PRIVACY POLICY FOR JOB APPLICANTS

This document aims to provide information to job applicants of The Burgiss Group Ltd (Sofia)(the “Applicants”) about their personal data and the way it is processed by the controller pursuant to article 13 and article 14 of the Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) as follows:

1. Controller of Personal Data

The Burgiss Group Ltd, UIC 204641692, with seat and registered address: 1463 Sofia, 89B Vitosha Blvd., Millennium Tower, 5th floor, is controller of the Applicants’ personal data (the“Controller”).

In case of any questions or in case Applicants wish to exercise any of their rights as per the GDPR, the Applicants may contact the Manager of Human Resources and Administrative Activity of the Controller (the “HR Manager”):

(T) +359 2 905 5190

(M) +359 878 498 711

e-mail: hdobrinovich@burgiss.com

2. Categories of Personal Data

The Controller collects and processes the following personal data of the Applicants: name,picture, personal number, address, ID’s data, place of birth, telephone, interests, hobby, education, work experience, and other type of data provided by the Applicant in his/her CV.

3. Purpose of the Personal Data Processing and Legal Basis

The Controller processes personal data of the Applicants for the purposes of selecting employees according to the legal requirements and qualification requirements of the respective job position for which the applicant applies.

The personal data of the Applicants is processed, primary, on the legal basis of article 6 para 1 (b) of the GDPR in order the Controller to take steps at the request of Applicant prior to entering into an agreement. However, some personal data might be processed by the Controller on the legal basis of article 6 para 1 (c) of the GDPR for compliance with a legal obligation to which the Controller is subject or on article 6 para 1 (f) of the GDPR for the purposes of the legitimate interests pursued by the Controller.

4. Persons who Provide the Personal Data

The Controller receives personal data from the Applicants and recruitment agencies, depending on the case.

5. Categories of Recipients

The Controller may provide some or all of personal data, depending on the case, to the Applicant, The Burgiss Group, LLC (USA) and recruitment agencies which support the Controller in the selection process.

6. Transfer of Personal Data to Third Country of International Organization

The Controller transfers the Applicants’ personal data to the USA where the mother company of the Controller - The Burgiss Croup LLC, is located, in order for proper candidates to be selected. In order to guarantee the personal data in the transfer we have signed a Standard contractual clauses document for the transfer of personal data from the Community to third country.

7. Periods for Storing Personal

The Controller stores Applicants’ personal data for a period of 6 (six) months as of the selection procedure’s end in which the Applicant participated or for a period which the applicant has agreed explicitly with.

8. Rights of the Applicants Related to Personal Data

8.1 Every Applicant has the following rights under the terms and conditions of the GDPR:

  1. To withdraw consent, if the processing of personal data is based on consent;

  2. To get access to his/her personal data and information about personal data concerning him/her and the way it is processed as well as to receive copy of his/her personal data;

  3. To request Controller to rectify inaccurate personal data and to store it in accurate and actual form;

  4. To obtain from the Controller the erasure of personal data concerning him/her when personal data have been processed on no legal grounds and/or personal data are no longer necessary for the purposes for which they were collected;

  5. To obtain from the Controller restriction of processing;

  6. To object to processing of his/her personal data;

8.2 The Controller has to reply to the Applicant’s request under item 8.1 above not later than one month as of the day when the request is received. The Controller may delay its reply with additional two months depending on the complexity and number of requests. The Controller will inform the Applicant about the delay and the reasons for that not later than one monthas of the request’s receipt

9. Complaint with Supervisory Authority

The Applicants have the right to lodge a complaint with a supervisory authority which in the common case will be:

Bulgarian Commission for Personal Data Protection

2 Prof. Tzvetan Lazarov Blvd., 1592 Sofia, Bulgaria

kzld@cpdp.bg
www.cpdp.bg

10. Automated Decision-Making

The Controller does not use automated decision-making with respect to the Applicants’ personal data.