This notice has been drawn up on the authority of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (Articles 13 and 14).


Personal data Controllers


Agropolychim AD, having its seat and registered office in the town of Devnya, postcode 9160, Industrial Zone, Unified Identification Code 813095287, is a personal data controller and processor within the meaning of the Personal Data Protection Act and Regulation (EU) 2016/679.


Afer Bulgaria EOOD, having its seat and registered office in the town of Devnya, postcode 9160, Industrial Zone, Unified Identification Code 123512950, is a personal data controller within the meaning of the Personal Data Protection Act and Regulation (EU) 2016/679.


Rimakem EOOD, having its seat and registered office in the town of Devnya, postcode 9160, Industrial Zone, Unified Identification Code 103847457 is a personal data controller within the meaning of the Personal Data Protection Act and Regulation (EU) 2016/679.


Zarnen Terminal Varna Zapad AD, having its seat and registered office in the town of Devnya, postcode 9160, Industrial Zone, Unified Identification Code 203609503 is a personal data controller within the meaning of the Personal Data Protection Act and Regulation (EU) 2016/679.


You can contact us at the registered office indicated above or by using the online contact form on our website: https://agropolychim.bg/kontakti/obratna-vrazka/


For questions related to the processing of your personal data and to the exercise of your rights regarding processing of your personal data, please write to: data.protection@agropolychim.bg


Categories of personal data of natural persons, employees of business partners, with reference to contractual and pre-contractual relations with the companies in the group of Agropolychim


Depending on the specific purpose of and reasons for processing, the Controllers process the following categories of personal data, or combinations of such categories, of natural persons as employees, representatives, contractors, contact or authorized persons, persons, by virtue of their official duties, acting on behalf of the counterparty, employees who make and exchange correspondence and documents of assignment, acceptance, reporting and other actions on behalf of contractor:
– Name, surname, or full name
– Position; name of the employer
– Phone number; e-mail
– Personal identity number
– Number of identity document
– Vehicle registration plate number
– Video footage obtained within the territory of Agropolychim AD;
– Data certifying the commitment of the posted worker/employee on the territory of the company with the employer who posted the worker/employee (employment relationship between the seconded employee of the contractor and the employer who posted him on the territory of the company); data for paid remuneration for the last twelve months before posting or for the employment period, if shorter.

Purposes of processing your personal data


– Data concerning position of the individuals is processed for the implementation of communication between the parties, with respect to initiating, execution and suspension of contract or in the context of pre-contractual relations; contract management, maintenance and termination of business relations; for correspondence between the parties concerning the aspect of the contractual relation – quotes, negotiations, agreement on the contractual terms; operations referring contract execution: making bank transfers, work assignment and acceptance, reporting.
– To grant access to the offices, production, and technological premises regarding the execution of the contract, check of the identity document is being carried out in order to: identify individuals who are employees of contractors in their capacity as representatives of business partners; receiving individual pass for passing through the authorised access points.
– When granting access, the staff of the business partners shall be briefed on the rules for ensuring occupational safety and health. The instructed persons are registered in a safety and health instruction book.
– Personal data will be processed in execution of requirements of the current legislation in the cases of admission of employees posted on the territory of the company within the provision of services.

Grounds for processing your personal data


– Compliance with the Accounting Act, Tax legislation and other related regulations.
– Defense of the Controller’s rights in or out of court in case of contract default, claiming damages etc. with respect to business relations.
– Ensuring the physical security and protection against terrorist attacks on the buildings/sites or on the life and health of staff and visitors of Agropolychim AD pursuant to Article 23(1) of the Antiterrorism Act and Article 5 of Regulation No 8121з-1225 of 27 September 2017 on the types of sites under Article 23(1) of the Antiterrorism Act whose owners are required to develop and implement antiterrorism measures.
– Security guarding of the Controller’s property through the physical protection thereof against unlawful harm and through the prevention and blocking of such harm, as well as through counteracting unlawful aggression against individuals within the territory of the Company.
– Protection of the safety, health, and life of the individuals on the premises of Agropolychim AD in accordance with the Health and Safety at Work Act. Ordinance №RD-07-2 of 16.12.2009 for the conditions and the order for conducting periodic training and instructing of the workers and employees on the rules for ensuring healthy and safe working conditions, as well as all other applicable ordinances.
– Application of the requirements of the current legislation in the cases of admission of employees posted on the territory of the company within the provision of services. (Labour Code, Art. 121a; Labour Migration and Labour Mobility Act (in cases of third-country citizens seconded by a foreign employer for providing services on the territory of the Republic of Bulgaria); Regulation for implementing the Labour Migration and Labour Mobility Act. Art. 31 – for those seconded to the registration regime and Art. 25 – for seconded employees for whom a permit is required from the Employment Agency; Obligation to submit documents to the Employment Agency to make the registration of employment: Declaration of the host company that the conditions of art. 7, para. 1, item 3 of the Labour Migration and Labour Mobility Act (that working and pay conditions are not more unfavourable than those for Bulgarian citizens); Ordinance on the conditions and procedure for sending workers to business trips and employees within the frames of provision of services).


Personal data processing time limits


– The personal data in the financial and accounting documentation shall be processed and stored for the period for storage of such documents provided for by the applicable tax and accounting legislation.
– The personal data used for communication between the parties, consideration of offers and conclusion of a contract / order are stored for a period of 5 years after the expiration of the contract / execution of the order.
– Upon the contract expiry personal data processed for the contract execution will no longer be processed. The length of time the data is stored (documentation and correspondence) is determined by the final settlement of all financial obligations or any claims/objections between the parties. The provided commercial, technical,and financial accounting documents are processed and stored for the storage period determined in the applicable tax and accountancy legislation for the relevant type of document. The personal data processing time limit may be extended if required to ascertain, exercise, or defend entitlements to which such data are relevant. In these cases, the relevant data may be processed until the final closure/resolution of the relevant legal claims in accordance with the statutory procedure.
– The personal data for issuing an access permit in the “Request for Access” form are stored for up to 2 (two) years from the end date for which the permit was issued.
– For fulfilling the obligation to apply preventive safety measures for individuals, the controller processes full name and signatures of the instructed persons, which are stored for a period of 5 (five) years from the date of completion of the safety briefing book.
– The company shall keep the documents referred to in Article 14, para. 2 and 3 of the Ordinance on the conditions and procedure for sending workers to business trips and employees within the frames of provision of services, within one year after the expiry of posting. Since according to Art. 14, para. 3 of the Ordinance, at the request of the General Labor Inspectorate, when performing an inspection, the employer is obliged to provide the documents.

Categories of third parties accessing and processing your personal data


– A security company for providing physical security, access control within the territory of the company.
– Other companies in the group of Agropolychim for the purpose of the contract execution.
– Persons who, on behalf of the Controller, maintain software used for processing personal data.
– Persons, assigned by the Controller, providing consulting services, in the scope of which access personal data is involved.
– Competent government bodies and other persons as provided for by law, including persons providing the legal defense of the Controllers’ rights and interests.
– Postal or courier service providers if the use of such is necessary for the contract execution.
Rights of data subjects pertaining to the processing of their personal data
When processing your personal data, you have the right:
– To receive information concerning the processing of your personal data: the purposes of the processing; the categories of personal data concerned and the recipients to whom the personal data will be or have been disclosed, the envisaged period for which the personal data will be stored, the existence of automated decision-making, the source of the personal data (Article 15 of Regulation (EU) 2016/679).
– To obtain the rectification or completion of inaccurate/outdated personal data (Article 16 of Regulation (EU) 2016/679).
– Your personal data to be erased without undue delay where applicable, i.e. where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; where you have objected to the processing and there are no overriding legitimate grounds for the processing; where you have withdrawn the consent on which the processing is based; where required for compliance with a legal obligation; where the personal data have been unlawfully processed (Article 17 of Regulation (EU) 2016/679).
– To restrict he processing of your personal data where the personal data are incorrect (in such case the restriction shall apply for a period enabling the controller to verify the accuracy of the personal data); where the processing of the personal data is unlawful but you request the restriction of the use of your personal data instead of the erasure thereof; where the controller no longer needs the personal data for the purposes of the processing but they are required by you for the establishment, exercise or defense of legal claims; where you have objected to the processing pending the verification whether the legitimate grounds of the controller override those of the data subject (Article 18 of Regulation (EU) 2016/679).
– To require the notification of third parties to whom your personal data has been disclosed of any correction, deletion, or restriction, unless this is impossible or requires a disproportionate effort (Article 19 of Regulation (EU) 2016/679).
– To receive your personal data in a structured, widely used, and machine-readable format, or to request the transfer of such data to another controller subject to the grounds provided for in Regulation (EU) 2016/679 (Article 20 of Regulation (EU) 2016/679).
– To object to the processing of your personal data. In this case, the processing shall be discontinued, unless there are compelling legitimate grounds for the processing which override your interests, rights, and freedoms (Article 21 of Regulation (EU) 2016/679).
– To lodge a complaint with a supervisory authority pursuant to Article 77 of Regulation (EU) 2016/679 where you consider that Regulation (EU) 2016/679 or other applicable personal data protection rules have been infringed. The supervisory authority in Bulgaria is Commission for Personal Data Protection, 1592 Sofia, 2, Prof. Tsvetan Lazarov Blvd, website: https://www.cpdp.bg/

Any updates to this notice will be published on the website of Agropolychim AD: https://agropolychim.bg.