Privacy Policy
This Privacy Policy explains how DNA MEDIA AD (UIC 205882707, with its registered office and management address at Floor 3, 22 Galichitsa Street, Lozenets District, Sofia 1164, hereinafter referred to as the "Controller", "DNA MEDIA AD", the "Operator" or "we") collects, processes and stores your personal data when you use the Platform.
This Policy forms an integral part of and supplements our Terms and Conditions bulgariawantsyou.com/en/terms-of-use All capitalised terms (such as "Talent", "Employer" and "Platform") that are not expressly defined in this Policy shall have the following meanings:
"Controller" / "Operator" / "we" means DNA MEDIA AD, UIC 205882707, with its registered office and management address at Floor 3, 22 Galichitsa Street, Lozenets District, Sofia 1164.
"Talent" means any natural person who registers a Profile or uses the Platform to search for career opportunities, create a professional Profile, apply for job advertisements or contact Employers, and whose personal data are processed by the Controller in accordance with this Policy.
"Employer" means any legal entity or natural person (including its authorised representatives, employees and recruitment professionals) that registers a corporate Profile or uses the Platform to publish job advertisements, review applications, contact Talents and recruit personnel.
"Platform" means the website and/or mobile application operated by the Controller.
Section I: Details of the Controller and Data Protection Officer
1.1. DNA MEDIA AD, UIC 205882707, with its registered office and management address at Floor 3, 22 Galichitsa Street, Lozenets District, Sofia 1164 ("DNA MEDIA AD", the "Operator" or "we"), acts as a controller of personal data within the meaning of Regulation (EU) 2016/679 (GDPR).
1.2. If you have any questions about the processing of personal data, wish to exercise your rights or contact our Data Protection Officer (DPO), you may contact us at:
1.2.1. Data protection email address: [email protected]
1.2.2. Correspondence address: Floor 3, 22 Galichitsa Street, Sofia 1164
Section II: Personal Data We Collect and Process
2. In providing our services, we collect personal data relating to various categories of data subjects, which may be summarised as follows:
2.1. Persons who have registered on our Website;
2.2. Persons who use certain services on our Website without registering;
2.3. Persons who have submitted enquiries through our various channels;
2.4. Persons who have subscribed to our newsletter or registered for events organised by the Company;
2.5. Persons participating in events organised by us as speakers or attendees;
2.6. Persons who have given their consent for direct marketing purposes;
2.7. Persons participating in promotional games and campaigns organised by the Company;
2.8. Persons submitting enquiries in relation to real estate advertisements published in the "Real Estate" section.
3. A description of the personal data collected and processed is provided below. Where we are subject to a contractual or legal obligation, we must comply with it and process your personal data. If such an obligation applies and you do not provide the required data when requested, we may be unable to enter into or perform an agreement or comply with our legal obligation.
Process | Categories of Personal Data | Purpose of Processing | Legal Basis |
Registration/Creation of a Website Account | First name and surname, email address, telephone number, answer to the question "Why do I want to work in Bulgaria?", education, professional field and cities of interest. Social media profiles (if provided). If you wish, you may add a photograph to your account. The photograph you add will be visible to Employers. | Enabling use of the Platform's services, including management of the personal Profile and submission of applications to employers. | Processing is necessary for the performance of a contract (Article 6(1)(b) GDPR). |
Registration through a Google or Meta Account (e.g. Facebook) | Name, email address, Profile photograph (if available and provided by the selected platform), and account ID in the relevant network | Facilitating registration and sign-in to the Platform through an existing user account with a third-party service | Performance of a contract - registration and sign-in through your selected account form part of the service we provide to you (Article 6(1)(b) GDPR). Separate consent is required for storing information in, and accessing information from, your terminal device pursuant to Article 4a of the Electronic Communications Act. |
Consent to the processing, storage and sharing with prospective employers of all data from your Profile, including your CV and other qualification-related documents (where the Profile is public) | Personal data contained in your Profile and attached files, including your CV and qualifications: first name and surname, contact details, education, professional experience, skills, photograph (if included in your CV), and any other information voluntarily entered by a Website user. | Processing, storing and sharing information and documentation with employers offering positions suitable for the user; facilitating the job-search process by presenting the information directly to prospective employers | Consent, given by actively enabling the specific public-visibility setting - Article 6(1)(a) GDPR |
Subscription to New Job Notifications | Email address and desired professional field | Sending notifications about new advertisements according to criteria selected by the user | Consent - freely given, specific, informed and unambiguous (Article 6(1)(a) GDPR) |
Use of the Contact Form | First name and surname, email address | Responding to enquiries and handling complaints according to the need stated by the user | Legitimate interests - ensuring effective communication and user support (Article 6(1)(f) GDPR) |
Participation in Events Organised by the Company | Your personal data contained in your Profile, including the attached CV and other documents relating to your qualifications During the event and in certain cases, video recordings may also be made of persons/participants captured as part of the overall scene. | Registration for participation in events Organising the event and providing data to employer partners for the purpose of establishing contact and creating professional opportunities. Documenting events of a public nature | Performance of a contract - registration and participation in the event (Article 6(1)(b) GDPR); disclosure of your data and documents to employer partners - separate explicit consent (Article 6(1)(a) GDPR); video recording of the event - the Controller's legitimate interests (Article 6(1)(f) GDPR), with an information notice displayed at the event venue and the opportunity for you to object. |
Registration for Participation in Promotional Campaigns | First name and surname, email address and social media Profile (in certain cases) | Effective administration of campaign participation; contacting participants; awarding prizes | Consent - by voluntarily completing a registration form (Article 6(1)(a) GDPR); where necessary, compliance with a legal obligation (Article 6(1)(c) GDPR) |
Interaction through Social Media (e.g. Facebook, Instagram) | Public information from social media: name/alias, comments, messages and reactions ("like"/"follow") | Responding to enquiries and providing content according to the contact method selected by the user | Legitimate interests - responding to an enquiry or reaction (Article 6(1)(f) GDPR) |
Applying for an Advertisement through the Platform | Curriculum vitae (CV), including the personal data and photograph contained in it (if included), as well as all other documents and information in your Profile; technical information about the application (e.g. date and advertisement); history of applications to individual employers. | Transmitting the documents and information submitted by you to the Employer that published the advertisement; storing and displaying the application in the Employer's Profile on the Platform; enabling participation in a recruitment procedure; maintaining your application history. | Performance of the contract between you and us for use of the Platform, including steps taken at your request (Article 6(1)(b) GDPR). Upon receipt of the application, the Employer acts as an independent controller and we act as a processor of personal data on its behalf (see Section IVa). |
Employer Registration | First name and surname of a representative or contact person, together with their email address, telephone number and position | Creating the Employer's Profile, managing advertisements and communicating with Talents | Legitimate interests (Article 6(1)(f) GDPR) - administering the contractual relationship with the Employer and ensuring communication in connection with it. The contract is concluded with the legal entity, not with you personally, and therefore the legal basis is not performance of a contract. |
Communication between Talents and Employers through the Internal Messaging System | Message content, name and Profile data voluntarily provided by Talents or Employers | Facilitating the recruitment process and direct communication between the parties | Performance of a contract (Article 6(1)(b) GDPR) - providing the messaging functionality as part of the service. In respect of messages in the context of a specific application, we act as a processor of personal data on behalf of the Employer. |
Newsletter Subscription | Email address | Sending a newsletter containing news, event information and marketing offers | Consent (Article 6(1)(a) GDPR) |
Submitting an Enquiry about a Real Estate Advertisement ("Real Estate" Section) | First name and surname, telephone number, message content, date and time sent, and IP address The IP address is processed to ensure system security and prevent misuse. | Forwarding the enquiry to the relevant real estate agency (Home2U or INclusive) that published the specific advertisement, so that it can contact you in connection with your interest in the Property | Legitimate interests (Article 6(1)(f) GDPR) - forwarding your enquiry to the agency selected by you and ensuring system security. Home2U and INclusive are independent controllers in respect of subsequent communications with you, and you may exercise your rights directly against them. |
Security Logs | IP address, User ID, browser and timestamp | Preventing misuse, evidencing acceptance of the Terms and Conditions, and defending legal claims | Article 6(1)(f) GDPR |
|
|
|
|
When you register through a Google or Meta account (e.g. Facebook), we may, depending on the service you select, obtain access to your name, email address, Profile photograph and the identifier associated with your account on the relevant platform. These data are used solely to create your Profile on our Platform and provide you with access to our services. We do not have access to your password or other sensitive data from those platforms.
4. Data Relating to Talents (Natural Persons)
4.1. Identification Data: first name, surname, Profile photograph, and country and city of residence;
4.2. Contact Data: email address, telephone number and links to social/professional networks (LinkedIn);
4.3. Professional Profile and CV: education, employment history, language and technical skills, and attached files (CV, certificates and portfolio);
4.4. System and Technical Data: IP address, sign-in data, browser type, operating system and activity logs;
4.5. Behavioural Data: application history and notification preferences.
5. Data Relating to Employers and Traders
5.1. Contact details of the representative/contact person (name, position, business email address and telephone number);
5.2. Invoicing data and financial history;
5.3. History of communications through the messaging system.
Section IIa: Special Categories of Personal Data and Persons under 18 Years of Age
5a.1. We do not request or intentionally process personal data under Article 9(1) GDPR, including data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, or data concerning a person's sex life or sexual orientation. Please do not include such data in your CV, attached documents or free-text fields.
5a.2. If you nevertheless include such data, they shall be stored and displayed to Employers unchanged as part of the documents you submit. We do not index them, search or filter by them, or use them as a ranking or recommendation criterion. You may request their erasure at any time.
5a.3. We do not request, and you should not provide through the Platform, a Bulgarian Personal Number, identity document number or bank details.
5a.4. The Platform is not intended for persons under 18 years of age. If we become aware that we have received data relating to such a person, we shall erase them without undue delay.
Section III: Purposes and Legal Bases for Processing
6. We process your personal data on the following legal bases under Article 6(1) GDPR:
6.1. Performance of a contract (Article 6(1)(b) GDPR): to register a Profile, provide application functionalities, deliver the services and process payments;
6.2. Compliance with a legal obligation (Article 6(1)(c) GDPR): for financial, accounting and tax reporting purposes;
6.3. Legitimate interests (Article 6(1)(f) GDPR): to ensure network and information security, prevent fraud and defend legal claims;
6.4. Explicit consent (Article 6(1)(a) GDPR): to send marketing newsletters; to use analytics cookies and tools for analysing user behaviour, including Hotjar and Google Analytics; and to disclose your complete Profile data to Employers, including your CV and contact details.
Section IV: Visibility Management and Profile Modes
7. Each Talent manages the level of access to their personal data through the following modes in their control panel:
7.1. "Looking for a Job" (on/off) and separate visibility controls. When "Profile Visibility" is enabled and explicit consent has been given, the Talent's complete Profile is visible to Employers. Without such consent, Employers cannot view the Talent's Profile or data.
Section IVa: What Happens When You Apply for an Advertisement
7a.1. When you submit an application for an advertisement, we transmit the documents and information submitted by you to the Employer that published the advertisement and store and display them in the Employer's Profile on the Platform.
7a.2. From the time the application is received, the Employer acts as an independent controller of your personal data for the purposes of its recruitment procedure. You may exercise your GDPR rights directly against the Employer. The Employer's contact details and a link to its privacy policy are available in the advertisement.
7a.3. In respect of the storage and display of the application on the Platform, communications with you through the internal messaging system in the context of that application, and its export and erasure, we act as a processor of personal data on behalf of the Employer under an agreement concluded with it pursuant to Article 28 GDPR.
7a.4. Irrespective of the application submitted, your Profile and the documents uploaded to it remain part of our Profile database, for which we are the Controller. Erasure of an application by the Employer does not result in erasure of your Profile, and vice versa.
7a.5. Separately from the application process, an Employer may obtain access to your Profile through the Talent search and Profile access functionalities, in accordance with the visibility settings you have selected. In this case, we disclose your data in our capacity as Controller and the Employer becomes an independent controller from the time of access; in this situation, we do not act as a processor on its behalf.
Section V: Anonymisation and "Talent Pool Visualisation"
8. The Platform provides Employers with a "Talent Pool Visualisation" functionality to display statistical data concerning available professionals in a given sector.
9. Talent Pool processing is carried out entirely on aggregated and anonymised data. No names, contact details or specific CVs are disclosed in this process; only quantitative metrics are displayed (e.g. "126 Software Development professionals").
Section VI: Automated Processing and Algorithms
10. The Platform uses deterministic algorithms to rank and recommend advertisements on the basis of objective criteria. The algorithms serve solely an assistive function.
11. Algorithmic matching constitutes profiling within the meaning of Article 4(4) GDPR but does not constitute automated decision-making producing legal effects within the meaning of Article 22 GDPR. The final decision whether to invite a candidate to an interview or hire them is made entirely by a natural person (the Employer).
12. Artificial-intelligence-based functionalities will be introduced after this Policy has been updated and prior notice has been given.
Section VII: User Behaviour Analytics
13. To improve the functionality and design of the Platform, DNA MEDIA AD uses the Hotjar analytics tool.
14. The integration has been implemented in strict compliance with the principle of data protection by design:
14.1. All text fields containing personal data (names, CVs, email addresses, passwords and addresses) are automatically masked at browser level before the data are sent to Hotjar's servers;
14.2. Keystroke logging is not used and is disabled;
14.3. Session recordings and heatmaps display only mouse movements and clicks in anonymised form.
Section VIII: Consent Management through Cookiebot and Marketing
15. Cookie consent is managed and audited through the Cookiebot platform (integrated through Google Tag Manager).
16. The job advertisement email newsletter is sent regularly (every Friday morning) only after explicit consent has been given. You may unsubscribe at any time through the link contained in each email.
Section IX: Data Recipients and Transfers to Third Countries
17. Talents' personal data are disclosed to:
17.1. Registered Employers (in accordance with the selected visibility settings);
17.2. Technical and hosting service providers (processors) with which DNA MEDIA AD has entered into data processing agreements (DPAs);
17.3. Public authorities, where required by law.
17.4. The specific recipients and providers under Clauses 17.1 and 17.2 are:
17.4.1. BULKOD 2016 OOD (Bulgaria) - development, technical support and administration of the Platform;
17.4.2. Amazon Web Services EMEA SARL (Luxembourg) - cloud hosting infrastructure and data storage in regions within the EU;
17.4.3. Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA) - payment processing and issuance of electronic invoices;
17.4.4. Hotjar Ltd. (Malta) - analysis of user behaviour on the Website;
17.4.5. Google Ireland Ltd. / Google LLC (Ireland / USA) - web analytics and sign-in through an existing account;
17.4.6. Meta Platforms Ireland Ltd. (Ireland) - sign-in through an existing account;
17.4.7. Cookiebot - cookie consent management platform;
17.4.8. Home2U and INclusive (Bulgaria) - independent controllers receiving enquiries in the "Real Estate" section;
17.4.9. Accounting, legal and audit advisers bound by confidentiality obligations.
18. Transfers of Personal Data outside the European Economic Area (EEA)
18.1. The Operator endeavours to process and store your personal data primarily within the European Union (EU) and European Economic Area (EEA).
18.2. In certain cases, in connection with the use of specific external technology services and functionalities (e.g. analytics tools such as Google Analytics and Hotjar, payment services through Stripe Inc., and social sign-in/Google and Meta sign-in functionalities), your data may be transferred to and processed by providers based in countries outside the EEA, in particular the United States of America (USA).
18.3. Transfers of data to such providers shall be carried out in compliance with the legal requirements of the GDPR and on the basis of the following safeguards:
18.3.1. For providers based in the USA (e.g. Google, Meta and Stripe) that are certified under the Data Privacy Framework (DPF) pursuant to the European Commission's adequacy decision of 10 July 2023, transfers shall be made without the need for further authorisation;
18.3.2. For providers outside the EEA that are not covered by an adequacy decision, the Operator shall use the Standard Contractual Clauses approved by the European Commission (pursuant to Article 46(2)(c) GDPR), together with the necessary supplementary technical and organisational security measures.
18.4. Information on the specific external providers, the destination country and the applicable transfer mechanism is set out in Clause 17.4 of this Policy.
Section X: Data Retention Periods
19. Data in the user Profile shall be retained until the Talent closes the Profile.
20. If the Profile remains completely inactive (no sign-in) for a period of three (3) consecutive years, DNA MEDIA AD shall send a warning notice to the email address provided by you. If no action is taken within 30 days after the notice is sent, the Profile shall be closed automatically and the personal data, including uploaded CVs, shall be erased or irreversibly anonymised.
21. Retention periods by category of data are as follows:
21.1. Data in the user Profile and documents attached to it - until closure of the Profile or expiry of the period under Clause 20;
21.2. Applications and documents attached to them that are accessible to the Employer - until expiry of the relevant advertisement, or until its removal or archiving, as applicable;
21.3. Messages from the internal messaging system - 10 years after completion of the relevant application;
21.4. Application history - until closure of the Profile;
21.5. Enquiries submitted through the contact form - 10 years from completion of the communication;
21.6. Newsletter and notification subscription data - until consent is withdrawn;
21.7. Evidence of consent given, amended and withdrawn - five (5) years from withdrawal;
21.8. Event participation data and video recordings - 10 years;
21.9. Accounting and invoicing documents - in accordance with Article 12 of the Accountancy Act and Article 38 of the Tax and Social Security Procedure Code.
Section XI: Rights of Data Subjects
22. Every user has the following rights under the GDPR:
22.1. Right of access to personal data;
22.2. Right to rectification of inaccurate data;
22.3. Right to erasure (the "right to be forgotten");
22.4. Right to restriction of processing;
22.5. Right to data portability;
22.6. Right to object to processing;
22.7. Right to withdraw consent at any time.
23. Requests to exercise your rights shall be sent to [email protected]. We shall respond within one (1) month of receiving the request. Where necessary, this period may be extended by a further two (2) months, taking into account the complexity and number of requests. We shall notify you of the extension and the reasons for it within the first month (Article 12(3) GDPR).
24. Irrespective of any request submitted to us, you have the right at any time to lodge a complaint with the Commission for Personal Data Protection at 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, email: [email protected], website: www.cpdp.bg. You also have the right to seek judicial protection before the competent administrative court.
25. This document has been drawn up in Bulgarian and English. In the event of any conflict or difference in interpretation between the Bulgarian and English versions, the Bulgarian text shall prevail and have full legal effect.