We would like to inform you that we have taken the necessary measures for lawful, fair and transparent processing of your personal data. This Notice explains the purposes and legal grounds for processing your personal data.
Please read this Notice carefully to learn details about how your personal data is processed as a user, potential user or other interested party. Regardless of the purposes and grounds for processing your personal data, we will treat it with equal care. This Information contains your rights and remedies in accordance with applicable law.
This Information may be amended from time to time. The changes will enter into force upon the publication of the current Information on the processing of personal data at the address: www.bbca.bg / www.en.bbca.bg
More information on the Bulgarian legislation on the protection of personal data can be found on the website of the Commission for the Protection of Personal Data: www.cpdp.bg
- The Association
Bulgarian Breast and Gynecological Cancer Association is an association registered in the commercial register and the register of non-profit legal entities at the Registration Agency with EIK 206854486, with its headquarters and management address in the Republic of Bulgaria, Sofia, gh. Mladost 1, bl. 122, entrance 1, fl. 2, apartment 4, (hereinafter referred to as “BBCA”).
BBCA carries out its activities in strict compliance with the requirements of the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons in relation to the processing of personal data and on the free movement of such data (General Data Protection Regulation) to ensure the confidentiality and lawful processing of the personal data of its counterparties.
- Contact details
If you have any questions related to the processing of personal data, please contact us at: email@example.com
- Purposes of personal data processing
The personal data collected by BBCA may be processed for different purposes and on different legal grounds, as follows:
3.1. Purposes where the processing of personal data is necessary to comply with legal obligations:
a. Reporting to regulatory and government authorities – for tax purposes based on the requirements of the Accounting Act.
3.2. Purposes where the processing of personal data is necessary for the performance of a contract
a. Conclusion of contracts and performance of contractual obligations by BBCA – for the conclusion of contracts for purchases or use of services by BBBCA, as well as the performance of contracts by BBBCA, certain personal data for the counterparty are required (e.g. full name, address, contact data). It is possible that BBBCA may require additional information depending on the nature of the services that are part of the contract.
b. Use of product/service – BBCA processes users’ personal data through various channels in order to ensure the use of the offered services.
3.3. Purposes where the processing of personal data is based on the user’s consent
a. Use of the LIFE Platform: For registration and use of all modules of the LIFE Platform, users express their express consent and provide their personal data voluntarily and in good faith.
b. Direct marketing of services offered by BBCA: Offering services provided by BBCA, as well as participation in surveys through any of the channels, incl. e-mail, SMS, telephone, online channels.
c. Individual/personalized direct marketing and segmentation (profiling) for commercial purposes, including the use of “Cookies”: Creation of user profiles in order to provide new, better services, taking into account individual needs.
Consent to the processing of personal data according to this point 3.3 is provided by the data subject in a special User Consent Declaration.
3.4. Purposes where the processing of personal data is based on a legitimate interest of the controller:
a. Sending message services – BBCA processes personal data to send messages about the services used by the user through calls, emails, SMS, letters, etc. Notifications only apply to services already in use; communications do not pursue marketing purposes, nor do they contain new offers for services.
b. Disputes – Creation, exercise or defense of BBCA’s rights – BBCA will process user data to protect its rights in legal proceedings, when settling claims with the help of external lawyers, etc. This refers to situations where personal data is processed in connection with the administration of information related to legal disputes, judicial guarantees, applications and judicial decisions.
c. Internal reporting, analysis and development – BBCA uses the personal data of its users to improve the available and offer new, better and innovative services.
- Rights of Data Subjects
All subjects of personal data have the following rights and can exercise any of them in person or by sending a letter or e-mail addressed to: Vladimir Slavev, Sofia, zh.k. Mladost 1 bl. 122 entrance 1 fl. 2 apartment 4, firstname.lastname@example.org:
a. Right of access – At the request of the Data Subject, the BBCA shall provide information on the categories of personal data related to it that are collected and processed, as well as information on the purposes of the processing, the recipients or categories of recipients to whom the data is disclosed and the sources of such data , except in cases where the data has been collected directly from the Data Subject.
b. Right to correction, blocking of processing (restriction and/or deletion (deletion)) – At the request of the Data Subject, BBCA will correct, delete or block the processing of personal data if there is a case where the processing does not comply with the provisions of the legislation . In such cases, the BBCA notifies all third parties to whom the personal data has been disclosed, regarding all cases of correction, deletion or blocking of the processing of the personal data of the relevant person.
c. Right to data portability – The data subject has the right to receive his personal data, which he has provided to the BBCA, in a generally accessible, structured and machine-readable format and has the right to forward/transfer this data to another Administrator without hindrance from BBCA as a personal data controller to whom the data is provided when the processing of personal data is based on consent or a contractual obligation or the processing of personal data is carried out in an automated manner.
d. Right to object – The data subject has the right to object to the processing of his personal data when the processing of personal data is based on the controller’s legitimate interest. BBCA will consider the objection as soon as possible after its submission and will notify the objecting party in writing of its opinion. After considering the objection, the BDRG generally stops the processing of the individual’s personal data and informs all participating parties to whom the data has been transferred about the objection received and the measures taken based on it. However, in some cases the GDPR may have compelling legal grounds to continue processing even after an objection has been received from the data subject (e.g. in the case of legal proceedings, fraud monitoring, etc.). In these cases, the BBCA will contact the Data Subject who submitted the objection to clarify the reasons for the BBCA to continue processing his personal data.
e. The right to withdraw the given consent to the processing of personal data for the purposes specified in the Declaration of Consent. Withdrawal can be submitted in the form of a declaration.
f. Right to file a complaint with the Personal Data Protection Commission (PCPD) – The data subject has the right to file a complaint with the Personal Data Protection Commission (PCPD) against the actions of the GDPR in connection with the processing of his personal data.
Whenever the Data Subject wishes to exercise his rights, he should provide a specific and detailed description of his request. BBCA will respond accordingly to inquiries that contain sufficient detail. When exercising the rights, the GDPR must verify the identity of the data subjects and for this purpose may ask them to present an identity card or other identity document.
If you wish to receive more information or if you do not agree with the opinion of the BBCA, you have the right to file a complaint with the Commission for the Protection of Personal Data at the address: www.cpdp.bg.
- Types of personal data processed
The GDPR may process various types of personal data related to the physical identity, social identity or economic identity of the data subjects. The data may be obtained from the data subject, from third parties, or may be created by the GDPR when servicing the user.
5.1. BDRG can process different types of data depending on the purpose of the processing, for example:
a. to identify you: name, current address, date of birth;
b. To contact you: phone number, email, postal address.
5.2. BDRG processes special categories of personal data about the health status of its users: type of tumor – primary or recurrent, histological type, stage, operations, therapies.
These data are processed only with the express written consent of registered users in order to support the social care and treatment of patients diagnosed with breast cancer. These personal data are processed by or under the supervision of a professional worker – a doctor bound by the obligation of professional secrecy under the law of the European Union and Bulgaria.
5.3. Public data and data obtained from third parties
BBCA sometimes processes public data, such as information that is subject to an obligation to disclose, for example if you are appointed as a manager or representative of a company or if you own a company. The GDPR may also receive personal data through third parties, for example through official registries, which are responsible for collecting this information lawfully.
Such public data and data obtained from third parties may be relevant and used for the purposes indicated by BBCA in this Information, to verify the accuracy of the information in our documentation and to support the process of direct or indirect marketing campaigns.
- Recipients of personal data
Personal data is primarily processed by BDRG employees. The processing of personal data may also be carried out by other persons in connection with the services provided to BBCA. All these persons have a valid and binding contract for the processing of personal data concluded with BBCA.
The processing of the special categories of personal data is carried out exclusively only by a doctor who is explicitly indicated by the patient, as well as by the assistants associated with the doctor. Third parties do not have the right to access this personal data.
a. Personal data administrators to whom BBCA may transfer personal data include:
CPLD (Commission for the Protection of Personal Data)
CCP (Consumer Protection Commission)
b. The persons to whom personal data are transferred for processing are natural or legal persons, public authorities, agencies or any other body that processes personal data on behalf of the controller.
c. Recipients outside the European Economic Area (EEA)
Some of the above recipients may be located outside the EEA. BBCA will transfer personal data to countries outside the EEA (third countries) only if the necessary safeguards are in place to protect personal data according to local and European legislation and the provided personal data is adequately protected in the relevant third country. BBCA will take all necessary measures to protect your personal data by limiting their provision to third parties in or outside the EEA.
- Duration of personal data storage
BBCA stores the personal data of the data subjects in accordance with the statutory storage periods, and when there are none, according to its internal rules.
The total duration for storing personal data and documents of users/potential (future) users is 6 (six) months after termination of the registration of the respective user.
The total duration for storage of personal data and documents of BBCA’s counterparties is five (5) years after completion of the transaction and termination of relations with the counterparty. Where BBCA is referred to in this Information and in the User Consent Declaration, it shall be deemed to be the Bulgarian Breast and Gynecological Cancer Association and its successors in title in the event that the Society ceases to exist.