I. Common circumstances
1. This privacy policy aims to provide clarity to applicants for employment at AVTO UNION JSC (The Company) on the following circumstances:
1.1. on what basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation/GDPR);
1.2. what is the purpose of collecting such data;
1.3. period such data is stored;
1.4. whose data The Company manages during the recruitment process;
1.5. what data is collected ragerding the recruitment process;
1.6. who has access to the data collected;
1.7. what rights data subjects have and how they can exercise them.
2. The administrator of the provided personal data regarding the selection of employees is AVTO UNION JSC with UIC 131361786, registered office and address of management: Sofia Blvd. 43 Christopher Columbus, contact email in relations to the processing of personal data: gdpr@avtounion.bg.
II. Grounds for processing
3. The basis for processing the personal data by the Company, when selecting employees, is to take steps at the request of the data subject before concluding a contract pursuant to Art.6 par(1)(b) of GDPR. The provision of personal data is a voluntary and necessary condition for participation in the selection procedure.
4. In the event that in the selection process the candidate for the post, by deliberate consent, gives permission for his data to be stored and used for future selection for other positions and other companies in the group of Eurohold Bulgaria JSC (Part of the same group is also Avto Union JSC, for a period longer then 6 (six) months, but not more than 1(one) year , then the basis for processing of the data is consent – Art. 6(1)(a) from GDPR.
5. Consent shall be provided in an appropriate and accessible manner.
5.1. Consent may be withdrawn by the data subject as easily as it is given and at any time.
5.2. Consent and rejection shall be effected by the same action.
6. When processing personal data in recruitment procedures, data subjects are not subject to decisions based solely on automated processing, including profiling.
III. Purposes of processing
7. The purposes of the processing of personal data are:
7.1. for the selection of employees for a specific declared position, with the ultimate aim of concluding an employment contract with the selected candidate.
7.2. to carry out future recruitment if the entity has given its explicit consent to the processing of its data for this purpose and for a period exceeding 6(six) months, but not more than 1(one) year.
IV. Storage period
8. Personal data contained in CVs are stored for a period of 6(six) months after the completion of the selection and signing of an employment contract with the selected candidate.
9. The retention period for CVs for future selection, for persons who give explicit consent is 1(one) year from the granting of consent.
V. Types of personal data and categories of data subjects
10. The Company processes personal data of persons who participate in a recruitment procedure, namely the data contained in the CVs of the entities provided by themselves. Such categories of data may be:
10.1. identification/physical identity;
10.2. data for social identity(example: education and professional experience);
10.3. family identity;
10.4. other data announced in the notice for the launch of a selection procedure, where required, according to a regulatory act for the position declared.
VI. Data access
11. Only certain employees of the Company who participate in the selection process have access to the data of the candidates. These are the manager and/or human resources expert, the direct head of the structural unit for which selection is made, members of the Board of Directors. These persons are bound by confidentiality clauses in relation to the processing of personal data in and on the occasion of the performance of their duties. In case, to the explicit written consent provided under item 4 of this Policy, the personal data will be processed only by companies in the group of Eurohold Bulgaria JSC, UIC 175187337, which are registered and operate on the territory of the Republic of Bulgaria”.
12. The applicants’ data is accessible from the site through which the person applies for the job and in which the vacancy notice is published (in particular https://www.avtounion.bg/).
13. The Company takes and implements all necessary technical and organizational measures to protect the personal data of the subjects and ensures compliance with their rights.
14. The Company guarantees that the personal data received will be processed honestly and impartially in the light of the interests of the entity and its fundamental rights and freedoms.
15. When, for any reason, the approved candidate, before the entry into force of the employment contract, refuses to take up employment, all collected documents containing personal data shall be returned to the person against a signed protocol.
VII. What rights do data subjects involved in the recruitment process have and how they can exercise them
16. The data subject shall have the right to:
16.1. obtain, upon request, all necessary information relating to the processing of the data it provides;
16.2. to request from the Company rectification or erasure of personal data or restriction of the processing of personal data, subject to the prerequisites for this;
16.3. to object to the processing and to lodge a complaint with the Commission for Personal Data Protection (CPDP) and to the competent court in case of unlawful processing of the data;
16.4. withdraw consent to the processing of his personal data at any time when the data are provided on the basis of consent, and the withdrawal of consent does not affect the lawfulness of the processing prior to its withdrawal;
16.5. to be informed of the consequences of not providing consent for the processing of his or her personal data;
16.6. be informed about the purposes and durations of the processing of his personal data, as well as whether the Company intends to process the data for a purpose other than those for which they were collected, as well as in the event of a change in the purposes of processing;
16.7. To receive a copy of data collected.
17. All requests for provision of information under item 17 shall be made in writing, signed by the data subject and sent to an e-mail address: gdpr@avtounion.bg or in person to the address of the management of the Company.
The request for the exercise of the rights of the data subject should contain the following information:
18.1. identification of the person – name and PIN;
18.2. contacts for feedback – address, telephone, e-mail;
18.3. request – description of the request.
19. The company responds to the requests of the entities, executing them if there are grounds for doing so, or issue a reasoned refusal, where there are grounds for doing so, indicating the right of the entities to object to the CPDP and to the competent court.
Additional provisions
§1. Definitions:
1. “Personal data” means any information relating to an identified person or person who can be identified by name, identification number, location data, online identifiers or one or more indications specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
2. “Processing of personal data” means any operation or set of operations carried out with personal data or a set of personal data by automatic or other means such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, arranged or combination, restriction, erasure or destruction.
3. “Consent of person” means any freely expressed, specific, informed and unambiguous indication of the data subject’s will, by means of a statement or a clear affirmative action expressing his/her consent to the processing of personal data relating to him or her.
4. ‘Data subjects’ means the person related to the personal data. In this case, the data subjects are the job applicants.
5. “Right of access” – the data subject has the right to receive from the controller confirmation whether personal data related to him or her are being processed and, if so, to access the data.
6. “Right to edit” – the data subject has the right to ask the controller to edit the inaccurate personal data relating to him or her.
7. “Right to erase” – the data subject has the right to request from the controller the erasure of personal data relating to him, and the controller has the obligation to delete the personal data when the personal data are no longer necessary for the purposes for which they were collected or processed, or the data subject withdraws his consent on which the processing of the data is based or the personal data have been processed unlawfully.
8. “Right to restrict processing” – the data subject has the right to require the administrator to restrict the processing when the accuracy of the personal data is contested by the data subject, for a period allowing the administrator to verify the accuracy of the personal data or the processing is unlawful, but the data subject does not want the personal data to be erased, but instead requires restriction of their use.
9. ‘Profiling’ means any form of automated processing of personal data consisting in the use of personal data to assess certain personal aspects relating to a natural person, in particular to analyse or predict aspects relating to the performance of that natural person’s professional duties, economic status, health, personal preferences, interests, reliability, behaviour, location or movement.
10. ‘Administrator’ means a physical or legal entity, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.
Transitional and final provisions
§2. This policy was approved by the Executive Director of Avto Union JSC on 22.05.2018. and shall enter into force on the same date.
§3. For cases not settled by this policy, the relevant provisions of the legislation in force shall apply..
