Scholarship Programme for Postgraduate Studies in the Republic of Bulgaria and Abroad
The solely-owned joint stock company EKO Bulgaria EAD with registered seat and management address at 3 “Lachezar Stanchev” str., complex “Litex Tower”, 9th floor, Izgrev district, Sofia, registered in Commercial Register at the Registry Agency with UIC 130948987, represented by the executive director Andreas Triantopoulos (hereinafter referred to as the "Company"), as controller of the personal data of applicants for the Scholarship Programme for Postgraduate Studies in Bulgaria and Abroad, determines the purposes and means of processing such data in accordance with Regulation 679/2016 EU on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as "GDPR") and the applicable national legislation in general, including the Personal Data Protection Act (promulgated SG. Issue No. 1/04.01.2002 г. with amendments).
1. Sources of collection & Categories of personal data
The Company collects the following categories of personal data from the data subject themselves, after they have read this document and confirmed that they have read it by filling in a special form:
| a. Identification Data | Three names as per identity document, Personal Identification Number, gender, nationality, date of birth, data from personal identity document such as No. of the document, date of issuance, expiry date, issuing authority and further data as per the document, occupation, information on issued Visa F1/J1 |
| b. Contact details | Email/postal address, telephone number, password (for the application process) |
| c. Education Data | Degrees, certificate of enrolment or final letter of acceptance to the postgraduate programme |
| d. Work Experience Data | Reference to previous work experience, letters of recommendation from university professors, certificate of previous employment, CV |
| e. Photo | Photograph of the candidate |
| f. Social data | Declaration by the data subject confirming that they are not employed; a reference by the data subject’s employer, evidencing the employment |
| g. Health data | Disability certificate, medical certificate, if submitted at the discretion of the subject. |
2. Purposes of processing
The purposes for which the above personal data are processed are as follows:
A. to inform the Company of the applicant's (data subject's) intention to participate in the Scholarship Programme for Postgraduate Studies in the Republic of Bulgaria and Abroad,
B. to assess the applicant's suitability for the scholarship,
C. to draw up the contract, if the applicant is selected, and to monitor the smooth progress and fulfilment of the obligations of both parties,
D. contacting and informing all scholarship applicants, whether they have been awarded a scholarship or not, about the Company's activities, provided they have given their consent to this,
E. the protection of its legal interests, the management of the company's business operations and IT infrastructure, in accordance with its internal policies and procedures.
F. Utilising data from participants in the current Scholarship Programme in order to reach a wider audience through a communication campaign on social media. In this way, the Company provides new individuals who may be interested in its activities with information about the new programmes it implements, encouraging them to participate. This process is carried out only if the scholarship recipients have given their consent for their data to be transferred to a partner of the Company, through a relevant consent form, which contains further information about the processing in question.
The provision of personal data by the data subject is necessary in order to apply for participation in the Scholarship Programme for Postgraduate Studies in the Republic of Bulgaria and abroad.
3. Legal basis for processing
In accordance with the applicable legislation on the protection of personal data, the legal bases on which the data processing is carried out are, as appropriate, the following:
- Article 6(1)(a) of the GDPR, i.e. the data subject’s explicit and freely given consent, insofar as the data subject voluntarily agrees to the processing of specific categories of personal data for optional purposes not required for the evaluation of eligibility or the performance of the scholarship agreement, such as the use of images, testimonials, or participation in promotional or targeted communication activities. The provision or withdrawal of such consent does not affect the evaluation of the application or the granting of the scholarship.
- Article 6(1)(b) of the GDPR as the processing is necessary for taking steps at the request of the data subject prior to entering into a scholarship agreement, namely for the assessment of the applicant’s eligibility under the scholarship programme, and, where applicable, for the conclusion and performance of the contract (the terms and conditions of the programme) to which the student, as the data subject, is a party. This includes the processing of identification data, contact details, education and academic background, and work experience data, to the extent strictly necessary for these purposes.
- Article 6(1)(f) GDPR as the processing of personal data related to income and remuneration of the applicant is necessary for the purposes of the legitimate interests of the controller- to make sure the applicant is eligible in terms of income, to receive the grant under the programme.
4. Transfer and categories of recipients
The Company may transfer the data to other legal entities of the HELLENIC Group, within the European Union, for the same purposes as those mentioned in paragraph 2 above. In addition, it may transfer the data to external partners of the Company, e.g. for the purpose of carrying out communication activities and generally serving the purposes of the Scholarship Programme. The processing of personal data by the above entities collaborating with the Company is carried out under the control of the Company and is subject to the same privacy policy or a policy of at least the same level of protection.
It may also transfer data to judicial, prosecutorial, administrative or police authorities in the context of the judicial protection of their legitimate interests or if required by law.
5. Data security
The Company, as the Data Controller, undertakes to implement the necessary technical and organisational measures. In particular, the file containing the profile details and applications of candidates is protected both electronically and physically. Personal data is stored on the Company's servers, located in a data centre in –Sofia, Bulgaria. Measures are taken to protect them, i.e. access rights, encryption and anonymisation of older data. The server is protected by a password and a firewall. The Company has security policies in place that aim to ensure the security and integrity of all information, including personal information.
6. Subject rights
6.1 Right of access, rectification, erasure, restriction of processing
The data subject has the right to submit a request to the Company (as the data controller) for:
- access to personal data about them,
- rectification of inaccurate or outdated data about them or to complete any incomplete data,
- request the erasure of data about them if their processing is not necessary in relation to the purposes for which they were collected,
- request the restriction of the processing of personal data about them,
- portability of their data (e.g. directly to another employer)
- to lodge a complaint with the National Data Protection Supervisory Authority. In Bulgaria this is the Commission for Personal Data Protection - kzld@cpdp.bg, having its seat and registered address at 2 Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
More information about these rights, including the circumstances under which they are exercised and how they are exercised, is included in the PERSONAL DATA PROTECTION STATEMENT posted on the Company's website Защита на личните данни < ЕКО България | EKO Bulgaria
6.2 Right to object
In addition, the data subject has the right to object, at any time and for reasons related to their particular situation, to the processing of their personal data based on Article 10, paragraph 1, lines 5 or 6 of the GDPR, including profiling based on those provisions. In such a case, the company as the controller shall no longer process the personal data, unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
6.3 Right to withdraw consent
The applicant has the right to withdraw their consent at any time, without prejudice to the lawfulness of the processing based on consent before its withdrawal. In any case, the data subject is informed that the withdrawal of consent to the processing of data that is absolutely necessary for the performance of the contract may mean that the contract cannot be performed in some or all of its aspects.
6.4 The exercise of the above rights requires the data subject to submit, free of charge, a written request to the company's Data Protection Officer, whose details are provided below. The company reserves the right to respond within one month of receiving the request, but may extend this period by a maximum of two months with a reasoned response.
7. Communication between the data subject and the Company
For any matter relating to the processing of their personal data, or if they wish to exercise their rights or receive a copy of the latest version of the Company’s and the Hellenic Group's Personal Data Protection Policy, the data subject may contact the Company's Data Protection Officer (DPO), Ms. Desislava Vasileva, using the following contact details:
- by e-mail: at office@eko.bg
- by post: to the Company's address, to the attention of the Data Protection Officer.
In any case, the data subject retains the right to lodge a complaint with the Bulgarian Supervisory Authority, which is the Commission for Personal Data Protection - kzld@cpdp.bg, having its seat and registered address at 2 Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria.
8. Retention period for personal data
The Company retains personal data for a period of up to five (5) years from the termination of the contract in any way and up to two (2) years from the submission of the application by the student in case the contract is not concluded. If a legal dispute is pending, beyond the above processing times, and until its conclusion with a final court decision.