This document aims to inform all data subjects who have relations with Asarel-Medet JSC and/or a company from the Asarel corporate group about the manner in which their personal data are processed, the types of data processed, their disclosure to third parties, and their rights in accordance with the applicable requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals in terms of personal data processing and free movement of such data and repealing Directive 95/46/EC, the Personal Data Protection Act and other applicable legal requirements.
A primary concern of Asarel-Medet JSC (the Company) and the companies within the Asarel corporate group is to ensure a high level of security for the personal data of individuals. Therefore, all required measures have been taken to align the Company’s activities in this area with best practices and statutory requirements for information protection and confidentiality. When collecting personal data for the purpose of carrying out the Company’s core activities, the fundamental principles of data minimisation, lawfulness, transparency, and security are observed. The companies within the Asarel corporate group are subsidiary, related, or associated commercial companies registered in Republic of Bulgaria and have adopted and signed an Inter-Corporate Agreement for the processing of personal data within the Asarel Group. Transfers of personal data within the corporate group are carried out in accordance with the provisions of the Inter-Corporate Agreement.
Individuals protection in terms of processing of their personal data is a fundamental right under Article 8 of the Charter of Fundamental Rights of the European Union. This right is aligned with all fundamental rights and contributes to the observance of the freedoms and principles recognised by the Charter. Personal data protection is regulated by Regulation (EU) 2016/679 of 27 April 2016 and by other legal acts of the European Union and the legislation of its Member States.
Depending on the specific situation, the Company acts as a data controller and/or data processor with respect to the personal data it collects and processes. Personal data is collected, processed, and stored by the Company in its capacity as employer, supplier, and contracting party, in strict compliance with legal requirements, legitimate interests and contractual terms.
1. Categories of data subjects and categories of processed Personal data
The processed personal data relates to the following categories of data subjects and include:
- Job applicants – identification data (name, permanent and/or current address, telephone number, email), education and professional qualifications (educational degree obtained, personal and professional qualifications, specific skills, work experience, etc.).
- Employees and workers engaged under employment and civil contracts, as well as persons who have concluded management and control contracts – identification data (name, personal identification number/foreigner number, permanent and/or current address, ID card number and date of issue, telephone number, email), education and professional qualifications (data related to education, professional experience, work record, professional qualities and personal skills, such as employment records, copies of diplomas, qualification courses relevant to the position), health data (sensitive data are processed insofar as required to fulfil specific rights and obligations under labour and social security legislation and social benefits and payments), and other categories of data related to social status (marital status, children under 18), criminal record certificates (where required by law), video image, photographic images, and other data required for the performance of the Company’s rights and obligations as a controller and/or for the protection of legitimate interests.
- Clients, suppliers or external contractors – personal data required for the conclusion and implementation of the relevant service contract, including identification data of the individual (name, personal identification number, permanent and/or current address, telephone number, email).
- External visitors to the Company’s offices and sites, the personal data collected in the course of security and access control regimes in buildings, facilities, and Company-controlled areas – video images and identification data (name, personal identification number, permanent and/or current address, telephone number, email).
2. Purposes of processing
As a data controller, the Company processes personal data for the following purposes, which also constitute the legal grounds for processing, depending on the relevant category of data subjects: compliance with statutory obligations and official powers; human resources management and financial-accounting reporting; implementation of initiatives related to donations, sponsorships, charitable causes, public initiatives, and corporate social responsibility activities, including but not limited to: obligations as Employer and Insurer under labour, accounting, tax, and social security legislation; recruitment procedures and employee management; security and access control in controlled areas; performance of contractual obligations; review of service offers and selection of contractors; verification of the authority of representatives of potential partners; ensuring and monitoring compliance with applicable corporate policies, internal rules, and procedures, and investigation of incidents; project and programme management; granting access to Company premises and ensuring the security of property, assets, facilities, infrastructure, premises, employees, systems, and technical equipment, including through video surveillance; protection of legal interests in judicial and extrajudicial proceedings; implementation of donations, sponsorships, charitable causes, information and educational activities, stakeholder communication, and participation in public and corporate social responsibility initiatives.
3. Categories of Personal data recipients
Personal data processed by the Company may be disclosed to:
- Public authorities – National Revenue Agency, National Social Security Institute, Labour Inspectorate, courts, investigative authorities, Ministry of Interior, prosecution authorities, audit bodies, etc., which may lawfully request the data in the exercise of their powers.
- Data processors with whom the Company has concluded data processing agreements in accordance with the GDPR (banks, accounting firms, occupational health services, etc.).
- Third parties acting as independent controllers (e.g., postal and courier service providers, providers of social benefits, etc.).
The Company, as Controller, does not disclose personal data for direct marketing purposes and does not apply automated decision-making, including profiling.
4. Rights of data subjects
The General Data Protection Regulation provides the following rights to individuals regarding the processing of their personal data:
- Right of access and information – the right to access one’s personal data and information about their storage and processing, including purposes of processing, categories of data, categories of recipients, and storage periods.
- Right to rectification – to request immediate correction or completion of inaccurate or incomplete personal data.
- Right to erasure (“right to be forgotten”) where processing is unlawful or data are no longer required, except where required for: (1) freedom of expression and information; (2) compliance with a legal obligation; (3) reasons of public interest; or (4) establishment, exercise, or defence of legal claims.
- Right to restriction of processing in the event of a legal dispute until its resolution and/or for the establishment, exercise, or defence of legal claims.
- Right to object at any time on grounds relating to a particular situation, unless there are compelling lawful grounds for processing that override the interests and rights of the data subject or a judicial process.
- Right to data portability where processing is carried out by automated means on the basis of consent or a contract; in certain cases, data may be transferred to countries outside the EU in a structured, commonly used, machine-readable format.
Any interested person may exercise their rights by submitting a written or electronic request to the Data Controller, including identification details, addressed to the Coordinator responsible for data protection compliance at Asarel-Medet JSC by telephone +359 357 60 323 or email data.protection@asarel.com.
In accordance with the Personal Data Protection Act and the GDPR, any individual who believes their data protection rights have been violated may lodge a complaint with the Commission for Personal Data Protection (https://www.cpdp.bg) or another competent supervisory authority, where applicable.
5. Data retention periods
As Controller, the Company retains processed personal data in accordance with statutory retention periods and only as long as required to achieve the purposes for which they were collected or to comply with legal requirements. Upon expiry of the applicable periods, personal data are destroyed/deleted unless required for the establishment, exercise, or defence of legal claims.
6. Personal data security
The Company maintains appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures ensure a level of security appropriate to the risks, taking into account technological developments, implementation costs, and the nature, scope, context, and purposes of processing, as well as risks to data subjects. The measures aim to ensure the ongoing confidentiality, integrity, and availability of personal data.
Contact
Data Controller: Asarel-Medet JSC
For additional information, you may contact the responsible Data Protection Coordinator at data.protection@asarel.com.