-
"EXPRESS GARANTSION" Ltd aims to maintain good policies and practices that ensure maximum
protection of your personal data.
-
This Privacy Policy is based on the requirements of Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data.
-
All amendments and additions to the privacy policy will be applied after publication of its
current content, available through our website: www.exgar.com
-
By using our website, you agree to the collection, use and disclosure of your information as
stated below in this policy. If you do not agree, please do not use: www.exgar.com.
-
The Privacy Policy is applicable to your personal data if you are an individual or a
representative of a legal entity that uses or wishes to use the services provided by
"EXPRESS GARANTSION" Ltd, including those offered online through a specialized platform on
our website, including through social networks.
DEFINITIONS
- "Personal data" means any information relating to an identified natural person
or a natural person who can be identified ("data subject"); a natural person who can be identified
is a person who can be identified directly or indirectly, in particular by an identifier such
as a name, identification number, location data, online identifier or by one or more factors
specific to the physical, physiological, genetic, mental, mental, economic, cultural or social
identity.
- "Processing" means any operation or set of operations performed on personal
data or on sets of personal data, by automatic or other means such as collection, recording,
organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure
by transmission, dissemination, recording or otherwise making available, arrangement or combination,
restriction, deletion or destruction.
- "Controller" means a natural or legal person, public authority, agency or other
body which, alone or jointly with others, determines the purposes and means of the processing
of personal data; when the purposes and means of such processing are determined by Union law
or Member State law, the controller or the specific criteria for its appointment may be provided
for by Union law or Member State law.
- "Processor" means a natural or legal person, public authority, agency or other
body which processes personal data on behalf of the controller.
- "Recipient" means a natural or legal person, public authority, agency or other
body, to which the personal data are disclosed, whether a third party or not. At the same time,
public authorities which may receive personal data in the framework of a particular inquiry in
accordance with Union or Member State law shall not be regarded as "recipients". The processing
of these data by the said public authorities complies with the applicable data protection rules
according to the purposes of the processing.
- "Supervisory authority" means an independent public authority, established by
a Member State and is responsible for monitoring the application of Regulation (EU) 2016/679.
PURPOSES OF THIS POLICY AND PRINCIPLES OF PERSONAL DATA PROCESSING
This policy aims to inform all data subjects who have relationships with "EXPRESS GARANTSION"
Ltd about the way their personal data is processed, what personal data is processed, when it
needs to be disclosed to third parties, as well as the rights of the subjects, in accordance
with the Regulation.
Personal data in "EXPRESS GARANTSION" Ltd is collected, processed, stored and transmitted
lawfully, fairly and transparently in compliance with the relevant. The data subject is
informed in advance about the processing of his personal data.
In connection with the services provided, "EXPRESS GARANTSION" Ltd processes information about
the following data subjects:
- individuals visiting the website www.exgar.com;
-
individuals who visit on their own behalf or on behalf of another natural or legal person
through www.exgar.com and other online channels;
-
individuals who have sent on their own behalf or on behalf of another person they represent,
inquiries (including but not limited to by email, by fax, by call, etc.), requests, signals,
complaints or other correspondence to "EXPRESS GARANTSION" Ltd;
-
data subjects, job candidates through: the company's website, applications received through
information platforms for job seekers (e.g.: jobs.bg, zaplata.bg, etc., through events, by
phone or email, social networks, etc.).
-
Personal data is collected for specific, clearly defined and lawful purposes and is not
further processed in a manner incompatible with those purposes.
- The volume of personal data corresponds to the purposes for which it is collected.
- Personal data must be accurate and updated when necessary.
-
Personal data is erased or corrected when found to be inaccurate or inconsistent with the
purposes for which it is processed.
-
Personal data is kept in a form which permits identification of the relevant individuals for
a period no longer than necessary for the purposes for which such data is processed.
In fulfillment of its legal obligations, "EXPRESS GARANTSION" Ltd processes your data for the
following purposes:
-
providing information to the Ministry of Internal Affairs, the Consumer Protection
Commission and the Personal Data Protection Commission, in connection with the fulfillment
of our obligations arising from the current regulations in this area;
-
processing your data in invoices issued in your name for other purposes compatible with the
initial purpose of their collection;
- carrying out tax and insurance control by the relevant competent state authorities;
-
providing information to the court and third parties in the context of court proceedings, in
order to protect our legitimate interests, including collecting receivables from clients
through court proceedings.
"EXPRESS GARANTSION" Ltd also processes your data for the purposes of the following our
legitimate interests:
-
for the purposes of direct marketing – sending offers containing information about our
current offers, promotions and discounts.
-
for the inclusion of your name, photographs, video and other data in advertising brochures,
website and other publications of "EXPRESS GARANTSION" Ltd as a result of your participation
in group events organized by us.
-
for the protection, exercise or preservation of the legal rights, privacy, security or
property of the controller, the users of the controller's services and members of society.
DATA SUBJECTS AND CATEGORIES OF PERSONAL DATA
"EXPRESS GARANTSION" Ltd collects, processes and stores personal data in its capacity as an
employer, supplier and contractor and in compliance with the requirements of applicable
legislation, legitimate interests and contractual conditions.
The data subjects whose personal data is processed in "EXPRESS GARANTSION" Ltd are mainly job
applicants, employees, persons entrusted with management or control, owners, participants in
competitions and events organized by Express Garantsion Ltd, contractors and suppliers,
sponsored and gifted persons, etc.
1. From persons, job candidates, for the purpose of selection and coordination with the
applicant, the following personal data is collected:
- Identification: name, permanent and/or current address, phone, email;
-
Education and professional qualifications; data related to education, work experience,
professional and personal qualifications and skills (CV).
2. From persons employed under employment relationships, the following personal data is
lawfully collected as minimally necessary for appointment:
-
Identification: phone, email, ID card or passport data - name; personal number, personal
foreign number (date of birth), permanent and/or current address, number and date of issue
of ID card.
-
Education and professional qualifications: data related to education, work experience,
professional and personal qualifications and skills (employment books, copies of diplomas,
qualifications related to the respective position).
-
Health data: The Company processes sensitive data only to the extent necessary for the
performance of its specific rights and obligations, in the field of labor and insurance
legislation and social benefits and payments.
-
Other data:
- Data on social status – marital status, number of children under 18 years of age.
-
Criminal record certificate - only when required by law or regulation to certify
criminal history.
-
Video image - photographs and other data, the processing of which is necessary for the
fulfillment of the rights and obligations of the controllers from Express Garantsion
Ltd, in their capacity as employer and/or for the protection of their legitimate
interest.
3. From natural persons - clients of the company, personal data is collected that is necessary
for the conclusion and performance of the respective contract:
-
Identification: name; personal number (date of birth), permanent and/or current address,
contact phone, email and position.
4. From natural persons, service providers to the company, personal data is collected
necessary for the conclusion and performance of contracts for the provision of services to the
company from external providers, as follows:
-
Identification: name, personal number (date of birth), permanent and/or current address,
phone, email.
5. Personal data collected when implementing security of the company's property and access
regime in buildings and facilities of the companies – video images, identification – name,
position, organization/enterprise.
PERSONAL DATA PROTECTION
The controller and processors of "EXPRESS GARANTSION" Ltd have taken the necessary technical
and organizational measures provided for in Regulation (EU) 2016/679 and the Personal Data
Protection Act, and apply best practices from international standards. In order to ensure
maximum security in processing, transfer and storage of personal data, all reliable mechanisms
are used to protect personal data from loss, theft and misuse, as well as from unauthorized
access, disclosure, modification or destruction.
ACCESS TO PERSONAL DATA
The controller of "EXPRESS GARANTSION" Ltd may, if necessary, provide personal data to third
parties such as competent state authorities and institutions when required by law, as well as
to Processors, on the basis of an express contract, and all subjects whose personal data is
provided to another processor are informed about this.
In cases of providing personal data of employees, including under management and control
contracts, clients or service providers, to a processor of the specific Controller:
-
Requires sufficient guarantees from the processor for compliance with legal requirements and
good practices for processing and protection of personal data.
-
Concludes a written agreement or other legal act with identical effect, which regulates the
obligations of the processor and meets the requirements of Art. 28 of Regulation (EU)
2016/679.
- Informs the individuals whose data will be provided to a processor.
Access to personal data may also be had by the relevant state authorities – court,
investigation, prosecution, audit authorities, etc. The above-mentioned may request the data
in due order in connection with the performance of their powers.
In connection with carrying out our activities and fulfilling our contractual obligations to
our clients, we provide your data to the following groups of persons "recipients", namely:
- to the data subject - always when they exercise this right;
- to the users/clients to whom the data relates;
- to business partners;
- providers of payment services for online payment via credit cards;
-
IT companies maintaining information systems, our company website, software and platforms;
-
to public authorities (Ministry of Internal Affairs, municipality, National Revenue Agency,
Consumer Protection Commission, Personal Data Protection Commission, judicial and other
control authorities);
-
other personal data controllers to whom "EXPRESS GARANTSION" Ltd provides your personal data
on a legal basis and/or on the basis of a bilaterally signed contract.
PROVISION OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION
Transfer of personal data to countries outside the EU/EEA is permissible only when:
-
The European Commission has adopted a decision confirming that the country to which the
transfer is made provides an adequate level of protection for the rights and freedoms of
data subjects.
-
Appropriate safeguards are in place – such as Binding Corporate Rules (BCRs), standard
contractual clauses, approved code of conduct or certification mechanism approved by the
Personal Data Protection Commission and/or the European Commission.
-
The data subject has given his explicit consent to the transfer after being informed of the
possible risks, or
-
The transfer is necessary for business purposes, including the performance of a contract
with the subject, protection of the public interest, establishment and protection of legal
disputes, protection of the vital interests of the data subject in cases where he is
physically or legally unable to give consent.
PERSONS RESPONSIBLE FOR COLLECTING, PROCESSING AND STORING PERSONAL DATA
The collection, processing, storage and protection of personal data is carried out only by
persons to whom this is expressly indicated and whose official duties or specifically assigned
task require this.
The persons responsible for the protection of personal data and the persons processing
personal data on behalf of the controller and/or processor are natural persons who have
previously undertaken a confidentiality obligation, possessing the necessary competence and
appointed and/or authorized by an appropriate written act.
VIDEO SURVEILLANCE
Video surveillance is carried out for the purpose of protecting, exercising or preserving the
legal rights, privacy, security or property of the controller, its employees and/or
contractors, as well as to ensure the safety, privacy and security of members of society.
Video surveillance is organized and controlled by employees of the controller, specially
trained in data protection.
The recordings are stored on specialized DVR and NVR video surveillance devices depending on
the capacity of the respective device and the quantity of video recordings, except in the
event of a registered violation of the rights of the controller or third parties, in which
case the recording may be provided to the relevant control authorities, if it is available on
the respective device.
You have the right to request a review of the recordings if you claim a violation of rights
that relate to you or to a person over whom you exercise supervision.
The company may refuse to review requests that are unreasonably repeated, require
disproportionate technical efforts or threaten the confidentiality of other users.
RETENTION PERIOD FOR PERSONAL DATA
The duration of storage of your personal data depends on the purposes of the processing for
which they were collected:
-
Your personal data is stored to achieve the purpose(s) for which it was collected and within
the statutory deadlines, and the consent provided by you remains in effect even after the
termination of the relationship between us. Personal data is stored for the specified
periods, after which it is securely destroyed. When it is necessary for their storage to
continue after the expiration of the prescribed period, the data is anonymized and/or
pseudonymized.
-
Personal data processed for the purpose of issuing accounting/financial documents for the
implementation of tax and insurance control, but not only – invoices, debit, credit notes,
are stored to achieve the purpose(s) for which they were collected and within the statutory
deadlines, and the consent provided by you remains in effect even after the termination of
the relationship between us. Personal data is stored for the specified periods, after which
it is securely destroyed. When it is necessary for their storage to continue after the
expiration of the prescribed period, the data is anonymized and/or pseudonymized.
-
Video recording – depending on the capacity of the respective device and the quantity of
video recordings.
Storage of personal data for longer periods is possible for the protection of the legitimate
interests of "EXPRESS GARANTSION" Ltd, as well as until the expiration of the respective
statute of limitations in order to protect against possible claims from clients, as well as
for a longer period in case of an already arisen legal dispute – the documents are stored
until its final resolution with a final court/arbitration decision.
As a Personal Data Controller, "EXPRESS GARANTSION" Ltd exercises due care and takes the
appropriate and required by regulatory framework administrative, technical and physical
measures, as well as those related to personnel /training, awareness, etc./, to protect the
information it holds, including protecting the personal data of its clients from loss, theft
and unauthorized use, disclosure, modification and any other illegal forms of processing. We
have physical, electronic and procedural safeguards that comply with our legal obligations
regarding the protection of personal data and which we maintain in accordance with modern
technological achievements.
RIGHTS IN CONNECTION WITH THE PROCESSING OF PERSONAL DATA
- Right of access to data relating to him - the user/client has the right at any
time to request confirmation from us as to whether data relating to him is being processed, information
about the purposes of this processing, for the categories of data and for the recipients or categories
of recipients to whom the data is disclosed.
- Right to correct and update his personal data when it is inaccurate or incomplete
with regard to the purposes of its processing.
- Right to erasure, when his data is processed unlawfully or with a lapsed
basis (the initial purpose for which it was collected and processed has been fulfilled, the
retention period has expired (including the statute of limitations), consent for processing
has been withdrawn, you have objected to their processing, etc.), there is no other basis
for their processing or national or European legislation requires it.
- Right to restriction of processing – in the presence of a legal dispute between
"EXPRESS GARANTSION" Ltd and the individual until its resolution and/or for the establishment,
exercise or protection of legal claims; when the processing is unlawful, but the data subject
does not wish the personal data to be erased, but requires instead restriction of their use;
upon an objection made by you to the processing of your personal data for the period of verification
of its validity.
- Right to data portability - the data subject has the right to request that we
transfer his personal data in machine-readable format to another controller explicitly specified
by him without hindrance.
- Obligation to notify upon correction or erasure of personal data or restriction of
processing - the client has the right to require us to notify third parties to whom his personal data
has been disclosed, of any erasure, correction or blocking of such data, except in cases where
this is impossible or is associated with excessive efforts for "EXPRESS GARANTSION" Ltd.
- Right to notification of personal data security breach - in cases where there
is a likelihood that the data security breach will pose a high risk to the rights and freedoms
of natural persons. We are not obliged to notify you if: we have taken appropriate technical
and organizational protection measures in relation to the data affected by the security breach,
as well as if we have subsequently taken measures that guarantee that the breach will not lead
to a high risk to your rights and if notification would require disproportionate efforts.
- Right to object to the processing of your personal data – at any time and on
grounds relating to the specific situation of the person, provided that there are no compelling
legal grounds for the processing that take precedence over the interests, rights and freedoms
of the data subject, or court proceedings.
-
When personal data is processed for the purposes of direct marketing, the user has the right
at any time to object to the processing of personal data relating to him for this type of
marketing, which includes profiling insofar as it is related to direct marketing. At the
latest at the time of the first contact with the user, he is expressly informed of the
existence of the right to object described above, which is provided to him through
notification in a clear manner and separately from any other information.
- Right to judicial and administrative protection – right to file a complaint
to a supervisory authority, right to an effective judicial remedy against a supervisory authority,
right to an effective judicial remedy against a controller or processor; right to compensation
for damages suffered.
-
Data subjects also have the right to:
-
Be informed and give their consent for the processing of personal data when such is
required, and the consent of natural persons is a freely given, specific, informed,
unambiguous and conscious act of their desire regarding the processing of their personal
data by the company, and it is also their right to withdraw it at any time.
-
Request information about the basis on which their personal data was provided for
processing to a third party.
-
Object to a decision made solely on the basis of automated processing, including
profiling, if applicable.
-
Be notified of a personal data security breach that is likely to pose a high risk to
their rights and freedoms.
- Submit complaints to the regulatory authority.
-
In some cases, receive or request their personal data to be transferred to countries
outside the European Union in a structured, commonly used format suitable for machine
reading (right to portability).
- Be informed of the consequences of not providing personal data.
"EXPRESS GARANTSION" Ltd considers and pronounces on the user's request in accordance with the
requirements of applicable legislation in the shortest possible time and in all cases within 1
/one/ month from receiving the application. If necessary, this period may be extended by
another 2 /two/ months, given the complexity and number of applications. "EXPRESS GARANTSION"
Ltd informs the user of any such extension within one month of receiving the application,
indicating the reasons for the delay.
Data of the supervisory authority:
PERSONAL DATA PROTECTION COMMISSION /PDPC/,
- in person, at address: Sofia, 2 Prof. Tsvetan Lazarov Blvd.;
- by letter, at address: Sofia, p.c. 1592, 2 Prof. Tsvetan Lazarov Blvd.;
- by fax – 029153525;
- at the email of PDPC – kzld@cpdp.bg;
- through the website of PDPC at address: https://www.cpdp.bg/.
"EXPRESS GARANTSION" Ltd is the commercial company registered in the Commercial Register at
the Registry Agency with UIC 020916641, which collects, processes and stores your personal
data under the terms of this Policy and the applicable legislation of the European Union and
the Republic of Bulgaria.
"EXPRESS GARANTSION" Ltd is a personal data controller within the meaning of Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of
such data and the Personal Data Protection Act.
For all questions related to the processing of your personal data, you can contact us at our
management address: Varna, 3 Atanas Moskov Str., floor 2 or at the following email:
hr@exgar.com
Can you refuse to provide personal data to "EXPRESS GARANTSION" Ltd and what are the
consequences of this?
In order to fulfill the services requested by you, we need certain data that is normatively determined
by the current legislation in the Republic of Bulgaria.
COOKIE POLICY
In order to provide personalized and adequate services through our website and our products,
"EXPRESS GARANTSION" Ltd needs technology to remember and store information about your use of
them. This is done with the help of so-called cookies. They are small text files containing
small amounts of information and are stored on your computer or in the memory of your web
browser. Then, your web browser sends these cookies back to our website on each subsequent
visit, helping the site to recognize you and store information about your user preferences
(visits, clicks, activity history). The use of the collected cookies is very limited and is
related to technical purposes – improving and personalizing the functionality of our website
and our products). The information collected through the use of cookies cannot be linked to a
specific person. The retention period for cookies is 5 years according to international NAI
standards, which you can familiarize yourself with at https://www.networkadvertising.org/.
More detailed information about cookies and their functionality can be found at
https://www.aboutcookies.org/.
By visiting our site and registering to use our products, you accept the use of cookies in the
manner described in these Terms of Use of Cookies. Nevertheless, you can control and manage
cookies in various ways. Please note, however, that removing or blocking cookies may affect
the use of our website and our products, limiting your access to certain functionalities or
parts of it.
Types of cookies we use:
- Necessary cookies
These cookies make the correct operation of our website and our products possible, as they allow
you to view the information in them and use their functions. For example, thanks to them, we
show you the information on our site in the correct language, etc.
- Functional cookies
These cookies allow us to tailor the operation of our site and our products to the preferences
of our visitors and users, so that you can use their full functionality, watch videos on it,
etc. This information is completely anonymous, used for very limited purposes and stored for
a limited period of time.
- Analytical cookies
We use analytical tools that allow us to understand what the traffic to our site is, how easily
our users work with it and what interests them in its content. The information collected through
these cookies is used exclusively and only for statistical purposes and is not intended to be
used for personal identification of users. We do not receive any information about your personal
data. These cookies show us which pages of our site you have viewed, whether you visited our
site via mobile or desktop device and other anonymous data. The analytical tools are provided
by Google Analytics and Adobe Analytics and the information collected about your IP address is
not associated with any other information stored by Google and Adobe.
- Targeting cookies
These cookies do not store personal information, but only contain information about how you have
used our site. They may be triggered by our advertising partners to show you only information
that is relevant to you. For example, such are the cookies of Facebook, Google, etc.
Cookie management
You can control and manage cookies in various ways using your browser. Please note that if you
delete all cookies, the preferences you have saved will also be deleted. For more information
on how to change your browser settings to block or filter cookies, visit
https://www.aboutcookies.org or http://www.cookiecentral.com.
We use the following service providers and you can learn more about their privacy policies and
how to opt out of their cookies by visiting their sites:
- Adobe: https://www.adobe.com/privacy/opt-out.html
- Google Analytics: https://support.google.com/analytics/answer/6004245
"EXPRESS GARANTSION" Ltd may at its discretion change and supplement these Terms of Use of
Cookies at any time. In case of a change to these Terms, we will indicate the date of change
and this change will take effect in relation to you and your data after the date of this
change or from another, explicitly indicated later date.
CHANGES TO THE PRIVACY POLICY
"EXPRESS GARANTSION" Ltd has the right, when circumstances require it, to unilaterally update,
amend and supplement the privacy policy at any time in the future. Any addition or change to
this Policy will be published on the company's website www.exgar.com and/or will be provided
upon request of the client.
This policy was last updated on 01.10.2025.
