Media Center

Home / Media Center / Personal data protection policy

Personal data protection policy

The right to privacy and the protection of your personal data is a main priority of the Bulgarian Air Traffic Services Authority (BULATSA), which is committed to process your personal data responsibly and in accordance with the applicable European and national legislation on the protection of personal data.

This personal data protection policy is applicable to your personal data if you are a job applicant, a legal representative/employee of our contracting party, participate in a training organized by us, visit any of our buildings or wish to use a service, submit an inquiry or other correspondence sent through the forms provided for this purpose on the enterprise’s website.

Who processes and is responsible for your personal data?

Administrator of the personal data is the Bulgarian Air Traffic Services Authority (BULATSA), entered in the commercial register under UIC 000697179, with headquarters address: 1, Brussels Blvd., Sofia 1540, “Slatina” district, website: www.bulatsa.com.

BULATSA has a specially designated Data Protection Officer: Daniela Vasileva.

What personal data do we process?

Depending on the specific goals and grounds, BULATSA processes all or some of the personal data specified below, separately or in combination between them:

  • Identification data: three names, gender, nationality, Unified Personal Number/other identifier, date and place of birth, identity document data;
  • Contact data: address, e-mail, telephone number;
  • Health data;
  • Data on education, professional qualification and work activity;
  • Data relating to convictions and offences;
  • Financial information, including bank accounts;
  • Other data required under the special laws that regulate labor relations, tax-insurance relations and accounting of the activity;
  • Other information and personal data necessary for the fulfillment of the statutory obligations of BULATSA to ensure security in civil aviation;
  • Photos and videos from conferences and events;
  • IP addresses, cookies and other digital information when we provide services through our website or provide access to the Internet through our network. Please check the Cookies section for more information: https://www.bulatsa.com/en/media-center/cookie-policy/.

For what purposes do we use your personal data?

  • Fulfillment of the legal obligations of the enterprise under the Civil Aviation Act and the by-laws on its implementation, the National Civil Aviation Security Program of the Republic of Bulgaria, the ratified international treaties in the field of civil aviation to which the Republic of Bulgaria is a party and the applicable regulations of the European Union, as well as other normative acts applicable to the activity of the enterprise;
  • Fulfilment of orders of competent state authorities;
  • Selection of employees, including conducting specialized and language trainings for positions opened by us;
  • Conclusion of contracts and pre-contractual relations;
  • Processing online requests for access to our services, online contact forms and documents submitted through the application platform on our website;
  • Ensuring the security of employees, visitors, as well as the infrastructure of the enterprise, through a video surveillance system, physical security, access control and registration of external visitors;
  • Ensuring the normal functioning, maintenance and security of the website and the information and communication systems of BULATSA;
  • Organization and conduct of specialized trainings by the Training Organization at BULATSA;
  • Exercising the rights, fulfilling the obligations and protecting the rights and legitimate interests of BULATSA, including by court order;
  • Implementation of the social policy of BULATSA;
  • Processing requests under the Access to Public Information Act;
  • Promotion of the BULATSA’s activity, including by distributing advertising materials and brochures, posting photos and/or videos on the website / Facebook page, LinkedIn page of BULATSA, or in other media.

Legal grounds for processing

BULATSA processes personal data only in the presence of one of the alternative legal grounds under the General Regulation, and in particular:

  • Performance of a contract, including the pre-contractual relations before its conclusion;
  • Legal obligations applicable to the enterprise;
  • The legitimate interests of the enterprise, insofar as they take precedence over the interests or fundamental rights and freedoms of the data subjects;
  • In some cases, we process personal data only after the prior consent of the data subject. Consent is a separate basis for the processing of your personal data, whereby the purpose of processing is specified therein and may not be covered by the purposes listed in this Personal Data Protection Policy. Consent already given can be withdrawn by the individual at any time.

Who do we share the collected personal data with?

  • Competent authorities that, by virtue of a legal act, have the authority to demand from the enterprise the provision of information, including personal data – court, supervisory, regulatory or control authorities, authorities with powers to protect national security and public order.
  • Other competent state bodies in fulfillment of an obligation provided for by law.
  • The persons processing personal data with the purpose of maintaining the information and communication systems of the enterprise, delivery of services, security, video surveillance, etc. In these cases, the relationship between BULATSA and the personal data processor is regulated by a contract or other legal act, which provides for appropriate measures to guarantee the security of personal data.

What are your rights?

Every natural person whose data is processed by BULATSA has the following rights:

  • right of access to his/her personal data, including to receive a copy of them;
  • right to correct or supplement inaccurate or incomplete personal data;
  • right to delete personal data that is processed without a legal basis;
  • right to restrict the processing – in the event of a legal dispute between BULATSA and the person until its resolution or for the establishment, exercise or defense of legal claims;
  • right to object – at any time and on grounds related to the individual’s specific situation, provided that there are no compelling legal grounds for the processing that take precedence over the interests, rights and freedoms of the data subject, or legal proceedings;
  • right to portability – only in the event that the personal data is processed automatically on the basis of consent or contract;
  • right not to be subject to a fully automated decision involving profiling that gives rise to legal consequences for the data subject or significantly affects him/her.

In accordance with the Personal Data Protection Act, the above-mentioned rights can be exercised by submitting a written application on site at BULATSA. An application can also be submitted electronically pursuant to the Law on Electronic Documents and Electronic Authentication Services. The application must be made personally by the data subject or by a person explicitly authorized by him/her. BULATSA shall decide on the data subject’s application within 30 days of its submission. When the requests of a data subject in connection with the exercise of the above-mentioned rights are manifestly unfounded or excessive, BULATSA may impose the payment of a fee or refuse to take action on the application.

Right of appeal

In accordance with the Personal Data Protection Act and Regulation (EU) 2016/679, every natural person who believes that the right to protection of his/her personal data has been violated, may submit a complaint to the Commission for Personal Data Protection at address: 2, Prof. Tsvetan Lazarov Blvd., 1592 Sofia, website: https://www.cpdp.bg/en .

Mandatory or voluntary nature of the data provided

Personal data is provided to BULATSA directly by the persons themselves, by their employers or by our contracting parties. In the event that the person does not provide the required information, including the necessary personal data, BULATSA will not be able to enter into a contract with him/her and respectively will not be able provide the requested service or information.

Security of personal data

BULATSA applies appropriate physical, organizational and technical measures to protect your personal data from accidental loss, unauthorized access, use and disclosure, including continuous training of employees and assuming an explicit obligation by the employees for confidentiality.

How long do we keep your personal data?

The duration of storage of personal data depends on the processing purposes for which they were collected. We keep your personal data for as long as is reasonable and necessary to fulfill the purpose for which it was collected and in accordance with applicable laws.

The documents provided by job applicants for the purposes of competition procedure and containing their personal data, such as CV, references and others, are stored for a maximum period of 5 years, if the job applicants have given their consent for that. In the absence of consent, the provided documents, together with the personal data objectified in them, shall be destroyed within 6 months after completion of the competition procedure for the needs of which they were provided.

The documents containing personal data of the job applicants, which were created in BULATSA for the needs of a competitive selection or recruitment procedure, are kept for a period of 3 years.

The personal data processed for the purpose of concluding and performing a contract are kept for the duration of the contract and until the final settlement of all financial relations between the parties and expiration of the legally defined data storage obligations.

The personal data processed for the purpose of issuing accounting/financial documents for the implementation of tax-insurance control are kept for at least 5 years after expiration of the prescription period for repayment of the public claim, unless the applicable legislation provides for a longer period.

The personal data of contractors under the PPA are kept for a period of 5 years from the date of completion of the performance of the public procurement contract or from the date of termination of the procedure.

Video surveillance records are kept for a period of 2 months.

Timeliness and changes of the Personal Data Protection Policy

In order to implement the most up-to-date protection measures and in order to comply with the legislation in force, we will regularly update this Personal Data Protection Policy. The changes will take effect immediately after their announcement. Regularly reviewing this page ensures that you will always be aware of what information we collect, how and for what purposes BULATSA uses it, and under what circumstances (if any) we will share it with other parties.

Completeness, accuracy and punctuality of information

The information on this Website is intended to provide users with general information on matters that may be of interest to them. Its use is entirely at the discretion of the users. The Website may contain references to certain laws and regulations, which may be changed over time and should be interpreted only for the particular moment. The whole content of the Website and all services provided by it are without guarantees of completeness, accuracy or timeliness, and in this sense we could not be liable for any contractual or non-contractual, material or non-material damages that occurred after the use of our Website.

A A