpose of entering into an employment contract or a management or control contract, the following personal data—which is the minimum required by law for hiring—is lawfully collected:
- Identification: phone number, email address, ID card or passport information—first and last name; Personal Identification Number (EGN), date of birth (LNC), permanent and/or current address, ID card number and date of issuance
- Education and professional qualifications: data related to education, work experience, professional and personal qualifications, and skills (employment records, copies of diplomas, qualifications relevant to the position)
- Health data: The Company processes sensitive data only to the extent necessary to fulfill its specific rights and obligations under labor and social security legislation and regarding social benefits and payments
- Other data:
– data regarding social status
– marital status, number of children under 18 years of age
– criminal record, only when a law or regulatory act requires verification of a criminal history
– video footage, photographs, and other data whose processing is necessary for the fulfillment of the rights and obligations of the controllers at Road company EAD in their capacity as an employer and/or for the protection of their legitimate interests.
3. Personal data necessary for the conclusion and performance of the relevant contract is collected from individuals who are customers of the company:
- Identification: name; personal identification number (date of birth), permanent and/or current address, contact phone number, email address, and job title.
4. Personal data is collected from individuals who are service providers to the company, as necessary for the conclusion and performance of contracts for the provision of services to the company by external providers, as follows:
- Identification: name, personal identification number (date of birth), permanent and/or current address, phone number, email address.
- Personal data collected in connection with the security of the companies’ property and access control in the companies’ buildings and facilities—video footage, identification—name, position, organization/company
Personal Data Protection
The administrators and processors at Road company EAD have taken the necessary technical and organizational measures provided for in Regulation (EU) 2016/679 and the Personal Data Protection Act, and apply best practices in accordance with international standards. To ensure maximum security in the processing, transfer, and storage of personal data, all reliable mechanisms are used to protect personal data from loss, theft, and misuse, as well as from unauthorized access, disclosure, alteration, or destruction.
Access to Personal Data
The data controllers at Road company may, if necessary, disclose personal data to third parties such as competent government authorities and institutions when required by law, as well as to processors, based on an explicit contract, and all data subjects whose personal data is disclosed to another processor are informed of this.
In cases where personal data is disclosed to employees—including under management and control agreements—customers, or service providers of a processor, the specific Controller:
- requires sufficient safeguards from the processor to ensure compliance with legal requirements and best practices for the processing and protection of personal data
- enter into a written agreement or other legal instrument with equivalent effect that governs the processor’s obligations and meets the requirements of Article 28 of Regulation (EU) 2016/679
- informs individuals whose data will be provided to a data processor. Access to personal data may also be granted to the relevant state authorities—courts, investigative bodies, the prosecutor’s office, auditing authorities, and others. The aforementioned authorities may request the data through the proper channels in connection with the exercise of their powers.
Transfer of Personal Data to Countries Outside the European Union
The transfer of personal data to countries outside the EU/EEA is permitted only when:
- The European Commission has adopted a decision confirming that the country to which the transfer is made ensures an adequate level of protection of the rights and freedoms of data subjects
- Appropriate safeguards are in place—such as Binding Corporate Rules (BCRs), standard contractual clauses, an approved code of conduct, or a certification mechanism approved by the Personal Data Protection Commission and/or the European Commission
- The data subject has given his or her explicit consent to the transfer after being informed of the possible risks, or
- The transfer is necessary for legitimate business purposes, including the performance of a contract with the data subject, the protection of the public interest, the establishment and defense of legal claims, or the protection of the data subject’s vital interests in cases where the data subject is physically or legally incapable of giving consent.
Storage and Destruction of Personal Data
Personal data is stored in accordance with the time limits specified in the applicable regulations. The specific retention periods are set forth in the relevant personal data registers, depending on the type of data and the purposes for which it is processed. When personal data is no longer necessary for the aforementioned purposes and/or the retention periods have expired, the controller and the processor (acting on the controller’s instructions) shall delete it or destroy it in another secure manner.
Persons Responsible for the Collection, Processing, and Storage of Personal Data
The collection, processing, storage, and protection of personal data are carried out only by individuals who have been expressly authorized to do so and whose job duties or a specifically assigned task require it.
Road company has appointed a Data Protection Officer with the aim of improving the regulation, coordination, and implementation of general technical and organizational security measures, thereby ensuring that personal data is always processed in a transparent, fair, and lawful manner. The Data Protection Officer’s primary role is to provide methodological guidance and oversight regarding the implementation of the personal data protection policy within the group. In addition to the designated Data Protection Officer, specific data protection officers have been appointed in each company; they are required to report to the group’s Data Protection Officer and consult with him or her regarding the implementation of this Policy.
The persons responsible for personal data protection and those processing personal data on behalf of the controller and/or processor are individuals who have previously undertaken a confidentiality obligation, possess the necessary competence, and have been appointed and/or authorized by a corresponding written document.
Rights of Data Subjects
Data subjects have the following specific rights regarding the processing of their personal data:
Right of Access to Personal Data Concerning the Individual
Individuals have the right to access personal data concerning them at any time during processing, without delay, within the statutory time limit, free of charge, and in accordance with the procedures established by the respective company.
Right to Object
Data subjects may at any time object to the processing of their personal data by the company or a data processor.
Right to Rectification:
Data subjects have the right to request the rectification of their personal data if it is inaccurate, including the completion of incomplete personal data.
Right to erasure (right to be forgotten):
Data subjects have the right to request that the company erase their personal data without undue delay in the following cases:
- The personal data is no longer necessary for the purposes for which it was collected or otherwise processed
- The data subject withdraws the consent on which the processing is based, and there is no other legal basis for the processing
- The data subject objects to the processing, and there are no legitimate grounds for the processing that override the data subject’s interests
- The personal data has been processed unlawfully
- The personal data must be erased to comply with a legal obligation under Union law or the law of a Member State to which the controller is subject
- The personal data was collected in connection with the offering of information society services to children, and consent was given by the person exercising parental responsibility for the child
- The controller may refuse to erase data in cases where there is a legal obligation to retain such data
Right to Data Portability
The data subject has the right to receive the personal data concerning him or her that he or she has provided to a controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to whom the data were provided, where the processing is based on consent or a contractual obligation and the processing is carried out by automated means.
Right to Restriction of Processing
The data subject has the right to request restriction of the processing of his or her personal data when:
- the accuracy of the personal data is contested by the data subject, in which case the processing shall be restricted for a specific, lawful period that will allow the controller to verify the accuracy of the personal data
- the processing is unlawful, but the data subject does not wish for the personal data to be erased and instead requests that its use be restricted
- the controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise, or defense of legal claims; the data subject has objected to processing
- the data subject has objected to the processing:
– necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or
– necessary for the purposes of the legitimate interests of the controller or a third party
– pending verification and a response as to whether the legitimate grounds for their processing take precedence over the interests of the data subject
Data subjects also have the right to: - Be informed and give their consent to the processing of personal data when such consent is required, provided that the consent of natural persons is freely given, specific, informed, unambiguous, and conscious expression of their will regarding the processing of their personal data by the company, and they have the right to withdraw such consent at any time
- Request information regarding the basis on which their personal data has been provided to a third party for processing
- Object to a decision made entirely on the basis of automated processing, including profiling, if applicable
- Be notified of a personal data breach that is likely to result in a high risk to their rights and freedoms
- File complaints with the regulatory authority
- In certain cases, receive or request that their personal data be transferred to countries outside the European Union in a structured, commonly used, machine-readable format (right to data portability)
- Be informed of the consequences of not providing personal data
Exercising Your Rights
Data Protection Officer
Any data subject may contact the Data Protection Officer at the relevant company or at the following email address: office@roadcompany.eu
Right to File a Complaint with a Supervisory Authority:
Anyone who believes that Road company EAD is processing their personal data unlawfully may contact the Data Protection Officer at the email address provided above. The data subject also has the right to file a complaint with the supervisory authority in the Republic of Bulgaria—the Commission for Personal Data Protection.
Updates to the Policy
This Policy is updated periodically in response to changes in the external or internal environment. In the event of a change to the Privacy Policy, the current version will always be available on the corporate website.