Information on the company that works with and protects your personal information:

Outsource Bulgaria” Ltd. – a registered company with EIC 204725578. Our headquarters are located in Sofia at 15A Krum Kyulyavkov Street, Floor 6, Office 11. Contact us at 0877739699 or via email at info@officeland.com for any inquiries.

Why We Collect and Use Your Personal Data

Legal Basis for Processing Your Personal Data:

• Fulfilling obligations under a contract with you
• Your explicit consent for specific purposes
• Compliance with legal requirements

Learn more about how we handle your data in the sections below.

Processing Your Data for Contractual Purposes

We handle your personal information to fulfill our obligations and exercise our rights under any agreements we have with you, both before and after the contract is signed.

Purposes of processing:

• Verifying your identity
• Managing and fulfilling your requests and executing agreements
• Creating proposals for new contracts
• Generating invoices for services used
• Providing you with comprehensive customer support and collecting payments
• Keeping records of communications regarding orders, queries, and issues
• Notifying you of updates and changes related to our services
• Analyzing customer history
• Detecting and preventing illegal or violative activity in accordance with our terms of service

Data We Handle Under This Legal Basis:

Based on the contract we have with you, we process information related to the contract, such as:

• Personal contact information (address, email, phone number)
• Identification details (name, ID number, permanent address)
• Data on orders placed
• Correspondence related to our services (email, letters, requests, feedback)
• Payment information (credit/debit card, bank account)
• Additional information such as customer number, IP address, demographic data, social media profile, website activity This personal data processing is essential for us to fulfill our contractual obligations and provide you with our services. Without this information, we would not be able to conclude the contract.

We provide personal data to third parties

We share your personal information with third-party partners to provide you with high-quality, efficient, and comprehensive service. We take all necessary technical and organizational measures to protect your data and have strict controls in place to ensure confidentiality and security. We remain responsible for the protection of your data at all times.

We may share your information with the following types of recipients (data controllers):

• Postal and courier services
• Service providers for maintenance of equipment, software, and hardware used in data processing
• Consultants for various services.

When we delete data collected on this basis

Data collected under this legal basis will be deleted 2 years after the termination of the contract, whether it expires, is cancelled, or ends for any other reason.

TO FULFILL REGULATORY OBLIGATIONS

In certain cases, the law requires us to process your personal data. We are legally obligated to comply with these requirements such as:

• Anti-Money Laundering Measures
• Consumer Protection Act requirements for distance and off-premise sales
• Providing information to the Consumer Protection Commission or other parties as mandated by the Consumer Protection Act
• Complying with regulations for data protection and providing information to the Commission for the Protection of Personal Data
• Keeping legal accounting in accordance with the Law on Accounting and Tax-Insurance Procedure Code
• Providing information to courts and third parties during legal proceedings
• Verifying age when making online purchases.

We delete data collected under legal obligations after fulfilling or no longer being subject to those obligations. For example:

• Accounting data is stored and processed for 11 years as per the Accounting Act
• Information provided to courts and other authorities will be retained for 5 years as per current legislation.

Provision of data to 3rd parties

As required by law, we may disclose your personal data to relevant government bodies or organizations.

AFTER YOUR CONSENT

We only process your personal data on this basis with your explicit, voluntary, and informed consent. There will be no negative consequences for you if you choose not to provide consent.

This is a separate legal basis for processing your data and the specific purpose will be outlined when we request your consent. This purpose is not covered by the purposes listed in this policy. With your consent, and until it is withdrawn or our contract with you ends, we may provide personalized product/service offers and conduct detailed analysis of your basic personal data.

Data we process on this basis:

We only process the data for which you have provided specific consent on this basis. The exact data processed may vary and is determined on a case-by-case basis. Commonly, this includes personal information such as names, address, phone number and email address.

Provision of data to third parties

On this basis, we may provide your data to marketing agencies, Facebook, Google or the like.

Withdrawal of consent

You have the right to withdraw your consent at any time. This will not impact our ability to fulfill our contractual obligations. If you choose to withdraw your consent for any of the ways we have described above, we will no longer use your personal data for those purposes. However, please note that the withdrawal of consent will not affect the legality of the processing based on the consent given before it was withdrawn.

You can withdraw your consent by using our website or contacting us through the provided contact information.

When we delete data collected on this basis

We delete the data collected on this basis upon your request or 12 months after it was initially collected.

PROCESSING OF ANONYMOUS DATA

We process your data for static purposes, that is, for analyzes in which the results are only generalizable and therefore the data is anonymous. Identification of a specific person from this information is impossible.

Your data can also be anonymized. Anonymization is an alternative to data deletion. Upon anonymization, all personally identifiable elements/elements enabling your identification are irreversibly deleted. There is no legal obligation to delete anonymized data, as it does not constitute personal data.

Explaining Our Use of Automated Algorithms

We use automated algorithms and methods to improve our products and services and tailor them to your needs. This process is known as profiling. By using these methods, we aim to constantly enhance the quality of our products and services for you.

How we protect your personal data

We take all necessary organizational and technical measures as outlined in the Personal Data Protection Act to ensure the security and protection of your data.

We have implemented policies to prevent misuse and breaches, which support our efforts to safeguard your information.

To ensure maximum security during the processing, transfer, and storage of your data, we may use additional security mechanisms such as encryption and pseudonymization.

Personal data we have received from 3rd parties

We do not receive data from 3rd parties.

Your Rights as a User

As a user of our site, you have the rights to protect your personal data according to Bulgarian and EU laws. You may exercise your rights through our contact form or by sending a message to our email address.

Your rights include:

• The right to receive information about the processing of your personal data by us
• The right to access your personal data
• The right to correct any inaccurate data
• The right to have your personal data erased (also known as the right to be forgotten)
• The right to restrict our processing of your personal data
• The right to data portability between different controllers
• The right to object to the processing of your personal data
• The right not to be subject to decisions based solely on automated processing, including profiling, that have legal consequences or similarly significant effects on you
• The right to seek judicial or administrative protection in case of violation of your rights

You may request the deletion of your personal data if:

• The personal data is no longer necessary for the purposes for which it was collected or processed
• You withdraw your consent for the processing and there is no other legal basis for the processing
• You object to the processing and there are no overriding legal grounds for the processing
• The personal data has been processed unlawfully
• The personal data must be deleted to comply with a legal obligation
• The personal data was collected in connection with the provision of information society services to children and consent was given by the person with

The Right to Data Portability:

The right to data portability allows individuals to receive the personal data they have provided to us in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from us, if the processing is based on the user’s consent or on a contract and the processing is carried out by automated means. This right enables individuals to easily switch to another service provider without having to manually re-enter all of their personal data. Additionally, when technically feasible, the data subject has the right to request a direct transfer of the personal data from one controller to another.

Right to object

Users have the right to object to the administrator the processing of their data. The administrator of personal data is obliged to terminate the processing unless it proves that there are compelling legal grounds for the processing that take precedence over the interests, rights, and freedoms of the data subject, or for the establishment, exercise, or defense of legal claims. In case of objection to the processing of personal data for direct marketing, the processing should be stopped immediately.

Complaint to the supervising authority

Every User has the right to file a complaint against the illegal processing of his data to the Commission for the Protection of Personal Data or the competent court.

Maintaining a register

We maintain a register of the processing activities for which we are responsible. This register contains all the information below:

The name and contact details of the administrator

Purposes of processing;

• Description of categories of data subjects and categories of personal data;

• The categories of recipients to whom the personal data are or will be disclosed,

• Including recipients in third countries or international organizations;

• Where possible, the deadlines for the erasure of the various categories of data;

• Where possible, a general description of technical and organizational security measures