[et_pb_section fb_built=”1″ admin_label=”section” _builder_version=”4.16″ global_colors_info=”{}”][et_pb_row admin_label=”row” _builder_version=”4.27.4″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” hover_enabled=”0″ global_colors_info=”{}” custom_margin=”70px||||false|false” custom_margin_last_edited=”on|phone” sticky_enabled=”0″ custom_margin_tablet=”10px||||false|false” custom_margin_phone=”0px||||false|false”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_font=”Audiowide|–et_global_body_font_weight|||||||” header_text_align=”center” hover_enabled=”0″ sticky_enabled=”0″]<\/p>\n
[\/et_pb_text][et_pb_text admin_label=”Text” _builder_version=”4.27.4″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” global_colors_info=”{}”]<\/p>\n
Approved by: ……………..
Manager
\u201cAVE BULGARIA LOGISTICS\u201d LLC<\/p>\n
\u201cAVE BULGARIA LOGISTICS\u201d LLC (hereinafter the \u201cCompany\u201d or the \u201cController\u201d) is a limited liability company registered in the Commercial Register with the Registry Agency under UIC 203003174, with registered office and address of management: Sofia, \u201cStudentski\u201d district, \u201cMalinova dolina\u201d residential complex, bl. 29, entrance \u201cV\u201d, as well as head office at: Sofia, 9 \u201cVitoshki kambani\u201d St., 3rd floor. The company website is <\/a>www.avebulgaria.com<\/u><\/span><\/a>.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC\u2019s main business activity is \u201cForwarding and transport transactions in the country and abroad,\u201d and the Company may carry out any other activity not prohibited by law. As a freight forwarder, the Company operates mainly in Europe and Asia, and organizing transports to America is not uncommon. It does not own transport vehicles\u2014the assigned cargo is organized through subcontractors: road carriers, airlines, and shipping lines. The services offered are specialized and related to the core activity: transport of goods by air, land and sea, customs representation, organization of urgent shipments, \u201cOnboard Courier,\u201d consolidation, handling, packaging, distribution, as well as consulting services related to these activities\u2014transport (unimodal or multimodal), consolidation, warehousing, handling, packaging or distribution of goods and cargo, and the provision of consulting services connected thereto. Forwarding services also include logistics services carried out through modern technologies related to the transport, handling or storage of goods and cargo, i.e., end-to-end supply chain management. In cases of storage, subcontractors with their own warehouses are again used.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC is a personal data Controller within the meaning of Regulation (EU) 2016\/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95\/46\/EC (hereinafter the \u201cGDPR\u201d), and the Bulgarian Personal Data Protection Act (hereinafter the \u201cPDPA\u201d).<\/p>\n With this Privacy and Personal Data Protection Policy (hereinafter the \u201cPolicy\u201d), \u201cAVE BULGARIA LOGISTICS\u201d LLC recognizes the inviolability of the individual and endeavors to protect against unlawful processing of personal data of natural persons. In accordance with Bulgarian legislation, the GDPR, and best practices, \u201cAVE BULGARIA LOGISTICS\u201d LLC has taken the necessary technical and organizational measures to protect the personal data of natural persons.<\/p>\n Familiarization with this Policy prior to using our services is necessary, since the provision of services involves the collection of certain categories of personal data that \u201cAVE BULGARIA LOGISTICS\u201d LLC needs to fully provide the services.<\/p>\n With this Privacy and Personal Data Protection Policy, \u201cAVE BULGARIA LOGISTICS\u201d LLC aims to inform natural persons regarding:<\/p>\n the purposes and means of processing personal data;<\/p>\n<\/li>\n the recipients or categories of recipients to whom the data may be disclosed;<\/p>\n<\/li>\n the legal basis for processing personal data \/the mandatory or voluntary nature of providing the data\/, as well as the consequences of refusing to provide them;<\/p>\n<\/li>\n information about the right of access, the right to rectification and erasure of the collected data.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n \u201cPersonal data\u201d \u2013 any information related to an identified or identifiable natural person (\u201cdata subject\u201d); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.<\/p>\n \u201cSpecial categories of personal data\u201d \u2013 personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person\u2019s sex life or sexual orientation.<\/p>\n \u201cProcessing\u201d \u2013 any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organizing, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.<\/p>\n \u201cController\u201d \u2013 any natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by EU law or by the law of a Member State, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law.<\/p>\n \u201cJoint Controllers\u201d \u2013 where two or more Controllers jointly determine the purposes and means of processing personal data, they are joint Controllers.<\/p>\n \u201cProcessor\u201d \u2013 a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.<\/p>\n \u201cRegister\u201d \u2013 any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis.<\/p>\n \u201cData subject\u201d \u2013 any living natural person who is the subject of personal data stored by the Controller.<\/p>\n \u201cData subject\u2019s consent\u201d \u2013 any freely given, specific, informed and unambiguous indication of the data subject\u2019s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.<\/p>\n \u201cChild\u201d \u2013 the GDPR defines a child as anyone under the age of 16, although this may be reduced to 13 under Member State law. The processing of a child\u2019s personal data is lawful only if a parent or guardian has given consent. The Controller makes reasonable efforts to verify, in such cases, that the holder of parental responsibility for the child has given or authorized consent.<\/p>\n \u201cProfiling\u201d \u2013 any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person\u2019s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.<\/p>\n \u201cPersonal data breach\u201d \u2013 a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.<\/p>\n \u201cMain establishment\u201d \u2013 the Controller\u2019s headquarters in the EU will be the place where it takes the main decisions as to the purposes and means of its data processing activities. For a Processor, its main establishment in the EU will be its administrative center. If the Controller is established outside the EU, it must designate its representative in the jurisdiction in which the Controller operates to act on its behalf and liaise with supervisory authorities.<\/p>\n \u201cRecipient\u201d \u2013 a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as \u201crecipients\u201d; the processing of those data by those public authorities shall comply with applicable data protection rules according to the purposes of the processing.<\/p>\n \u201cThird party\u201d \u2013 any natural or legal person, public authority, agency or body other than the data subject, the Controller, the Processor and persons who, under the direct authority of the Controller or Processor, are authorized to process personal data.<\/p>\n \u201cData Discloser\u201d \u2013 a party to a contract that transmits to a Recipient personal data of natural persons which it processes.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC processes personal data on the following grounds:<\/p>\n Based on the data subject\u2019s freely given, informed and explicit consent;<\/p>\n<\/li>\n Where there is a legal obligation to process the data;<\/p>\n<\/li>\n Upon conclusion or performance of a contract, as well as actions preceding the conclusion of a contract;<\/p>\n<\/li>\n Where necessary to protect the vital interests of the natural person or the legitimate interest of the Controller, provided it does not conflict with the lawful interests of the natural person.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC processes personal data provided by employees, assignors, suppliers, clients, counterparties and other natural persons to whom the data relate in connection with the provision of services within its scope of activity, as well as for the preparation and conclusion of contracts.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC also processes personal data that were not obtained from the natural person to whom they relate, but were provided by a third party in connection with a specific service, whereby the person providing these data to \u201cAVE BULGARIA LOGISTICS\u201d LLC undertakes to:<\/p>\n provide the third party with the Controller\u2019s details;<\/p>\n<\/li>\n inform the third party of the purposes, the categories of data provided and the categories of recipients of those data;<\/p>\n<\/li>\n provide information on the right of access and rectification of personal data of the person to whom the data relate.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n Personal data are stored for a period necessary according to the purposes for which they were collected or for a period established by a statutory act.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC processes personal data through a set of actions that may be performed by automated or other non-automated means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, provision, updating or combination, blocking, erasure and destruction.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC processes personal data independently or by assigning processing to Processors, by written contract determining the purposes and scope of the obligations assigned by the Controller to the Processor, provided there is a relevant legal basis in accordance with the requirements of the GDPR\/PDPA. Processors on behalf of \u201cAVE BULGARIA LOGISTICS\u201d LLC may be, for example, the Controller\u2019s employees, whose rights and obligations in relation to the processing of personal data are duly regulated in the Controller\u2019s internal acts as well as in the respective job descriptions. Processors may also be third parties outside the Controller\u2019s structure to whom personal data processing has been assigned on behalf of the Controller.<\/p>\n The listed processing activities are carried out in compliance with the following principles:<\/p>\n lawfulness, fairness and transparency of personal data processing;<\/p>\n<\/li>\n purpose limitation of personal data processing;<\/p>\n<\/li>\n data minimization (proportionality) in personal data processing;<\/p>\n<\/li>\n accuracy and up-to-dateness of processed personal data.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n In connection with statutory obligations and pre-contractual and contractual relations, in carrying out its activity, \u201cAVE BULGARIA LOGISTICS\u201d LLC processes personal data of its employees, clients and third parties for the following purposes:<\/p>\n administration of employment relations: personal data of job applicants and employees regarding an existing employment relationship (processing most often results from the Controller\u2019s statutory obligations arising from the specifics of the legislation governing its activity, financial-accounting activity, pension, health and social insurance activity, human resources management, automatic exchange of information in the field of taxation and others);<\/p>\n<\/li>\n administration of contractual relations and organization of transport and related services: personal data of persons prior to a service contract and of clients (including where explicit consent is given or processing is necessary for the performance of obligations under a contract to which the natural person is a party, as well as actions preceding the conclusion of a contract and undertaken at the request of the person).<\/p>\n<\/p>\n<\/li>\n<\/ul>\n Categories of personal data that \u201cAVE BULGARIA LOGISTICS\u201d LLC processes to carry out its activity:<\/p>\n Related to the physical identity of natural persons \u2013 name, Unified Civil Number (EGN), passport data, driver\u2019s license data, address, phone, e-mail, etc.;<\/p>\n<\/li>\n Related to economic identity \u2013 property and financial status, participation and\/or ownership of shares, securities in companies, presence of public liabilities, data necessary for identification for the purposes of the tax legislation of the jurisdiction where the person is a tax resident, tax identification number issued by that jurisdiction, functions of controlling persons, etc.;<\/p>\n<\/li>\n Related to social identity \u2013 education, employment, citizenship, permanent residence;<\/p>\n<\/li>\n Related to family identity \u2013 marital status, family relations, etc.;<\/p>\n<\/li>\n Personal data relating to health status \u2013 processed in connection with the administration of employment relations in the Company.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n Personal data relating to the health status of employees or job applicants are processed only in connection with the performance of statutory obligations of \u201cAVE BULGARIA LOGISTICS\u201d LLC in the field of labor and social security legislation, in compliance with the requirements of Regulation (EU) 2016\/679 of the European Parliament and\/or a legal act of the Republic of Bulgaria governing the matter.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC does not process personal data that:<\/p>\n reveal racial or ethnic origin;<\/p>\n<\/li>\n reveal political, religious or philosophical beliefs, membership in political parties or organizations, associations with religious, philosophical, political or trade union purposes;<\/p>\n<\/li>\n relate to genetic and biometric data processed solely for the purpose of identifying a natural person;<\/p>\n<\/li>\n relate to a natural person\u2019s sex life or sexual orientation or to the human genome.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC maintains the following registers of personal data processing activities:<\/p>\n Personnel<\/p>\n<\/li>\n Counterparties<\/p>\n<\/li>\n Clients<\/p>\n<\/li>\n Video surveillance<\/p>\n<\/p>\n<\/li>\n<\/ul>\n The data subject has the right to information about the purposes of processing his or her personal data, provided at the time of collection and upon subsequent change of the processing purposes.<\/p>\n The data subject has the right to request confirmation as to whether his or her personal data are being processed and to receive information regarding the type of personal data processed by \u201cAVE BULGARIA LOGISTICS\u201d LLC that personally concern him or her. This information shall be provided regardless of where the personal data are processed. The data subject may submit a request for access to personal data to the Controller, including through the Data Protection Officer (DPO) of \u201cAVE BULGARIA LOGISTICS\u201d LLC.<\/p>\n Where the processing of personal data is carried out by automated means, the data subject also has the right to receive the personal data concerning him or her, which he or she has provided to the Controller, in a structured, commonly used, machine-readable and interoperable format, and to transmit those data to another controller. This right applies when the data subject has provided the personal data on the basis of his or her consent or the processing is necessary due to a contractual obligation. The right does not apply when the processing is based on a legal ground other than consent or contract. When exercising this right, \u201cAVE BULGARIA LOGISTICS\u201d LLC assists the subject by providing, where possible, the personal data processed for him or her in the desired format, which must be structured, commonly used and machine-readable. This information is provided by \u201cAVE BULGARIA LOGISTICS\u201d LLC to the subject in accordance with established rules and statutory requirements.<\/p>\n If the stored personal data are inaccurate or incomplete, the data subject may request that they be corrected. At any time during the processing of personal data, the data subject may ask the Controller to restrict the use of his or her personal data for part or all of the processing purposes for which the subject has given consent.<\/p>\n The data subject has the right to request that the Controller restrict the processing of his or her data in the following cases:<\/p>\n the accuracy of the personal data is contested by the data subject, for a period enabling verification of the accuracy of the personal data;<\/p>\n<\/li>\n the processing is unlawful, but the data subject opposes the erasure of the personal data and requests the restriction of their use instead;<\/p>\n<\/li>\n the Controller no longer needs the personal data for the purposes of the processing, but the data are required by the data subject for the establishment, exercise or defense of legal claims;<\/p>\n<\/li>\n the data subject has objected to processing pending the verification whether the Controller\u2019s legitimate grounds override those of the data subject.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n When processing has been restricted pursuant to the conditions in the previous paragraph, such data shall, with the exception of storage, be processed only with the data subject\u2019s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person, or for reasons of important public interest.<\/p>\n If a request for information, rectification, or restriction of processing is refused, the data subject shall be informed of the reason for the refusal. The data subject has the right to request the Controller to erase personal data concerning him or her, and the Controller has the obligation to erase them without undue delay where:<\/p>\n the data are no longer necessary for the initial purpose and there is no new lawful purpose;<\/p>\n<\/li>\n the lawful basis for processing is the data subject\u2019s consent and he or she withdraws that consent, and there is no other legal basis for processing;<\/p>\n<\/li>\n the data subject objects to the processing and there is no other legal basis for processing;<\/p>\n<\/li>\n the personal data have been unlawfully processed;<\/p>\n<\/li>\n the personal data must be erased in order to comply with a legal obligation under the legislation applicable to the Controller;<\/p>\n<\/li>\n the personal data have been collected in relation to the offer of information society services to a child data subject.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n When exercising this right, the Controller informs the subject how the erasure will affect their relationship going forward.<\/p>\n The right to erasure shall not apply insofar as processing is necessary:<\/p>\n for compliance by the Controller with a legal obligation requiring processing under applicable legislation; or<\/p>\n<\/li>\n for the establishment, exercise or defense of the Controller\u2019s legal claims.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n The data subject has the right to object to the processing of personal data concerning him or her. The Controller shall cease processing personal data unless it demonstrates that there are compelling legitimate grounds for the processing to continue.<\/p>\n In addition, every data subject has the right to object if his or her personal data are used for advertising purposes (direct marketing) or for market or public opinion research. In such case, the personal data shall be blocked and not used for the relevant purposes.<\/p>\n The data subject has the right to withdraw his or her consent to the processing of personal data at any time by a separate request addressed to the Controller. The data subject has the right to submit requests and complaints to the Controller related to the processing of his or her personal data, to which the Controller responds in accordance with the adopted procedure.<\/p>\n To exercise these rights, the data subject contacts the Controller through a free-text request or by using forms adopted by the Controller, sent to the e-mail office@viptrans.org or by letter to the address: Sofia, Krasno Selo district, 40 \u201cPraga\u201d Blvd., floor 1, to which the Controller responds in accordance with established rules and statutory requirements.<\/p>\n The Controller accepts that consent is present only in cases where the data subject has been fully informed about the planned processing and has expressed his or her consent without being pressured. Consent obtained under pressure or based on misleading information is not a valid basis for processing personal data.<\/p>\n Consent cannot be inferred from a lack of response to a message to the data subject. There must be active communication between the Controller and the subject for consent to exist. The Controller must be able to demonstrate that consent for the processing activities has been obtained.<\/p>\n In most cases, consent to the processing of personal data is obtained by the Controller using standardized consent documents, for example, but not limited to: when signing a contract, during recruitment, upon employment of an employee.<\/p>\n When processing personal data of children, the Controller must obtain authorization from the holders of parental responsibility (parents, guardians, etc.). This requirement applies to children under 16 years of age (unless the Member State has provided for a lower age limit, which may not be lower than 13 years).<\/p>\n The data subject may authorize another person to exercise the rights under Sections 8.1 to 8.8 of this Policy. The processing of personal data is permissible only if the data subject has consented to it, if there is a legal obligation to process the data, upon conclusion or performance of a contract, where necessary to protect the vital interests of the natural person or the legitimate interest of the Controller, provided it does not conflict with the lawful interests of the natural person. The lawfulness of processing personal data is a precondition for the transfer of personal data.<\/p>\n Consent must be declared in writing or on the basis of other legally permissible means, and the data subject must be informed in advance of the purpose of the processing and the possibility of transferring personal data to third parties. Emphasis is placed on the granting of consent when it is included in other declarations so that it is clear to the data subject.<\/p>\n Personal data may be collected only for the exhaustively listed purposes and may not be processed for purposes other than those provided. The processing of personal data must be necessary for the intended purpose. Personal data must be factually correct and, where necessary, kept up to date. The Data Controller implements appropriate technical and organizational measures to ensure the required level of data security. Only authorized personnel who have committed to comply with data confidentiality requirements are allowed to participate in the processing of personal data. \u201cAVE BULGARIA LOGISTICS\u201d LLC ensures the security of personal data in accordance with the principles set out in the GDPR\/PDPA by taking appropriate and sufficient technical and organizational measures to protect data from loss, theft, misuse, as well as from unauthorized access, disclosure, alteration or destruction.<\/p>\n To ensure sufficient protection of processed personal data, \u201cAVE BULGARIA LOGISTICS\u201d LLC uses technical measures such as, but not limited to, anti-virus protection, a firewall, encryption options, and others. \u201cAVE BULGARIA LOGISTICS\u201d LLC adopts internal rules that determine the sensitivity levels of processed personal data (information), based on which separate categories of personal data are created and processed for specific purposes. Separate categories of personal data are grouped into personal data registers. The internal rules determine both the order of access to these registers and the persons who have the right to access them, respectively to process the personal data stored in them.<\/p>\n The Controller adopts procedural rules determining measures and the order for physical access and protection of personal data, which are mandatory for all employees who process personal data.<\/p>\n All personal data should be accessible only to those employees \/ processors whose duties include processing the specific data, and access is exercised only in accordance with the adopted internal access control rules.<\/p>\n All employees of the Controller are responsible for ensuring security in the storage of the data they process, and for ensuring that the data are stored securely and are not disclosed under any circumstances to third parties, unless the Controller has granted such rights to those third parties under a written contract or a confidentiality clause.<\/p>\n The Controller introduces a \u201cclean desk\u201d policy, with which all employees who process personal data are familiar and comply. Paper records must not be left where they can be accessed by unauthorized persons and may not be removed from designated secure premises without express permission. As soon as paper documents are no longer necessary for the current work in processing personal data, they must be archived in the appropriate manner, and if there is no basis for their archiving, they must be destroyed in accordance with the established procedure.<\/p>\n Personal data may be deleted or destroyed only in accordance with the procedure adopted by the Controller. Paper records whose processing period has expired shall be shredded and destroyed as \u201cconfidential waste.\u201d Data on the hard drives of unused personal computers must be erased or the drives destroyed, in accordance with the established procedures.<\/p>\n The processing of personal data outside the Controller\u2019s premises is carried out according to the relevant procedural rules and is permissible with the express written consent of the immediate supervisor of the personal data processor or of the Controller.<\/p>\n By internal act, the Controller determines the rules for controlling the separation of personal data. These rules contain measures to ensure that data collected for different purposes can be processed separately by authorized employees\/persons.<\/p>\n In connection with measures ensuring the protection of personal information against accidental destruction or loss, the Controller defines procedures for restoring the availability of personal data after a physical or technical incident. To fulfill these obligations, the Controller provides the necessary technical means such as, but not limited to, servers, computer network, cloud storage.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC appoints a Data Protection Officer (DPO). The DPO is an internal person at the Controller. The role of this person is to monitor compliance with this Policy within the Controller\u2019s enterprise and to ensure the ability to demonstrate the compliance of personal data processing with data protection legislation.<\/p>\n The DPO develops and implements the data protection requirements in accordance with the provisions of this Policy. The DPO manages security and risk regarding compliance with this Policy.<\/p>\n The DPO is responsible for administering and processing requests and complaints submitted by data subjects to the Controller. The DPO provides the Controller\u2019s employees with the necessary explanations regarding compliance with personal data protection.<\/p>\n The DPO periodically prepares and presents reports to the Controller regarding the application of this Policy, the regulatory provisions governing personal data protection, as well as the compliance of the personal data protection ensured within the enterprise with the regulatory requirements in this field.<\/p>\n \u201cAVE BULGARIA LOGISTICS\u201d LLC does not store personal data in a form that permits identification of data subjects for a period longer than necessary for the processing for which the data subject\u2019s consent has been given and for the purposes for which they were collected. Storing personal data for a longer period is also permissible without the explicit consent of the data subject if provided for by a statutory act of domestic legislation or EU law.<\/p>\n The Controller may store data for a longer period than necessary for the processing for which consent has been given in cases where personal data will be processed for archiving purposes in the public interest, scientific or historical research, and for statistical purposes, and only with the implementation of appropriate technical and organizational measures to guarantee the rights and freedoms of the data subject.<\/p>\n The retention period for each category of personal data, grouped in a separate register, is determined in a procedure adopted by the Controller. This procedure specifies the criteria used to determine the retention period, including any legal obligations imposed on the Controller regarding data storage.<\/p>\n The procedure for data storage and destruction, as well as the rules for destroying information on physical media, applies in all cases.<\/p>\n Personal data must be securely destroyed in accordance with the principle of ensuring an appropriate level of security and the procedure adopted by the Controller. The Controller performs data inventory and risk assessment as part of its approach to addressing possible risks in processing the collected personal data. Where it is established that a type of processing may lead to a high risk to the rights and freedoms of natural persons, in particular through the use of new technologies, and taking into account the nature, scope, context and purposes of the processing, before proceeding with processing, the Controller performs a Data Protection Impact Assessment (DPIA) in accordance with the procedure adopted by the Company for impact assessment with respect to data protection and the methodology laid down therein for carrying out the impact assessment.<\/p>\n Where the DPIA has established\/indicated that the processing operations lead to a high risk which the Controller cannot mitigate with appropriate measures considering available technology and implementation costs, prior to processing, consultation with the supervisory authority (the CPDP \u2013 Commission for Personal Data Protection) shall be carried out.<\/p>\n The DPO performs periodic review of the initially inventoried data and revises the information entered in the \u201cRecord of Processing Activities\u201d in view of any changes in the Controller\u2019s activities.<\/p>\n The personal data Controller has the right to disclose processed personal data only to the following exhaustively listed categories of persons:<\/p>\n the natural persons to whom the data relate;<\/p>\n<\/li>\n persons whose right of access is provided for in a statutory act; or<\/p>\n<\/li>\n persons whose right arises under a contract.<\/p>\n<\/p>\n<\/li>\n<\/ul>\n For the purpose of providing services, the Controller discloses information\/necessary personal data for the performance of a contractual obligation undertaken towards the data subject. The Controller provides personal data to third parties who provide services on its behalf based on an explicit written instruction\/written contract. These third parties are not entitled to use or disclose the data beyond the purposes for which they were provided, except when necessary to perform services on behalf of the Controller or to comply with legal requirements. The purposes for processing the personal data provided are expressly defined in the written instruction\/written contract under which the data were provided to the third party. The third parties (personal data processors) are obliged to ensure the necessary technical and organizational measures for the protection of the personal data provided by the Controller or greater.<\/p>\n The Controller discloses personal data to its subsidiaries and joint partners based on an explicit written instruction or written contract. These persons may use the information for the purposes described in this Privacy Policy. With the data subject\u2019s explicit consent, the data may be shared with third parties under a written contract for their own purposes, such as offering products and services that may be of interest to the data subject.<\/p>\n The Controller discloses personal data to competent authorities\/persons for the purpose of organizing the protection of its legal rights and interests when initiating order for payment, arbitration, safeguard, claim and other proceedings.<\/p>\n The Controller discloses personal data about subjects whose personal data it processes when it is obliged to do so by law, subordinate legal act, international treaty or an act of EU law, or in connection with judicial proceedings, in response to a request from state authorities (e.g., law enforcement or investigative authorities), or in case of suspected serious and unlawful infringement of the legal rights and interests of data subjects.<\/p>\n Taking into account the regulation of personal data protection and the enhanced measures introduced by the GDPR\/PDPA, \u201cAVE BULGARIA LOGISTICS\u201d LLC recognizes the need for initial and subsequent training of its personnel whose duties include processing personal data of natural persons on behalf of the Controller.<\/p>\n The initial and subsequent trainings aim to inform employees about the established rules and procedures for compliance with this Policy and the applicable legal framework in the field of personal data protection, as well as other issues related to personal data protection and privacy.<\/p>\n Through employee training, the goal is to achieve awareness of existing or newly arising requirements regarding personal data protection, as well as the measures taken by the Controller in accordance with them.<\/p>\n The Data Protection Officer monitors the proper allocation of responsibilities of employees in relation to data protection in accordance with the Controller\u2019s rules and procedures for processing personal data.<\/p>\n The DPO must ensure that all employees who have ongoing duties related to personal data and processing operations, as well as those with permanent\/regular access to personal data, demonstrate compliance with personal data protection requirements.<\/p>\n Employees must be able to demonstrate competence in their understanding of compliance requirements and how they are applied within the Controller\u2019s organization.<\/p>\n The DPO is responsible for ensuring that these employees are informed about all issues related to personal data in accordance with the scope of their professional duties by organizing ongoing training when there is a change in the data protection legal framework or in the Controller\u2019s scope of activity, as well as when introducing new procedures\/measures for personal data protection by the Controller.<\/p>\n The Controller encourages training and awareness measures by providing the necessary resources and facilities.<\/p>\n The DPO acquaints and informs employees about the importance of data protection in performing their direct duties and in accordance with their role in the organization.<\/p>\n The DPO makes efforts and undertakes activities to ensure that employees understand how and why the rules and procedures are applied in the Controller\u2019s organization for personal data processing, for which he\/she compiles the relevant reports\/protocols.<\/p>\n The DPO participates in the development of training and awareness programs both for all personnel and for each specific role in the organization that relates to personal data processing.<\/p>\n The DPO creates a system for periodic verification of awareness and for updating employees\u2019 knowledge in connection with changes in data protection requirements.<\/p>\n Employees have the right to access specific training on personal data processing related to their permanent job roles and responsibilities and in accordance with the rules and procedures adopted by the Controller.<\/p>\n Employees have the right to access specific training on all information security requirements and procedures applicable to data protection and data processing within their daily job roles and responsibilities, including reporting personal data breaches.<\/p>\n Employees receive training on handling requests and complaints from data subjects related to personal data protection and processing, in accordance with the Controller\u2019s rules and procedures.<\/p>\n The DPO organizes training for all responsible persons and employees. Initial training of employees is conducted upon the entry into force of this Policy, as well as upon hiring new employees whose job duties include personal data processing. This Policy was updated and adopted by the managers of \u201cAVE BULGARIA LOGISTICS\u201d LLC on 02.09.2024 and is in force from the same date.<\/p>\n Data subjects may familiarize themselves with this Policy at the office of \u201cAVE BULGARIA LOGISTICS\u201d LLC: Sofia, 9 \u201cVitoshki kambani\u201d St., 3rd floor.<\/p>\n Data Protection Officer at \u201cAVE BULGARIA LOGISTICS\u201d LLC is: <\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" PRIVACY POLICYApproved by: ……………..Manager\u201cAVE BULGARIA LOGISTICS\u201d LLC PRIVACY AND PERSONAL DATA PROTECTION POLICY OF \u201cAVE BULGARIA LOGISTICS\u201d LLC INTRODUCTION \u201cAVE BULGARIA LOGISTICS\u201d LLC (hereinafter the \u201cCompany\u201d or the \u201cController\u201d) is a limited liability company registered in the Commercial Register with the Registry Agency under UIC 203003174, with registered office and address of management: Sofia, \u201cStudentski\u201d […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"open","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"\n Suggested text: <\/strong>Our website address is: https:\/\/www.avebulgaria.com.<\/p>\n\n\n Suggested text: <\/strong>When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.<\/p>\n\n\n An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https:\/\/automattic.com\/privacy\/. After approval of your comment, your profile picture is visible to the public in the context of your comment.<\/p>\n\n\n Suggested text: <\/strong>If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.<\/p>\n\n\n Suggested text: <\/strong>If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.<\/p>\n\n\n If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.<\/p>\n\n\n When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed.<\/p>\n\n\n If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.<\/p>\n\n\n Suggested text: <\/strong>Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.<\/p>\n\n\n These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.<\/p>\n\n\n Suggested text: <\/strong>If you request a password reset, your IP address will be included in the reset email.<\/p>\n\n\n Suggested text: <\/strong>If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.<\/p>\n\n\n For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.<\/p>\n\n\n Suggested text: <\/strong>If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.<\/p>\n\n\n Suggested text: <\/strong>Visitor comments may be checked through an automated spam detection service.<\/p>\n\n","_et_gb_content_width":"","footnotes":""},"class_list":["post-3","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.avebulgaria.com\/bg\/wp-json\/wp\/v2\/pages\/3","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.avebulgaria.com\/bg\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.avebulgaria.com\/bg\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.avebulgaria.com\/bg\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.avebulgaria.com\/bg\/wp-json\/wp\/v2\/comments?post=3"}],"version-history":[{"count":3,"href":"https:\/\/www.avebulgaria.com\/bg\/wp-json\/wp\/v2\/pages\/3\/revisions"}],"predecessor-version":[{"id":47281,"href":"https:\/\/www.avebulgaria.com\/bg\/wp-json\/wp\/v2\/pages\/3\/revisions\/47281"}],"wp:attachment":[{"href":"https:\/\/www.avebulgaria.com\/bg\/wp-json\/wp\/v2\/media?parent=3"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a> PURPOSES AND SCOPE OF THE POLICY<\/b><\/span><\/h2>\n
\n
<\/a> TERMS AND DEFINITIONS<\/b><\/span><\/h2>\n
<\/a> LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA, SOURCES OF PERSONAL DATA, AND RETENTION PERIOD<\/b><\/span><\/h2>\n
\n
\n
<\/a> MEANS, PRINCIPLES AND PURPOSES OF PROCESSING<\/b><\/span><\/h2>\n
\n
\n
<\/a> CATEGORIES OF PERSONAL DATA PROCESSED<\/b><\/span><\/h2>\n
\n
\n
<\/a> REGISTERS<\/b><\/span><\/h2>\n
\n
<\/a> RIGHTS OF DATA SUBJECTS<\/b><\/span><\/h2>\n
<\/a> Right to information, access to personal data, and data portability<\/b><\/span><\/span><\/h3>\n
<\/a> Right to rectification<\/b><\/span><\/span><\/h3>\n
Data subjects are responsible for providing accurate personal data to the Controller. In addition, the data subject should inform the Controller of any relevant changes in his or her personal data, including but not limited to changes in address or name.<\/p>\n<\/a> Restriction of processing<\/b><\/span><\/span><\/h3>\n
\n
<\/a> Refusal of a request for information, rectification, or restriction of processing<\/b><\/span><\/span><\/h3>\n
The refusal is made in the form of the request submitted by the subject and shall be reasoned.<\/p>\n<\/a> Right to erasure (\u201cright to be forgotten\u201d)<\/b><\/span><\/span><\/h3>\n
\n
\n
<\/a> Right to object<\/b><\/span><\/span><\/h3>\n
<\/a> Withdrawal of consent to personal data processing<\/b><\/span><\/span><\/h3>\n
The Controller informs the subject how the erasure will affect their relationship going forward.<\/p>\n<\/a> Requests and complaints. Remedies available to the data subject<\/b><\/span><\/span><\/h3>\n
<\/a> Right to express consent to the processing of his or her personal data<\/b><\/span><\/span><\/h3>\n
<\/a> Right of representation<\/b><\/span><\/span><\/h3>\n
The authorization must be explicit and made in writing.
On each exercise of the data subject\u2019s rights, the representative is obliged to present a copy of his or her power of attorney to the Controller or to the Processor acting on behalf of the Controller.<\/p>\n<\/a> GENERAL PRINCIPLES RELATED TO THE PROCESSING AND SECURITY OF PERSONAL DATA<\/b><\/span><\/h2>\n
<\/a> Lawfulness of processing<\/b><\/span><\/span><\/h3>\n
<\/a> Purpose specification<\/b><\/span><\/span><\/h3>\n
The purpose of collecting and processing the data must be observed by the Controller in any further processing and storage of such data.
Changes in purpose are permissible only with the data subject\u2019s consent or if this is permitted by the domestic law of the respective country from which the personal data were obtained.<\/p>\n<\/a> Data minimization<\/b><\/span><\/span><\/h3>\n
Where possible and cost-effective for the intended protective purpose, options for anonymization or pseudonymization of personal data should be used at an early stage.<\/p>\n<\/a> Data quality<\/b><\/span><\/span><\/h3>\n
The Controller takes appropriate and reasonable measures to correct or delete incorrect or incomplete data.<\/p>\n<\/a> Data security<\/b><\/span><\/span><\/h3>\n
These measures relate in particular to computers (servers and workstations), networks and communication links and applications, and are incorporated into the IT security management system through appropriate measures to protect such data from accidental deletion, unauthorized deletion or loss (information in this regard is presented in Directive (EU) 2016\/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union).<\/p>\n<\/a> Confidentiality of processing<\/b><\/span><\/span><\/h3>\n
Employees are prohibited from using such data for personal purposes or providing them to unauthorized companies and third parties. Unauthorized in this context also includes the use of personal data by employees who do not need access to such data to perform their job duties.
The obligation of confidentiality continues to apply after the termination of employment \/ civil \/ service relationships with the Controller.<\/p>\n<\/a> SECURITY MEASURES FOR PERSONAL DATA<\/b><\/span><\/h2>\n
<\/a> Technical measures for the protection of personal data<\/b><\/span><\/span><\/h3>\n
The Controller defines secure zones for storing physical media containing personal data, with access determined according to procedural rules.
The Controller introduces the following measures to limit access to physical data media\u2014for example, but not limited to: installing high-security locks on the doors of the Controller\u2019s office and on the doors providing access to the building where the office is located; locking cabinets containing paper-based data media.<\/p>\n<\/a> Organizational measures for the protection of personal data<\/b><\/span><\/span><\/h3>\n
<\/a> DATA PROTECTION OFFICER<\/b><\/span><\/h2>\n
<\/a> STORAGE, DESTRUCTION AND INVENTORY OF PERSONAL DATA<\/b><\/span><\/h2>\n
<\/a> Storage<\/b><\/span><\/span><\/h3>\n
<\/a> Destruction<\/b><\/span><\/span><\/h3>\n
Compliance with the procedure is mandatory to guarantee protection against unauthorized or unlawful processing and against accidental loss, destruction or damage to the data, by applying appropriate technical or organizational measures.<\/p>\n<\/a> Inventory and risk assessment<\/b><\/span><\/span><\/h3>\n
During the data inventory and processing, a risk assessment of personal data is carried out, the methodology and elements of which are regulated by a procedure adopted by the Company. Determining risks according to this methodology also applies to processing undertaken by other persons\/organizations on behalf of the Controller.<\/p>\n<\/a> TRANSFER OF PERSONAL DATA TO THIRD PARTIES<\/b><\/span><\/h2>\n
\n
<\/a> TRAINING<\/b><\/span><\/h2>\n
<\/a> OBLIGATIONS AND ROLES<\/b><\/span><\/h2>\n
The DPO documents each training conducted by preparing a list\/protocol of attendees at the respective trainings, held at an appropriate time according to the Controller\u2019s activity.<\/p>\n
Subsequent trainings are conducted periodically (at least once every 6 months) or when there is a change in the data protection legal framework\/ a change in the Controller\u2019s scope of activity regarding personal data processing, or when introducing new measures\/procedures for protection.<\/p>\n<\/a> FINAL PROVISIONS<\/b><\/span><\/h2>\n
Name: Vesela Slavchova Stoykova
Address: village of Bistritsa, Sofia Municipality, 6 \u201cShibil\u201d St.
E-mail address: vesela.stoykova@avebulgaria.com<\/p>\nWho we are<\/h2>\n\n\n
Comments<\/h2>\n\n\n
Media<\/h2>\n\n\n
Cookies<\/h2>\n\n\n
Embedded content from other websites<\/h2>\n\n\n
Who we share your data with<\/h2>\n\n\n
How long we retain your data<\/h2>\n\n\n
What rights you have over your data<\/h2>\n\n\n
Where your data is sent<\/h2>\n\n\n