Note: the authoritative text of this document exists only in Bulgarian. What follows is an overview in English of what it covers. For the full text, see Инструкция за защита на личните данни. In the event of any discrepancy, the Bulgarian text prevails.
What this document is
It is the internal personal data protection instruction of DZHIPAL Ltd (G-PAL), company ID 207998646, with its seat at 270 Vasil Levski Blvd, Plovdiv. It was approved by order of the Manager and is issued under Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act and related national legislation. It supplements the privacy policy published on this website.
The instruction governs how personal data collected by the controller is processed and protected, the conditions and procedure for maintaining registers of personal data, and how processing is supervised within the company.
What it covers
- General provisions — scope, legal basis and how the instruction relates to the published privacy policy.
- Data protection principles — lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
- Controller, processor and registers — who acts in which role, and which registers of personal data the company maintains.
- Data protection officer — the role, responsibilities and reporting line.
- Personal data breach procedure — how a breach is detected, recorded, assessed and notified.
- Keeping data up to date — how records are corrected and refreshed.
- Accountability — the documentation kept to demonstrate compliance.
Your rights
If you are in Bulgaria or the EU, the GDPR gives you the right of access to your personal data, and rights to rectification, erasure, restriction of processing, objection and data portability. To exercise any of them, or to ask a question about how we handle your data, write to [email protected] or call +359 877 166 555. You may also complain to the Commission for Personal Data Protection in Bulgaria.
