This document contains important information about the processing of the personal data of natural persons by the company “Sodexo Pass Bulgaria” EOOD (hereinafter referred to as “Company”) in its quality of personal data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
“Sodexo Pass Bulgaria” EOOD process personal data of all or some of the following categories of natural persons in connection with the in connection with the services provided under a contract or contracts (hereinafter referred to as the “Contract”):
- Clients – natural persons;
- legal representatives, authorized representatives and contact persons of clients and other contractors – legal entities;
- employees of clients – legal entities, when this is required for the conclusion or performance of the Contract and/or upon their request or with their consent.
If you are included into any of the above categories of persons, please read this document carefully. The terms “you”, “yours” and others similar terms apply to the persons included in the above categories.
1. Identity of the Company. Contact details
“Sodexo Pass Bulgaria” EOOD is a company established and existing under the laws of the Republic of Bulgaria, registered in the Commercial Register of the Bulgarian Registry Agency under UIC 131085380, with seat and registered office in Sofia 1766, district Mladost – 4, 1 Business Park Sofia Str., building 12, floor 1.
If you have questions about the processing of your personal data or wish to exercise some of your rights as a data subject, please contact the Company:
- by e-mail: dpo.bg@sodexo.com; or
- by phone: 0700 40 700; or
- by post to the following address: Sofia 1766, district Mladost – 4, 1 Business Park Sofia Str., building 12, floor 1.
2. Purposes and legal basis for the processing
“Sodexo Pass Bulgaria” EOOD may process your personal data for the following purposes:
(1) Conducting negotiations and concluding a legally binding Contract between the parties;
(2) Correct and timely implementation of the Contract concluded with you or with your company/employer and performance of all necessary communications between “Sodexo Pass Bulgaria” EOOD and you or your company/employer.
(3) Maintaining the business relationship between “Sodexo Pass Bulgaria” EOOD and its contractors, including by sending commercial communications and marketing information where this is provided for in the relevant Contract and/or based on your explicit consent.
The legal basis for the processing of your personal data for the purposes listed above are the following:
- contractual basis: performance of the contractual obligations of “Sodexo Pass Bulgaria” EOOD under the Contract concluded with your or with your company/employer;
- legal obligations: for example, fulfilment of the obligations of “Sodexo Pass Bulgaria” EOOD arising from the tax legislation, including, but not limited to the need to issue or store tax invoices and credit/debit notes;
- your consent: if no other legal basis can be applied, for example – when your Subscription to the Programme is concluded through your employer or other legal entity, or when you are willing to receive offers, advertising and marketing messages. When processing is performed on the basis of your consent, you have the right to withdraw your consent at any time, but this will not affect the lawfulness of the processing based on your consent prior to its withdrawal. To withdraw your consent, please contact the Company in one of the ways specified in item 1 of this document.
Your data are not processed for the purposes of automated decision making, including profiling, within the meaning of the applicable legislation.
3. Categories of personal data processed by the Company
“Sodexo Pass Bulgaria” EOOD may process all or part of the following categories of personal data:
- Identifying data, such as three names, Personal Identification Number (or date and place of birth) and passport data;
- Contact details, such as correspondence address, email and phone number;
- Data about occupied position, including for representative powers.
4. What happens if you do not provide your personal data?
Your personal data are necessary for the correct performance by “Sodexo Pass Bulgaria” EOOD of its pre-contractual or contractual obligations. In the event that you do not provide the required personal data to “Sodexo Pass Bulgaria” EOOD, this may hinder the conclusion and/or the proper performance of the Contract(s) between “Sodexo Pass Bulgaria” EOOD and you or your company/employer.
5. How do your personal data reach us?
Your personal data will be obtained by “Sodexo Pass Bulgaria” EOOD from yourself or from another employee/representative of your company/employer (when applicable).
6. With whom the Company may share your personal data?
“Sodexo Pass Bulgaria” EOOD may share your personal data with other subsidiaries of the corporate group of SODEXO, as well as with accountants, legal advisors and subcontractors of the Company who are involved in the execution of the Contract.
“Sodexo Pass Bulgaria” EOOD may also be required to disclose your personal data to regulatory authorities, courts and administrative, state or municipal authorities when required by law or by statutory procedures, or in order to protect the interests, rights or property of “Sodexo Pass Bulgaria” EOOD or its related third parties.
In the event that “Sodexo Pass Bulgaria” EOOD intends to transfer your personal data to a company established outside the European Union or the European Economic Area, “Sodexo Pass Bulgaria” EOOD will inform you and will make every effort to ensure that there are appropriate safeguards that provide an adequate level of protection of your personal data as required by the applicable legislation. This may include, for example, the use of intercompany or external data processing agreements based on EU approved Standard Contractual Clauses or EU-US Privacy Shield, or such other mechanisms as have been recognized or approved by the relevant authorities. If you have any questions regarding the transfer of your personal data to third parties, please contact the Company by using one of the ways specified in Paragraph 1 of this document.
7. Period for which your personal data will be stored
Your personal data will be stored by “Sodexo Pass Bulgaria” EOOD until the final termination of the contract or of the Subscription and the expiry of the statutory limitation periods for filing claims arising out of or relating to the contract or to the Contract, and/or until the expiry of the statutory storage periods of documents for tax control and inspections.
If you cease to be an employee and/or contact person of the legal entity that concluded a Contract with “Sodexo Pass Bulgaria” EOOD, “Sodexo Pass Bulgaria” EOOD will discontinue the processing of your personal data upon receipt of a notification of this circumstance or after the withdrawal of your consent, unless there is some other legal basis for their processing.
8. Your rights in relation to the personal data protection
As data subject you are entitled to exercise the following rights in relation to your personal data collected and processed by our Company:
| Right of access and rectification | You can request a copy of the Personal Data we hold about you. You may also request rectification of inaccurate Personal Data, or to have incomplete Personal Data completed. |
| Right to erasure | Your right to be forgotten entitles you to request the erasure of your Personal Data in cases where:
|
| Right to restriction of processing | You may request that processing of your Personal Data be restricted in the cases where:
|
| Right to data portability | You can request, where applicable, the portability of your Personal Data that you have provided to Sodexo, in a structured, commonly used, and machine-readable format you have the right to transmit this data to another Controller without hindrance from Sodexo where: (a) the processing of your Personal Data is based on consent or on a contract; and (b) the processing is carried out by automated means. You can also request that your Personal Data be transmitted to a third party of your choice (where technically feasible). |
| Right to object to processing | You may object (i.e. exercise your right to “opt-out”) to the processing of your Personal Data particularly in relation to profiling or to marketing communications. When we process your Personal Data on the basis of your consent, you can withdraw your consent at any time. |
| Right not to be subject to automated decisions | You have the right not to be subject to a decision based solely on automated processing, including profiling, which has a legal affect upon you or significantly affects you. |
| Right to lodge a Complaint | You can choose to lodge a Complaint with the Data Protection Supervisory Authority in the country of your habitual residence, place of work or place of the alleged infringement, regardless of whether you have suffered damages. Personal Data You have also the right to lodge your Complaint before the courts where the Sodexo entity has an establishment or where you have your habitual residence. |
The rights described above shall be exercised in compliance with the provisions of the applicable data protection legislation. For more information about these rights and how to exercise them, please contact the Company by using one of the ways specified in Paragraph 1 of this document.
In order to access to our Data Protection Requests Policy or to our Data Protection Policy, or if you are willing to download a Request Form, please visit our website www.sodexo.bg.