DATA PRIVACY POLICY OF EDENRED BULGARIA AD

 

Last updated July 2024

 

We, Edenred Bulgaria AD, UIC 130526402, having our seat and management address in Sofia 1784, 90 Tsarigradsko Shosse, floor 23 ("Edenred" or "we"), collect and process personal data of individuals, our clients, counterparties or other contacts on the Bulgarian market ("You"). We are aware of the responsibility we have to take care of and to protect your personal data, to comply with the applicable law in the area of privacy and personal data protection.

By this Data Privacy Policy (the "Policy" or the "Privacy Policy") we would like to acquaint you with the manner in which we collect and use the personal data you have provided to us. The Policy describes the applied methods and the purposes for which Edenred and our service providers, respectively, process the information collected from and about you upon entering into contracts and using services through the website www.edenred.bg (the "Website").

Important!

Please read this Policy carefully. It provides important information about how we process personal data and it explains your legal rights. This Policy is not aimed at changing the rights you have according to the applicable data protection laws.

By providing your personal data or using the Website you trust us and you voluntarily accept the terms and conditions of this Data Privacy Polic

1. PERSONAL DATA CONTROLLER

    1.1. Edenred, acting in its capacity as personal data controller is responsible for the correct and lawful processing of personal data, which you provide upon entering into contracts or using services through the Website or of other services of ours.

    1.2. In the event when you wish to contact us regarding matters concerning this Policy, please use the following forms of contact: Telephone: 02/974 02 20; Fax: 02/974 05 50, Email: legal.bulgaria@edenred.com .

2. HOW DO WE COLLECT YOUR PERSONAL DATA

We may process your personal data in the following cases:

• If you contact us directly, for example, by filling in the contact form on the Website, through the client service phone lines or through the system for online chat to request information about our products and services.
• If you respond to our direct marketing campaigns, for example by entering online data on the Website.
• If you order vouchers, cards or other services of ours.

If you are providing information on behalf of another person, you need to ensure that this person has been provided this Privacy Policy and that the requirements of the applicable laws have been complied with before you provide the information.

If you are below the age of 14, please, do not provide any personal information to us, unless you have the permission of a parent or guardian to do so.

We would like to ask for your assistance to keep your information up-to-date where you should inform us about any changes in your personal data.

 

3. WHAT PERSONAL DATA WE COLLECT

The following categories of personal data may be collected from and about you:

• About the physical identity – names, PIN or age, address, place of work, position, line manager and department, telephone, email address;
• Website use – date and time of your visit; how many and what pages you are viewing during your visit and how much time have you spent on them; the name of your Internet domain (this may be your internet provider such as NET 1 or your work place) and IP address (this is a number assigned to your computer when you are browsing the internet), which allows you access to our site; the internet browser you are using (e.g. MS Internet Explorer or Google Chrome) and the operation system of your computer (e.g. Windows 8.1);
• Information about the used services – information about orders;

4. HOW YOUR PERSONAL DATA CAN BE PROCESSED

The processing of your personal data in compliance with the effective Bulgarian legislation and the principles of the General Data Protection Regulation ЕС/2016/679 (the "Regulation") needs to be substantiated according to one of several legal grounds under the Regulation. We are required to stipulate the grounds for each use of your data as follows:

Purpose: Exercising the rights and obligations of Edenred resulting from contracts entered into with you or your company - employer;

Grounds for processing: performance of a contract under Art. 6, Para 1, letter "b" of the Regulation or the compliance with legal obligation under Art. 6, Para 1, letter "c" of the Regulation;

Purpose: Performance of correspondence with potential, current and ex clients of Edenred and client servicing, including in order to respond to your questions and to complete your requests, for example, to send you the requested documents or notifications by email; to send you important information and/or other administrative notifications regarding the Website, your relationship with us or changes in our terms and conditions or policies;

Grounds for processing: performance of agreement under Art. 6, Para 1, letter "b" of the Regulation; or the compliance of legal obligation under the meaning of Art. 6, Para 1, letter "c" of the Regulation; or express consent of each subject under Art. 6, Para 1, letter "a" of the Regulation or the legitimate interests of the controller under Art. 6, Para 1, letter "f" of the Regulation;

Purpose: Providing information bulletins, information about discounts and special offers, information and news about existing and new products;

Grounds for processing: express consent of each subject under Art. 6, Para 1, letter "a" of the Regulation;

Purpose: Direct marketing regarding potential, current and ex clients of the controller;

Grounds for processing: express consent of each subject under Art. 6, Para 1, letter "a" of the Regulation or the legitimate interests of the controller under Art. 6, Para 1, letter "f" of the Regulation;

You can object against the processing of your personal data for this purpose or withdraw your consent for receiving marketing communication and direct marketing at any time with subsequent effect by sending the objection or the notification for withdrawal to Edenred by email/contact phone, stipulated under Item 1.2 above.

Purpose: For our business purposes, for example, data analysis, verifications, improvement of our Website, improvement of our products and services, identification of the trends in the browsing of the Website;

Grounds for processing: the legitimate interests of Edenred

The legitimate interest of Edenred to provide first class products responds to the interests of the client and therefore, it is in compliance with the personal data protection legislation effective in Bulgaria and sufficient grounds for its processing. The clients expect high quality and first class functioning of the products and services of Edenred. To fulfil these expectations there is need for constant monitoring and improvement of quality as well as development or offering of new products and services.

    4.1. Providing personal data in compliance with the law

Edenred in its capacity as personal data controller is under the jurisdiction of the Republic of Bulgaria. In some events this may necessitate in the provision and/or disclosure of your personal data when this is required under the law, upon request and/or if needed, to third parties – state, etc. authorities, institutions and establishments, insurance companies, insurance brokers, banks and institutions within the scope of their competence and in compliance with the provisions of the Regulation, the PDPA and the other provisions of Bulgarian legislation.

Whenever possible, we will direct such requirement towards you or we will notify you before we respond, unless it refers to prevention or solving of a crime.

    4.2. Providing data to third parties, including personal data processors

The personal data we collect may be provided for processing to third parties who act on their own behalf or on behalf of Edenred, in compliance with the requirements of the Regulation and upon providing protection of the rights of data subjects.

Your personal data may be processed by:

        4.2.1. Companies from the Edenred Group;

        4.2.2. Companies providing services to Edenred, such as IT support, IT hosting.

    4.3. Data transfer in countries outside the European Economic Area

Edenred does not transfer your personal data to their partners based outside the European Economic Area.

5. HOW WE PROTECT YOUR PERSONAL DATA

    5.1. We protect personal data in strict compliance with the effective Bulgarian legislation and the principles of the Regulation.

    5.2. Your information is stored on our protected servers or on protected servers of our subcontractors or business partners (or in particular events the information is stored on hard copy upon complying with the necessary protection). The information is accessible and it is used in compliance with our policies and security standards (or those of our subcontractors or business partners), always in compliance with the effective law and the necessary protection measures.

    5.3. Although we cannot guarantee that the transferring of data through internet or the Website is without the risk of cyber attacks, we and our business partners are working diligently to maintain measures for physical, personal and document safety and protection of automated information systems regarding your data in compliance with the applicable legislation. For example, we apply the following measures:

        (a) strictly limited access of our employees and subcontractors to your data, granted only on a need to know and in view of implementation of the purposes for which it is being processed and on need to know basis;

        (b) Personal data is stored digitally in databases or in shared files, protected by passwords or with different degrees of authorization; implementation of monitoring and virus defence; copies and backup copies for recovery are made; the systems store logs with history of the operations with the documents;

        (c) All paper documents which may contain your personal data shall be stored in the office of Edenred in Sofia 1784, 90 Tsarigradsko Shosse Blvd., floor 23;

        (d) Procedures for control of the physical access and fire safety are implemented in the office of Edenred where personal data is processed.

        (e) The staff of Edenred who process personal data are acquainted with the requirements of the effective law, with the policies of Edenred, with the existing risks and scenarios for action upon their occurrence.

        (f) Contractual protection is provided for under the contacts with third parties - data processors on behalf of Edenred.

6. HOW LONG WE STORE YOUR PERSONAL DATA

    6.1. We store your personal data as long as necessary in view of the purpose for which we have obtained it. If your data is being processed for two purposes, we will store it until the purpose with longer period for processing is achieved; but we will stop processing it for this purpose with the shorter period after this shorter period has expired.

    6.2. We limit the access to your data to those persons who need to process it for the respective purpose.

    6.3. Under certain circumstances we may keep your personal data for longer periods of time in order to have a correct record of our relationship with you in the event of complaints or disputes or if we have reasons to believe that there is a likelihood for court disputes where your personal data shall be necessary.

    6.4. The storage periods are based on the business needs of Edenred and according to the applicable law. Personal data, which is no longer necessary, shall be anonymized (anonymized data may be stored but it is no longer related to you) or destroyed.

7. YOUR PERSONAL DATA PROTECTION RIGHTS

    7.1. You have certain rights in relation to your personal data, for example, you have the right:

        (a) to request from us to provide you with additional details how your data is used;

        (b) to request from us to provide you with access to your personal data and to provide you with copy thereof;

        (c) to receive the personal data which concerns you and which you have provided to us, in structured, commonly used and machine readable format and – when this is technically impossible – transfer this data to another controller without any hindrance, if the processing of your data is based on your consent or agreement and it is performed through automated means;

        (d) to request from us to update all inaccuracies in the data we store and correct it, update it;

        (e) to request from us to delete or anonymize all data about you which we no longer have legal grounds to process;

        (f) when the processing is based on consent and in relation to direct marketing, you may withdraw your consent so that we suspend this specific processing from now on;

        (g) to object against any processing for the purpose of automated individual decision making (including profiling) when this affects you significantly;

        (h) to request from us to limit the processing of you data, for example, when a complaint is being investigated.

    7.2. Rules for exercising the rights

      7.2.1. You may file a request for exercising your rights to Edenred in one of the following manners: by filling in this form, on site, by post, including email, by phone or fax as stipulated under Item 1.2 above.

      7.2.2. Each of your request, enquiry or demand is accepted, reviewed, checked as regards your identification and right you wish to exercise and it is responded to within one month of submitting it. In more complicated cases or when numerous requests are received, this period may be extended by two more months and we shall inform you about this. If there are reasons not to fulfil the request, we will indicate these reasons to the applicant in written form.

      7.2.3. Exercising these rights is subject to certain exceptions, for instance when public interest needs to be protected (e.g. upon prevention or solving crimes) or our interests, or the rights and freedoms of the others.

If you have any questions regarding the processing of your data, please contact us at the contact details under Item 1.2 above (Monday - Friday, from 09:00 to 17:30).

If you are not pleased with the processing of your data or with our response when exercising these rights, you are entitled to file a complaint to the Personal Data Protection Commission, at the following address: Sofia 1592, 2 Tsvetan Lazarov Street, 02/91-53-518, website: https://www.cpdp.bg. We would like to ask you to try and resolve the issue with us beforehand, even though you have the right to contact the Personal Data Protection Commission at any time.

8. COOKIES

    8.1. Processing of cookies

Cookies are small text files which some websites store on your computer or mobile device.

Cookies of this Website are used to secure a certain functionality of the site, as login, storing information about the order before it is sent to the server, protection against bots and protection of the users against certain types of attacks. Edenred takes maximum care of the information saved by the cookies and your unobstructed processing of all functionalities of the Website.

    8.2. Management and deletion of cookies

You may accept or reject the cookies through change in the setting of your browser. If cookies are blocked, it is possible that you are not able to use all interactive functionalities of this Website.

Most up-to-date browsers allow to control cookies through the saved settings of the browser.

    8.3. Cookies help:

      8.3.1. To make our Website work according to your expectations;

      8.3.2. To remember your settings during visits;

      8.3.3. To constantly improve our Website for you.

    8.4. We are not processing cookies to:

      8.4.1. collect identifying personal data – we will always ask for your express consent, if we ever wish to collect such information;

      8.4.2. collect sensitive information without your express consent.

    8.5. The processing of cookies falls within several categories:

      8.5.1. Cookies for website functions

We are processing cookies to make our Website function better. For example, we save information after you have entered our Website once so that you do not need to enter every time when you are visiting a different page/menu during your session.

After you exit or close the browser, the cookies for the session will be deleted.

      8.5.2. Analytical cookies

Analytical programmes use cookies for gathering statistical data which helps us improve our Website. Unless you provide us with express information by completing a form or calling us, all data, collected from the analytical programmes shall be stored anonymously and we see only general values and not specific individual data.

Examples of that include:

• How did you reach our Website (e.g., from a search engine, ad, etc.);
• The actions you complete on the Website such as viewed number of pages, time spent on each page, on which page the users have left the Website;
• How often you revisit our Website;
• The technology used by the users (e.g., browser, operation system, device, etc.)

    8.6. In order to learn more about cookies and how to manage them, please visit www.aboutcookies.org.

9. UPDATING THE POLICY

We may make changes to this Policy from time to time. The changes to this Policy shall come into effect when the reviewed Policy is published on the Website. If you are using our Website or our services after the changes, this shall be deemed as accepting our updated Policy.