PRIVACY POLICY OF THE BULGARIA WANTS YOU WEBSITE
This Privacy Policy has been prepared in fulfilment of the obligations of “DNA Media” AD, UIC 205882707 (hereinafter referred to as “the Controller”, “the Company”, or “we”), pursuant to Regulation (EU) 2016/679 (the General Data Protection Regulation – GDPR) of the European Parliament and of the Council of 27 April 2016, and the Bulgarian Personal Data Protection Act (PDPA).
This Privacy Policy provides information on how the Company collects and processes your personal data when you use our website and platform bulgariawantsyou.com (the “Website” and/or the “Platform”), as well as when you attend our events. It explains what personal data we collect, for what purpose and on what legal basis, how we store it, and when it may be necessary to disclose it to third parties. In addition, you will be informed about the rights you have in relation to the processing of your personal data, as well as the technical and organisational measures implemented by the Company to protect it.
INFORMATION ABOUT US
The controller of the personal data collected and processed is: DNA Media AD, UIC 205882707
Registered Office and Address: | Bulgaria, Sofia 1164, 22 Galichitsa Str. |
Contact details: | |
Website | |
When processing your personal data, we strictly adhere to the following fundamental principles:
Lawfulness, fairness and transparency
Purpose limitation
Data minimisation and relevance to the purposes of processing
Accuracy and up-to-dateness of the data
Storage limitation in accordance with the purposes to be achieved
Integrity and confidentiality, ensuring an appropriate level of security of personal data
DATA PROTECTION OFFICER (DPO)
Given the Company’s strong commitment and high level of care regarding data protection, we have appointed a Data Protection Officer (hereinafter “DPO”), whose role is to act as the contact person for all matters related to the processing of your personal data, including in connection with the exercise of your rights under the applicable legislation.
Name | Attorney Yordan Cholakov |
PERSONAL DATA
When providing our services, we collect personal data from different categories of clients (data subjects), which can be grouped as follows:
Individuals who have registered on our Website;
Individuals who use certain services on our Website without registering;
Individuals who have submitted inquiries through our various communication channels;
Individuals who have subscribed to our newsletter or signed up for events organized by the Company;
Individuals participating in our events as speakers or attendees;
Individuals who have given their consent for direct marketing purposes;
Individuals participating in promotional games and campaigns organized by the Company.
- individuals submitting enquiries in relation to real estate listings published in the “Properties” section.
A detailed description of the personal data collected and processed is provided below. When a contractual or legal obligation exists, we must comply with it and process your personal data accordingly. If such an obligation applies and you do not provide the requested data upon our request, we may be unable to enter into or perform a contract, or to fulfil our legal obligations.
Process | Categories of Personal Data | Purpose of Processing | Legal Basis |
|---|---|---|---|
| Registration / Account Creation | Name and surname, email, phone number, answer to 'Why do I want to work in Bulgaria', education, professional field, cities of interest, social media profiles (if provided), Bulgarian citizenship/origin, optional profile photo. | To enable platform usage, manage the profile, and allow job applications to employers. | Contract performance (Art. 6(1)(b) GDPR). |
| Registration via Google or Meta (e.g., Facebook) | Name, email, profile picture (if available), account ID in the respective platform. | To facilitate registration and login through existing third-party profiles. | Consent (Art. 6(1)(a)) and/or legitimate interest (Art. 6(1)(f) GDPR). |
| Sharing limited profile data with employers (non-public profiles) | Name, photo, and location. | To allow employers to identify talents using minimal criteria. | Legitimate interest (Art. 6(1)(f) GDPR). |
| Consent for sharing all profile data (public profiles) | All profile data and attached files, including CV, contact details, education, experience, skills, photo (if part of CV), and any voluntarily entered information. | To process, store, and share information with employers offering suitable positions. | Consent (Art. 6(1)(a) GDPR). |
| Subscription for Job Alerts | Email address, preferred professional field. | To send notifications about new job postings matching selected criteria. | Consent (Art. 6(1)(a) GDPR). |
| Use of Contact Form | Name, surname, and email address. | To respond to inquiries and handle complaints. | Legitimate interest (Art. 6(1)(f) GDPR). |
| Participation in Company Events | Profile data including attached CVs and qualification documents; video footage of participants recorded during the event. | Event registration, organization, data sharing with partners, documentation of public events. | Consent (Art. 6(1)(a)) and legitimate interest (Art. 6(1)(f) GDPR). |
| Participation in Promotional Campaigns | Name, surname, email, and social media profile (in some cases). | To manage participation, contact participants, and deliver prizes. | Consent (Art. 6(1)(a)) or legal obligation (Art. 6(1)(c) GDPR). |
| Interaction via Social Networks | Public social media information: name/alias, comments, messages, reactions (‘likes’/‘follows’). | To respond to inquiries and engage with users through their chosen communication channel. | Legitimate interest (Art. 6(1)(f) GDPR). |
| Application for Job Offers through the Platform | CV, personal data and photo (if included), other attached documents, technical info (date, posting), history of applications. | To forward application materials to selected employers and maintain application history. | Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f) GDPR). |
| Employer Registration | Name, surname, email, phone, and position of the representative/contact person. | To create employer profiles, manage job listings, and enable communication with Talents. | Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f) GDPR). |
| Communication between Talents and Employers | Message content, name, and voluntarily shared data. | To facilitate direct communication between Talents and Employers. | Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f) GDPR). |
| Newsletter Subscription | Email address. | To send newsletters containing news, events, and marketing offers. | Consent (Art. 6(1)(a) GDPR). |
| Submission of enquiry regarding a real estate listing (“Properties” section): full name, telephone number, message content, date and time of submission, IP address. | The IP address is processed for system security and prevention of misuse. | To forward the enquiry to the respective real estate agency (e.g., Home2U or INclusive) that has published the listing, in order to facilitate contact. | Article 6(1)(f) GDPR – legitimate interest in ensuring the functionality of the “Properties” section. |
When you register using a Google or Meta (e.g., Facebook) account, depending on the service you select, we may gain access to your name, email address, profile picture, and the identifier associated with your account on the respective platform. This information is used solely to create your profile on our Platform and to provide you with access to our services. We do not have access to your password or any other sensitive data from these platforms.
SECURITY OF PERSONAL DATA
The Company applies appropriate technical and organisational measures to protect your personal data in accordance with the requirements of Regulation (EU) 2016/679 (GDPR).
The measures we have implemented are designed to:
prevent unauthorised access, unlawful disclosure, alteration or destruction of your personal data;
reduce the risk of data loss, misuse or unlawful processing.
Access to your personal data is granted only to those employees, partners and service providers who need it in order to perform their duties. They process your data strictly in accordance with our instructions and are bound by contractual confidentiality obligations.
Your personal data is stored only for the period necessary to achieve the purposes for which it was collected, after which it is deleted or anonymised, unless a legal requirement mandates a longer retention period.
DATA SHARING
For the purpose of providing high-quality and efficient services, we may share your personal data with the following categories of recipients:
Data processors – providers of hosting, IT services, system administration and maintenance. We conclude agreements with them that ensure the security and lawfulness of the processing.
Professional service providers – banks, auditors, lawyers, insurers, event organisers and other service providers, whenever this is necessary in view of our legitimate interest.
Competent authorities – when fulfilling a statutory obligation to report, declare or cooperate.
Third parties in business transactions – in the event of restructuring, mergers, sales or transfers of parts of our business, we may disclose data provided that the recipients have a lawful interest and comply with data protection requirements.
Social media platforms – when publishing photos, videos or content related to events or initiatives organised by the Company.
Potential employers – in connection with event organisation and all other functionalities of the Website described in this Policy.
Partners – real estate agencies (e.g., Home2U and INclusive) when you submit an enquiry via the “Properties” section. Upon receipt of the enquiry, the respective agency acts as an independent controller and processes the data in accordance with its own privacy policy.
In all cases, we ensure that third parties receive only the data necessary for the respective purpose, subject to contractual safeguards and oversight to ensure compliance with security measures. The Controller remains responsible for the protection of your personal data.
When you register using a Google or Meta profile, the respective platform may process your personal data in accordance with its own privacy policies. We recommend reviewing those policies to understand how your data is used by these authentication providers.
The Website’s messaging system is intended for direct communication between Talents and Employers. BWY does not have access to the content of exchanged messages and does not monitor them. The responsibility for the lawfulness, accuracy and content of the information shared lies entirely with the parties who exchange it.
BWY stores only technical data related to the sending of messages (e.g., date and time), solely for the purposes of service maintenance and security.
INTERNATIONAL DATA TRANSFERS
The processing of your personal data is carried out primarily within the European Union (EU) and the European Economic Area (EEA). We do not intend to transfer personal data to countries outside the EU/EEA (“third countries”).
If, however, a need for such a transfer arises, we will carry it out only where an adequate level of protection is ensured on the basis of one of the following:
A decision of the European Commission recognising an adequate level of protection;
The conclusion of EU Standard Contractual Clauses with the recipient, approved by the European Commission.
In this way, we ensure that your personal data is protected in accordance with EU-equivalent standards, even when transferred internationally.
DATA RETENTION PERIODS
We retain your personal data only for the period necessary to achieve the purposes for which it was collected, as described in this Privacy Policy. When determining the specific retention period, we take into account:
the type and sensitivity of the data;
the volume and purpose of the processing;
the potential risk of unauthorised use or disclosure;
our legal obligations, including applicable limitation periods.
General rules:
Registration data (profile):
We will retain your personal data related to your website registration until the moment your profile is closed, plus an additional period of one (1) year. During this period, you may restore your profile.
After this period expires, the data will be destroyed unless a legal requirement mandates longer retention (e.g., for filing or defending a legal claim).
Data submitted through the property enquiry form is retained for 12 months from submission, unless longer retention is required for the establishment, exercise or defence of legal claims.
Processing based on consent:
When we process your data on the basis of consent (e.g., for marketing purposes), it will be retained until the moment you withdraw your consent. After withdrawal, the data will be deleted within a reasonable timeframe unless another lawful basis for processing exists.
Withdrawal of consent and absence of another legal basis:
If we no longer have a legal basis to continue processing after consent is withdrawn, your personal data will be deleted without undue delay.
Anonymisation:
In certain circumstances, we may anonymise your data for statistical, research, or analytical purposes. In such cases, we may use this information for an unlimited period, as it will no longer directly or indirectly identify you.
Deletion when no longer needed:
If we no longer require your data, we will delete it or anonymise it by removing all elements that permit identification.
AUTOMATED DECISION-MAKING AND PROFILING
The Company may use automated processes for decision-making related to presenting your application to potential employers.
Data subjects have the right to object to the processing of their personal data for marketing purposes when such processing is carried out on the basis of the Company’s legitimate interest.
You may exercise your right to object at any time by sending a request to: [email protected].
The Company will review your objection and, where appropriate, will cease processing your data for these purposes, unless it can demonstrate compelling legitimate grounds for the processing which override your interests and rights.
The Company does not make decisions that produce legal effects concerning data subjects or similarly significantly affect them, based solely on automated processing, including profiling, unless explicit consent has been obtained from the data subject or the processing is necessary for the performance of contractual obligations.
The use of registration via an external identity provider does not result in decisions based solely on automated processing.
YOUR RIGHTS
Under GDPR, you have the following rights:
- Right to information; In accordance with the applicable personal data protection legislation, including Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), you have a number of rights that you may exercise at any time.
The right to information allows you to request details about what personal data we hold about you, how we collected it, the purpose of its processing, as well as information about the recipients or categories of recipients to whom such data has been or will be disclosed.
The right of access allows you to obtain confirmation as to whether we process your personal data, as well as access to the data itself and information about its processing.
The right to rectification allows you to request that we correct inaccurate or complete incomplete personal data that we hold about you.
The right to erasure (“the right to be forgotten”) allows you to request the deletion of your personal data where the processing is unlawful, where the data is no longer needed for the purposes for which it was collected, where you have withdrawn your consent and no other legal basis for processing exists, or where the data must be deleted due to a legal obligation. Where applicable, the Company will notify third parties to whom this data has been disclosed of the deletion, unless this proves impossible or requires disproportionate effort.
The right to restriction of processing allows you to temporarily limit the processing of your personal data, for example when you contest the accuracy of the data (for the period during which its accuracy is being verified), when the processing is unlawful but you prefer the data not to be deleted, or when you have objected to the processing and verification of the legal grounds is pending.
The right to data portability allows you to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller. This right applies only when the processing is carried out based on consent or a contract, and by automated means.
The right to object allows you to object at any time to the processing of your personal data when the basis for such processing is the controller’s legitimate interest. If the objection is justified, we will stop processing the data unless we demonstrate compelling legitimate grounds that override your interests and rights. This right also includes the ability to object to the use of photographs or video recordings taken at public events.
The right not to be subject to a decision based solely on automated processing, including profiling, gives you the right to request human intervention, express your point of view, and contest the decision when it produces legal effects concerning you or significantly affects you.
The right to withdraw consent may be exercised at any time when the processing of your personal data is based on your consent, such as for marketing purposes. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal and does not prevent further processing where another legal basis exists, such as a legal obligation, contract performance, or legitimate interest.
If you believe that we are violating applicable personal data protection requirements, you have the right to lodge a complaint with a supervisory authority. In the Republic of Bulgaria this is the Commission for Personal Data Protection, address: Bulgaria, Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
More information about the Commission can be found at: https://www.cpdp.bg/.
We recommend contacting us first so that we may review your concern and assist you in the fastest and most effective way.
How to exercise your rights
To exercise any of the above rights, you may contact us via:
Email: [email protected]
or by post at the Company’s registered address.
We will respond to every request within one month of receipt. In cases of complex or numerous requests, this period may be extended by up to two additional months, of which you will be notified.
Exercising these rights is free of charge, unless the requests are clearly unfounded or excessive, in which case we may charge a reasonable fee.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or exercise any of your other rights). This is a security measure designed to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to request additional information needed to expedite our response.
CHANGES TO THIS POLICY
We reserve the right to amend and update this Policy. Any such changes will be published on our website bulgariawantsyou.com. If the changes are significant, we will additionally inform you by email or another appropriate method of contacting you.
This Policy is effective as of 18 February 2026.