LUKOIL-Bulgaria Ltd. processes personal data (personal data) in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), the Personal Data Protection Act and the applicable legislation on personal data protection.
1. Personal data controller
LUKOIL-Bulgaria Ltd. (Controller) is the controller of personal data under this Privacy Policy and this information notice.
LUKOIL-Bulgaria Ltd. is a commercial company registered in the Commercial Register and the Register of Non-profit Legal Entities with UIC 121699202, with registered office and address of management: Sofia, 42 James Bourchier Blvd., tel.: 02/91 74 100, e-mail: office@lukoil.bg.
LUKOIL-Bulgaria Ltd. has appointed a Data Protection Officer. You can contact the Data Protection Officer at: dpo@lukoil.bg
2. Categories of personal data processed by the Controller
For the purposes and in connection with the provision of the services, LUKOIL-Bulgaria Ltd. processes the following categories of personal data:
(a) identification data and contact details, including name and address, as well as other data necessary for identification;
(b) information about contracts and performance, including payment obligations and other contractual data, as well as data related to the services provided;
(c) data collected and generated in the course of the use of the services and/or products, including correspondence and communications with the company;
(d) data on complaints.
3. Purposes and legal grounds for processing
The Controller processes personal data for one or more of the following purposes on one of the following legal grounds:
(a) performance of a contract;
(b) fulfillment of legal obligations of the Controller under applicable law, including accounting and tax requirements, as well as obligations arising from sector-specific legislation, including where necessary to protect the interests of data subjects, including in connection with the protection of the company’s rights, including debt collection, claims handling and litigation;
(c) legitimate interests pursued by the Controller, including ensuring security of persons and property, as well as protection of the Controller’s rights and interests. These legitimate interests do not override the interests and fundamental rights and freedoms of data subjects.
(d) consent of the data subject, provided voluntarily for specific purposes and within the scope of such consent, including: - marketing communications and promotional messages, surveys, and participation in campaigns;
- use of electronic channels, where required, and administration of IT systems used by the Controller in providing services and maintaining contact with users.
4. To whom we may disclose personal data
We may disclose personal data to:
(a) processors acting on behalf of and pursuant to instructions from the Controller;
(b) authorities, institutions and other competent bodies, in accordance with applicable law;
(c) contracted service providers, including banks, insurers, couriers and other partners, where necessary for the purposes of processing personal data.
5. Data retention and protection
LUKOIL-Bulgaria Ltd. applies appropriate technical and organizational measures to protect personal data and retains it for periods consistent with the purposes of processing and legal requirements. Data is retained for the duration of the contractual relationship and for the statutory limitation periods, unless a longer retention period is required by law.
6. Data source
Personal data is collected directly from data subjects, as well as in accordance with the Controller’s lawful activities and in compliance with the applicable legal framework for personal data processing.
7. Data processors
The Controller may engage processors and requires that they process personal data in compliance with applicable law and provide appropriate safeguards.
8. Rights of data subjects
As a data subject, you have the following rights:
(a) right of access to your personal data processed by us;
(b) right to rectification of inaccurate data or completion of incomplete data;
(c) right to erasure of personal data where the conditions for this are met; (d) right to restriction of processing under the conditions provided for by law; (e) right to data portability, where applicable and when processing is based on consent or a contract; (f) right to object, where the legal grounds for processing allow this; (g) right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise your rights, you can submit a request to the address and contacts of LUKOIL-Bulgaria Ltd. stated above. Requests are handled in accordance with the statutory requirements and time limits. The exercise of rights is free of charge, unless otherwise provided by law.
The rights related to personal data may be exercised by the data subject, acting personally, and by a legal representative of the data subject, under the conditions determined by law, as well as by a person authorized by the data subject.
9. Right to lodge a complaint with a supervisory authority
If you believe that your rights have been violated, you have the right to lodge a complaint with the Commission for Personal Data Protection at: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., website: www.cpdp.bg.
10. Effective date:
Current as of 23.05.2018. Subject to updates.
LUKOIL-Bulgaria Ltd. (Controller) is the controller of personal data under this Privacy Policy and this information notice.
LUKOIL-Bulgaria Ltd. is a commercial company registered in the Commercial Register and the Register of Non-profit Legal Entities with UIC 121699202, with registered office and address of management: Sofia, 42 James Bourchier Blvd., tel.: 02/91 74 100, e-mail: office@lukoil.bg.
LUKOIL-Bulgaria Ltd. has appointed a Data Protection Officer. You can contact the Data Protection Officer at: dpo@lukoil.bg
2. Categories of personal data processed by the Controller
For the purposes and in connection with the provision of the services, LUKOIL-Bulgaria Ltd. processes the following categories of personal data:
(a) identification data and contact details, including name and address, as well as other data necessary for identification;
(b) information about contracts and performance, including payment obligations and other contractual data, as well as data related to the services provided;
(c) data collected and generated in the course of the use of the services and/or products, including correspondence and communications with the company;
(d) data on complaints.
3. Purposes and legal grounds for processing
The Controller processes personal data for one or more of the following purposes on one of the following legal grounds:
(a) performance of a contract;
(b) fulfillment of legal obligations of the Controller under applicable law, including accounting and tax requirements, as well as obligations arising from sector-specific legislation, including where necessary to protect the interests of data subjects, including in connection with the protection of the company’s rights, including debt collection, claims handling and litigation;
(c) legitimate interests pursued by the Controller, including ensuring security of persons and property, as well as protection of the Controller’s rights and interests. These legitimate interests do not override the interests and fundamental rights and freedoms of data subjects.
(d) consent of the data subject, provided voluntarily for specific purposes and within the scope of such consent, including: - marketing communications and promotional messages, surveys, and participation in campaigns;
- use of electronic channels, where required, and administration of IT systems used by the Controller in providing services and maintaining contact with users.
4. To whom we may disclose personal data
We may disclose personal data to:
(a) processors acting on behalf of and pursuant to instructions from the Controller;
(b) authorities, institutions and other competent bodies, in accordance with applicable law;
(c) contracted service providers, including banks, insurers, couriers and other partners, where necessary for the purposes of processing personal data.
5. Data retention and protection
LUKOIL-Bulgaria Ltd. applies appropriate technical and organizational measures to protect personal data and retains it for periods consistent with the purposes of processing and legal requirements. Data is retained for the duration of the contractual relationship and for the statutory limitation periods, unless a longer retention period is required by law.
6. Data source
Personal data is collected directly from data subjects, as well as in accordance with the Controller’s lawful activities and in compliance with the applicable legal framework for personal data processing.
7. Data processors
The Controller may engage processors and requires that they process personal data in compliance with applicable law and provide appropriate safeguards.
8. Rights of data subjects
As a data subject, you have the following rights:
(a) right of access to your personal data processed by us;
(b) right to rectification of inaccurate data or completion of incomplete data;
(c) right to erasure of personal data where the conditions for this are met; (d) right to restriction of processing under the conditions provided for by law; (e) right to data portability, where applicable and when processing is based on consent or a contract; (f) right to object, where the legal grounds for processing allow this; (g) right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise your rights, you can submit a request to the address and contacts of LUKOIL-Bulgaria Ltd. stated above. Requests are handled in accordance with the statutory requirements and time limits. The exercise of rights is free of charge, unless otherwise provided by law.
The rights related to personal data may be exercised by the data subject, acting personally, and by a legal representative of the data subject, under the conditions determined by law, as well as by a person authorized by the data subject.
9. Right to lodge a complaint with a supervisory authority
If you believe that your rights have been violated, you have the right to lodge a complaint with the Commission for Personal Data Protection at: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., website: www.cpdp.bg.
10. Effective date:
Current as of 23.05.2018. Subject to updates.
