Privacy Notice

This privacy notice tells you what to expect us to do with your personal information when you make contact with us or use our services.

This notice is layered. So, if you wish, you can easily select the reason we process your personal information and see what we do with it.

We will tell you:

• why we are able to process your information;
•  what purpose we are processing it for;
•   whether you have to provide it to us;
•  how long we store it for;
•  whether there are other recipients of your personal information;
•  whether we intend to transfer it to another country; and
•  whether we do automated decision-making or profiling.

АMATAS is the controller for the personal information we process, unless otherwise stated.

Contact details:

phone number: +359 899 911 911; email: office@amatas.com.

Data Protection Officer contact details

You can contact our Data Protection Officer at dpo@amatas.eu.

Most of the personal information we process is provided to us directly by you for one of the following reasons:

•           You have made a service request, inquiry or complaint to us;
•           You wish to attend, or have attended, an event;
•           You subscribe to our e-newsletters;
•           You have applied for a job;
•           You are representing your organization.

 We also receive personal information indirectly, in the following scenarios:

• It is included in a public register (ex. chief executive officer or general manager of a company with which we are  in a process of negotiations) or it is provided for a reason related to a contract: contact point, expert capacity etc.;
• Your personal information is contained in reports or another documentation related to service provision;
• We have seized personal information as part of a service provision;
• From other public authorities, regulatory authorities or law enforcement bodies;
• An employee of ours gives your contact details as a contact point or a referee.

It is included in a public register (ex. chief executive officer or general manager of a company with which we are                               in a process of negotiations) or it is provided for a reason related to a contract: contact point, expert capacity etc.;

Your personal information is contained in reports or another documentation related to service provision;

We have seized personal information as part of a service provision;

From other public authorities, regulatory authorities or law enforcement bodies;

An employee of ours gives your contact details as a contact point or a referee.

As part of our activities and statute, we may process special category data and criminal conviction data for which the data subject will be informed.

You will be informed for the consequences for not providing necessary information in every single case.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason and grounds for processing your information.

• Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process for which we will inform you.

• Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

• Your right to erasure

You have the right to ask us to erase your personal information that we will perform under certain circumstances.

• Your right to restriction of processing

You have the right to ask us to restrict the processing of your information under certain circumstances.

•           Your right to object to processing

You have the right to object to processing if we are able to process your information because the process is in our legitimate interests (ex. marketing purpose).

• Your right to data portability

This only applies to the information you have given us. You have the right to ask that we transfer the information you gave us from one organization to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.

Generally, you are not required to pay any charge for exercising your rights. We have one month to respond to you.

Please contact us at DPO@amatas.eu or preferably – here: https://dpo.amatas.com/?token=79158217cc7abc2a20f32921dd7af703, if you wish to make a request.

We will not share your information with any third parties for the purposes of direct marketing.

We may use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organization apart from us unless it is required by law. They will hold it securely and retain it for the period we instruct.

In some circumstances, we are legally obliged to share information. For example under a court order. We might also share information in relation to reference letters provided to us by your organization. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information.

We may also share your information in the event of the non-payment of an obligation. If the debt remains outstanding after the specified timeframe for payment, no payment plan is in place or an agreed payment plan is not being adhered to, we may initiate formal proceedings to recover the full amount of the unpaid penalty. As a result, AMATAS will share personal data with the litigation and recovery specialists it instructs in order for them to identify assets and undertake recovery action through the courts.

We may transfer your personal data in countries outside the European Economic Area (ex. when using the services of providers outside the region) and in this case, we will follow the applicable GDPR requirements.

Where we provide links to websites of other organizations, this privacy notice does not cover how that organization processes personal information. We encourage you to read the privacy notices on the other websites you visit.

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact us at dpo@amatas.eu or to https://dpo.amatas.com/?token=79158217cc7abc2a20f32921dd7af703 and we will respond.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to us as the competent supervisory authority – for Bulgaria: Commission for Personal Data Protection. Please follow this link to see how to do that: https://www.cpdp.bg/?p=pages&aid=5.

We may make updates and changes to the information published in this Privacy Notice. Up-to-date information will be published on our website.

We do not provide services directly to children or proactively collect their personal information. However, we may sometimes be given information about children. The information in the relevant parts of this notice applies to children as well as adults.

• Analytics

When you visit our website www.amatas.com, we may use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behavior patterns. We do this to find out such things as the number of visitors to the various parts of the site. This information is only processed in a way that does not directly identify anyone. We do not make and do not allow Google to make, any attempt to find out the identities of those visiting our website.

If we do collect personal data through our website, we’ll be upfront about this. We’ll make it clear when we collect personal information and we’ll explain what we intend to do with it.

•  Cookies

We use a cookies tool on our website to manage the cookies we use.

You can read more about how we use cookies, and how to change your cookies preferences, on our cookie notice.

• Security and performance

We use a third-party web application firewall to help maintain the security and performance of our website. The service checks that traffic to the site is behaving as would be expected. The service will block traffic that is not using the site as expected. To provide this service, the provider of the service processes the necessary information for security reasons.

• Purpose and lawful basis for processing

The purpose for implementing the above is to maintain and monitor the performance of our website and to constantly look to improve the site and the services it offers to our users. The lawful basis we rely on to process your personal data is either Article 6(1)(a) of the GDPR, for example when we require your consent for the optional cookies we use, or Article 6(1)(f) which allows us to process personal data when it is necessary for our legitimate interests (marketing, service improvement etc., security reasons, in order to maintain the integrity of our IT systems and the continuity of our business, etc.

• What are your rights?

As we are processing your personal data for our legitimate interests as stated above, you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on the circumstances and we will provide you with the necessary information.

We meet visitors at our head office, including:

• clients or their representatives;
• job applicants;
• suppliers and tradespeople;
• stakeholders;
• another visitors.

If your visit is planned, we will send your name and visit information to reception before your visit – so that we can prepare a pass card for your arrival.

If you arrive without an appointment, you will be given a pass card after providing the necessary data (names and a department that will be visited).

You must wear the passcard throughout your visit and leave it at the reception when you leave the premises.

We may ask all visitors to sign in and out at reception and show a form of ID. The ID is for verification purposes only, we do not record this information.

Closed-circuit television (CCTV) operates inside the building for security purposes. The purpose for processing the relevant information (video images) is for security and safety reasons. The lawful basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests.

We have Wi-Fi on-site for the use of visitors. We will provide you with the address and password.

We record information necessary for security reasons.

We don’t ask you to agree to terms, just to the fact that we have no responsibility or control over your use of the internet while you are on-site, and we don’t ask you to provide any of your information to get this service.

The purpose of processing this information is to provide you with access to the internet whilst visiting our site. The lawful basis we rely on to process your personal data is Article 6(1)(f) of the GDPR, which allows us to process personal data when necessary for the purposes of our legitimate interests.

This section of the privacy notice provides information that is specific to your reason for contacting us.

The below information gives you some of the basic details about what we do with your information.

 Purpose and lawful basis for processing

When you contact us to make a service request, we collect information, including your personal data, so that we can respond to it and communicate our offer with you.

The lawful basis we rely on to process your personal data is Art. 6(1)(b) of the GDPR, which allows us to process personal data when this is necessary to take steps at your request prior to entering into a contract.

• What we need and why we need it

We need enough information from you to answer your service request. If you call the helpline, we won’t make an audio recording of it and we won’t usually need to take any personal information from you. But in certain circumstances, we may make notes to provide you with a further service as required.

If you contact us via email or post, we’ll need a return address for a response.

• What we do with it

We will set up a case file on our case management system to record your request and so we can get it to the correct area of the business to be dealt with. We will also keep a record of our responses. We use the information supplied to us to deal with the request and any subsequent issues that may arise and to check on the level of service we provide.

• How long we keep it

We process the information as long it is necessary for a specific purpose or under the applicable law requirements.

• Purpose and lawful basis for processing

Our purpose for processing this information is to assess your suitability for a role you have applied for and to help us develop and improve our recruitment process.

The lawful basis we rely on for processing your personal data is Art. 6(1)(b) of the GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.

The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious or ethnicity information is Art. 9(2)(b) of the GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights.

•  What will we do with the information you give us

We will use all the information you provide during the recruitment process to progress your application with a view to offering you an employment contract with us, or to fulfil legal or regulatory requirements if necessary.

We will not share any of the information you provide with any third parties for marketing purposes.

We will use the contact details you give us to contact you to progress your application. We may also contact you to request your feedback about our recruitment process. We will use the other information you provide to assess your suitability for the role.

• What information do we ask for, and why

We do not collect more information than we need to fulfil our stated purposes and will not keep it longer than necessary.

The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it may affect your application if you don’t.

We will use any feedback you provide about our recruitment process to develop and improve our future recruitment campaigns.

• Application stage

If you use our online application system, your details may be collected by our data processor (if applicable) on our behalf.

You can submit your application to us without the need to create an account.

We ask you for your personal details including name and contact details. We will also ask you about previous experience, education, referees and for answers to questions relevant to the role. Our recruitment team will have access to all this information.

You will also be asked to provide equal opportunities information. This is not mandatory – if you do not provide it, it won’t affect your application. We won’t make the information available to any staff outside our recruitment team, including hiring managers, in a way that can identify you. Any information you provide will be used to produce and monitor equal opportunities statistics.

• Shortlisting

Our hiring managers shortlist applications for interviews.

• Assessments

We may ask you to participate in assessment days; complete tests or occupational personality profile questionnaires; attend an interview; or a combination of these. Information will be generated by you and by us. For example, you might complete a written test or we might take interview notes. This information is held by us.

If you are unsuccessful after assessment for the role, we may ask if you would like your details retained in our talent pool. If you say yes, we would proactively contact you should any further suitable vacancies arise.

• Conditional offer

If we make a conditional offer of employment, we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. We must confirm the identity of our staff and their right to work in the country, and seek assurance as to their trustworthiness, integrity and reliability.

You must therefore provide the necessary information.

If we make a final offer, we’ll also ask you for additional information necessary for processing of salary payments, emergency contact details, other necessary information.

• Purpose and lawful basis for processing

Our purpose for collecting this information is so we can facilitate the event and provide you with an acceptable service.

The lawful basis we rely on for processing your personal data is your consent under Art. 6(1)(a) of the GDPR. When we collect any information about dietary or access requirements we also need your consent (under article 9(2)(a)) as this type of information is classed as special category data.

• What we need

If you wish to attend one of our events, you will be asked to provide your contact information including your organization’s name and, if offered a place, information about any dietary requirements or access provisions you may need. We may also ask for payment if there is a charge to attend.

• Why we need it

We use this information to facilitate the event and provide you with an acceptable service. We also need this information so we can respond to you.

• What we do with it

If you are not successful in securing a place, we will let you know and hold your details on a reserve list in case a place becomes available.

If you are allocated places at an event, we will ask for information about any dietary/access requirements. We don’t share this information in any identifiable way with the venue, and we delete it after the event.

We do not publish delegate lists for events.

• What are your rights?

We rely on your consent to process the personal data you give us to facilitate the event. This means you have the right to withdraw your consent at any time. If at any point you want to withdraw your consent please email us.  If you do that, we will update our records immediately to reflect your wishes.

• Purpose and lawful basis for processing

Our purpose for collecting this information is so we can facilitate the video conference, webinar or live broadcast event and provide wider access to its content.

The lawful basis we rely on for processing your personal data is Art. 6(1)(f) – legitimate interest related to the organization of the event.

• What we need

If you are an attendee or presenter at one of these events we will need a name, email address, and other contact data from you.

We record some events and all presenters will have their image and audio captured in the recording. If you are an attendee you may have the option of sharing your image and audio during the session. If you choose to do so, this will also be captured in the recording.

Some events will feature a moderated Q&A. If you choose to interact with the Q&A your comments may be published to others at the event and will also form part of the recording.

If an event is being recorded we will always notify you in advance.

• What we do with it

We use your contact data to provide you with the event details. For recorded events, we will also email you a link to the recording once the event has concluded.

For some events, we may publish the recording on our website, YouTube or other channels so this is accessible to a wider audience. If an event recording will be published we will always notify you before the event.

We do not publish delegate lists for video conferences, webinars or live broadcast events but your name and email address may be visible to others in attendance during the event.

• How long we keep it

We will keep your email address and any recording of the event for up to 12 months.

• Purpose and lawful basis for processing

Our purpose for collecting the information is so we can provide you with a service and let you know about upcoming events.

The lawful basis we rely on for processing your personal data is your consent under Art. 6(1)(a) of the GDPR.

• What we need

Your name and email address.

• Why we need it

We use your email address to send you our e-newsletter.

• What we do with it

We only use your details to provide the service.

We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter.

You will receive a confirmation email once you have submitted your details and then the newsletters monthly.

• How long we keep it

We process the information as long it is necessary for a specific purpose or under the applicable law requirements.