This document contains important information about the processing of the personal data of natural persons by the company “Sodexo Pass Bulgaria” EOOD (hereinafter referred to as “Company”) in its quality of personal data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Sodexo Pass Bulgaria” EOOD processes personal data to all or some of the following categories of natural persons, with regard to the contracts it concludes:
- clients – natural persons;
- legal representatives and authorized representatives of clients – legal entities;
- contact persons with clients – legal entities under the contract or contracts concluded with them (hereinafter collectively referred to as “Contract”);
- employees of the clients – legal entities who enter in contact with “Sodexo Pass Bulgaria” EOOD during the operational execution of the Contract.
If you are included into any of the above categories of persons, please read this document carefully. The terms “you”, “yours” and other similar terms apply to the persons included in the above categories.
1. Identity of the Company. Contact details
“Sodexo Pass Bulgaria” EOOD is a company established and existing under the laws of the Republic of Bulgaria, registered in the Commercial Register of the Bulgarian Registry Agency under UIC 131085380, with seat and registered office at Sofia 1766, district Mladost, neighbourhood Mladost 4, 1 Business Park Sofia Str., building 12, floor 1.
If you have questions about the processing of your personal data or wish to exercise some of your rights as a data subject, please contact the Company:
- by e-mail: firstname.lastname@example.org; or
- by phone: 0700 40 700; or
- by post to the following address: Sofia 1766, district Mladost, neighbourhood Mladost 4, 1 Business Park Sofia Str., Building 12, floor 1.
2. Purposes and legal basis for the processing
“Sodexo Pass Bulgaria” EOOD may process your personal data for the following purposes:
(1) Conducting negotiations and concluding a legally binding Contract between the involved parties;
(2) Exact and timely implementation of the Contract concluded with you or with your company and performance of all necessary communication between us and you or your company.
(3) Maintaining the business relationship between “Sodexo Pass Bulgaria” EOOD and its contractors, including by sending commercial communications and information where this is provided for in the Contract or upon your written consent.
The legal basis for the processing of your personal data for the purposes listed above are the following:
- contractual basis: performance of the contractual obligations of “Sodexo Pass Bulgaria” EOOD under the Contract concluded with you or with your company;
- legal obligations: for example, fulfilment of the obligations of “Sodexo Pass Bulgaria” EOOD arising from the tax legislation, including, but not limited to the need to issue or store tax invoices and credit/debit notes.
- your consent: if no other legal basis can be applied, for example – when you want to receive offers, advertising and marketing messages. When processing is done on the basis of your consent, you have the right to withdraw your consent at any time, however, without affecting the lawfulness of processing based on the consent before its withdrawal. To withdraw your consent, please contact the Company by using one of the ways specified in Item 1 of this document.
Your data are not processed for the purposes of automated decision making, including profiling, within the meaning of the applicable legislation.
3. Categories of personal data processed by the Company
“Sodexo Pass Bulgaria” EOOD may processes all or part of the following categories of personal data:
- Identifying data, such as three names and PIN (or date and place of birth);
- Contact details, such as correspondence address, e-mail and phone number;
- Data about occupied position, including about your representative powers.
4. What happens if you do not provide your personal data?
Your personal data is necessary for the correct performance by “Sodexo Pass Bulgaria” EOOD of its pre-contractual or contractual obligations. In the event that you do not provide the required personal data to “Sodexo Pass Bulgaria” EOOD, this may hinder the conclusion and/or the proper performance of the Contract(s) between “Sodexo Pass Bulgaria” EOOD and you or your company.
5. How do your personal data reach us?
Your personal data will be obtained by “Sodexo Pass Bulgaria” EOOD from yourself or from another employee/representative of your company (where applicable).
6. With whom the Company may share your personal data?
“Sodexo Pass Bulgaria” EOOD may share your personal data with its subcontractors who are involved in the execution of the Contract, with accountants and legal advisors of the Company, as well with other subsidiaries of the Group SODEXO.
“Sodexo Pass Bulgaria” EOOD may also be obliged to disclose personal data to regulatory authorities, courts and administrative, government or municipal authorities where required by law, regulation or legal process, or to defend the interests, rights or property of “Sodexo Pass Bulgaria” EOOD or related third parties.
In the event that “Sodexo Pass Bulgaria” EOOD intends to transfer your personal data to a company established outside the European Union or the European Economic Area, “Sodexo Pass Bulgaria” EOOD will inform you and will make every effort to ensure that there are appropriate safeguards that provide an adequate level of protection of your personal data as required by the applicable legislation. This may include, for example, the use of intercompany or external data processing agreements based on EU approved Standard Contractual Clauses or EU-US Privacy Shield, or such other mechanisms as have been recognized or approved by the relevant authorities. If you have any questions regarding the transfer of your personal data to third parties, please contact the Company by using one of the ways specified in Paragraph 1 of this document.
7. Period for which your personal data will be stored
Your personal data will be stored by “Sodexo Pass Bulgaria” EOOD until the final termination of the Contract and the expiry of the statutory limitation periods for filing claims arising out of or relating to the Contract and/or until the expiry of the statutory storage periods of documents for tax control and inspections.
If you cease to be an employee and/or a contact person of your company – contractor of “Sodexo Pass Bulgaria” EOOD, “Sodexo Pass Bulgaria” EOOD will discontinue the processing of your personal data upon receipt of a notification of this circumstance.
8. Your rights in relation to the personal data protection
As data subject you are entitled to exercise the following rights in relation to your personal data collected and processed by our Company:
|Right of access and rectification||You may request access to your Personal data. You also have the right to request the rectification of incorrect Personal data or the supplement of incomplete Personal data.
You may request any available information about the source of the Personal Data as well as a copy of the personal data processed by Sodexo.
|Right to be forgotten||The right to be forgotten allows you to request the deletion of your Personal data if:
|Right to restriction of processing||You may request that processing of your Personal data be restricted in the cases where:
|Right to data portability||You can request, where applicable, the portability of your Personal data that you have provided to Sodexo, in a structured, commonly used, and machine-readable format you have the right to transmit this data to another Controller without hindrance from Sodexo where:
(a) the processing of your personal data is based on consent or on a contractual obligation; and
|Right to object||You may object to the processing of your Personal data, including in connection with profiling or direct marketing (marketing communications). When processing of your Personal Data is based on your consent, you can withdraw your consent at any time.|
|Right not to be subject to automated decisions||You have the right not to be subject to a decision based solely on automated processing, including profiling, which has a legal affect upon you or significantly affects you.|
|Right to lodge a complaint with a Supervisory Authority||If you have a privacy-related complaint against us, you should complete and submit the Complaint/Data Subjects’ Request Form or make your complaint by email or by letter to the contacts listed in Paragraph 1 of this Document in accordance with our Global Data Protection Complaint/Data Subject’s Request Policy. If you are dissatisfied with our response, you may then seek further recourse by contacting the relevant local Supervisory Authority – the Bulgarian Commission for personal data protection, or the local competent court. You may also contact our lead Supervisory Authority at our headquarters in France, the French Supervisory Authority (the “CNIL”, www.cnil.fr).|
The rights described above shall be exercised in compliance with the provisions of the applicable data protection legislation. For more information about these rights and how to exercise them, please contact the Company by using one of the ways specified in Paragraph 1 of this document.
To learn about our global Global Data Protection Policy or our Global Data Protection Complaint/Data Subject’s Request Policy, or if you wish to receive a Complaint/Data Subjects’ Request Form, please visit our website at: www.sodexo.bg.