PRIVACY POLICY

Personal data protection policy of  

“Cargofort” Ltd 

 

What is this document? 

For us, from CARGOFORT Ltd, the protection of the confidentiality of your personal data is a top priority. 

This document (eg “Policy”) is intended to inform you how we at CARGOFORT Ltd, as a controller of personal data, process your data in the course of our relationship (visit our website, use of our services, etc.) and how you can exercise your rights under Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter “the Regulation”) and the Personal Data Protection Act. 

 

Who are we 

CARGOFORT Ltd, UIC 206388476, with registered office and address of management in Sofia 1606, Krasno Selo district, 38-40 Georgi Sofiyski Str. (Aka CARGOFORT). 

CARGOFORT is a personal data administrator. 

CARGOFORT brings together a team of specialists with over 15 years of experience in the field of insurance, transport law, logistics, goods settlement and the CMR Convention. 

 

Contact data 

If you have questions or ambiguities regarding the processing of your personal data or wish to exercise any of your rights, you can contact us at the following coordinates: 

Address: Sofia 1606, Krasno Selo district, 38-40 Georgi Sofiyski Str. 

Email: office@cargofort.com  

Tel .: +359 886 677 598 

Website: www.cargofort.com  

 

What kind of your data we process? 

CARGOFORT processes the following data: 

  • three names;
  • contact details: e-mail address, physical address (delivery address), IP address and telephone;
  • unique civil number (PIN), personal number of a foreigner (PIN) or other identifier;
  • any other personal data that you provide to us in the process of using our services, which includes, but is not limited to: information on issuing invoices, including e-invoices, data from online chat, etc.

 

For what purposes we process your data? 

The personal data provided by you are processed for the following purposes: 

  1. Consulting clients.
  2. Communication with customers.
  3. Concluding contracts with clients.
  4. Conclusion of civil contracts.
  5. Job application: the processing of documents for job application / internship in “CARGOFORT”.
  6. Labor relations.
  7. For the purposes of direct marketing and sending information messages about the activities of “CARGOFORT”.

 

To whom we provide your data? 

“CARGOFORT” does not sell or provide your personal data to third parties, except in the cases explicitly listed below. Subject to the “need to know” principle, only a limited number of CARGOFORT representatives have access to your personal data, all of whom have an obligation to maintain the confidentiality of personal data. 

CARGOFORT may provide your data to: 

  • state bodies and bodies of the Ministry of Interior – within their powers and in compliance with the requirements contained in the legislation;
  • third parties – with the consent of a client for the purpose of providing services by CARGOFORT; exceptionally and only on the basis of contractual relations with CARGOFORT.

 

When providing personal data to a third party – processor, “CARGOFORT”: 

  • Requires guarantees for compliance with legal requirements and good practices for personal data processing;
  • Concludes a written agreement or other legal act with identical effect, which regulates the obligations of the processor. 

 

CARGOFORT‘ strategy for personal data protection 

  1. “CARGOFORT” processes your personal data legally. Personal data shall be processed only on the grounds provided for in Articles 6 and 9 of the Regulation and no exceptions may be made in this respect.
  2. “CARGOFORT” strives to process your personal data in a transparent manner. Restrictions on transparency are possible insofar as the purpose and meaning of the Regulation allow them.

 

Definitions 

For the purposes of this Policy: 

  • “personal data” means any information on the basis of which an individual can be identified, such as a name, identification number, location data, online identifier or one or more characteristics specific to the physical, physiological, genetic, psychological, the mental, economic, cultural or social identity of that individual;
  • “special categories of personal data” means personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs or trade union membership, genetic data, biometric data, health data or data on sexual life or sexual orientation of the physical face.
  • ‘data subject’ means the natural person who can be identified as a result of the processing of the relevant data;
  • “processing” means any operation or set of operations carried out with personal data or a set of personal data by automatic or other means such as collecting, recording, organizing, structuring, storing, adapting or modifying, retrieving, consulting, using, disclosing by transmission, disseminating or otherwise making the data accessible, arranging or combining, restricting, deleting or destroying it;
  • “controller” is a person who alone or jointly with other persons determines the purposes and means for the processing of personal data; “CARGOFORT” has the quality of administrator in terms of personal data of persons with whom it interacts to achieve its mission – participants in events; partners; sponsors; volunteers, etc. All personal data that CARGOFORT processes are obtained voluntarily and within the respective relations;
  • “processor of personal data” is a person who processes personal data on behalf of the controller; partners and volunteers have the quality of processors in terms of personal data provided by CARGOFORT; however, if they deviate from the instructions for working with this data, processors may lose the quality of ‘processors’, and acquire the quality of ‘administrators’ with the associated increased duties and responsibilities; 

 

Principles 

In the processing of personal data, “CARGOFORT” is guided by the following principles: 

  • Personal data is processed lawfully and in good faith;
  • Personal data is collected and used for specific, well-defined and legal purposes;
  • Personal data must be relevant and not excessive;
  • Personal data must be accurate and, if necessary, updated;
  • Personal data must be stored no longer than necessary;
  • The rights of data subjects must be respected;
  • Personal data must be stored securely protected from unauthorized access, accidental loss or damage;
  • For each operation related to personal data, a trace must remain, allowing to establish who, when and how processed the data;
  • Personal data is exceptionally transferred to countries or territories outside the European Economic Area solely for the purpose of fulfilling a contractual relationship between CARGOFORT and a customer for the purpose of providing services in the field of transport. In these cases, CARGOFORT monitors whether:
  • that country or territory provides an adequate level of protection of the rights and freedoms of data subjects in relation to the processing of personal data, or
  • a contract is concluded using standard contractual clauses that provide an adequate level of protection

 

Grounds for processing 

CARGOFORT processes personal data only if and to the extent that at least one of the following conditions is applicable: 

  1. a) the data subject has consented to the processing of his personal data by CARGOFORT for one or more specific purposes; consent must be freely expressed, specific, informed and unambiguous; it may be expressed by means of a statement or clearly confirmatory action;
  2. b) the processing is necessary for the performance of a contract concluded between CARGOFORT and the data subject, or for taking steps at the request of the data subject prior to the conclusion of the contract;
  3. c) the processing is necessary for the performance of a contract concluded between CARGOFORT and another legal entity providing data to its employees / partners for the purpose of providing services by CARGOFORT;
  4. d) the processing is necessary for the observance of a legal obligation, which is applied to “CARGOFORT”;

(e) the processing is necessary in order to protect the vital interests of the data subject or of another individual; 

  1. f) the processing is necessary for the performance of a task of public interest or in the exercise of official powers conferred on CARGOFORT;

  

Special categories of personal data are processed by CARGOFORT only if and to the extent that at least one of the following conditions is applicable: 

(a) the data subject has given his or her explicit consent to the processing of that personal data for one or more specific purposes; 

  1. b) the processing is necessary for the purposes of fulfilling the obligations and exercising the special rights of CARGOFORT or the data subject under labor law or social security and social protection law;

(c) the processing is necessary in order to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving his or her consent; 

(d) the processing relates to personal data which have been made public by the data subject; 

(e) the processing is necessary for the purpose of establishing, exercising or defending legal claims; 

(f) the treatment is necessary for the purposes of preventive or occupational medicine, for the assessment of the employee’s ability to work, the medical diagnosis, the provision of health or social care or treatment; 

(g) processing is necessary for reasons of public interest in the field of public health, such as protection against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare and medicinal products or medical devices. 

 

How personal data is stored and processed 

Personal data is stored on paper and electronically. Access to personal data is available only to those representatives of CARGOFORT who need such access to achieve the above-described purposes or for whom the law requires it. 

The processing of personal data may include the collection, recording, organizing, structuring, storing, retrieving, consulting, using, disclosing through transmission, publishing a website, or otherwise making personal data available, arranging or combining, restricting, deleting or destroying. CARGOFORT uses some of these forms of personal data processing. 

 

Rights of data subjects 

The right to be informed who, how and why your data  is processed  CARGOFORT publishes the relevant information on its website. 
Right of access  You have the right to receive confirmation from CARGOFORT whether it processes your personal data and if so, you have the right to access them, the right to receive a free copy of the data (except in cases of excessive and repeated inquiries), and the right to be provided with a description of the main characteristics related to the processing of your personal data. 
Right of adjustment  You have the right to correct or request “CARGOFORT” to correct, without undue delay, inaccurate, incomplete or outdated personal data. 
Right to delete  In certain cases, you may ask CARGOFORT to delete your personal data without undue delay. For example when: 

(i) are no longer necessary for the purposes for which they were collected or processed; 

(ii) if you object to the processing; 

(iii) if the data have been processed unlawfully; or 

(iv) must be deleted in order to comply with a legal obligation under EU law, the law of Bulgaria or another country. 

  

The law provides for cases in which CARGOFORT may refuse to delete your personal data. 
Right to limit processing  You may request that CARGOFORT restrict processing in the following cases: 

i. When you dispute the accuracy of personal data (the limit is for a certain period, which allows to verify the accuracy of the data); 

ii. When the processing is illegal, but you do not want them to be deleted, but only limited; 

iii. When “CARGOFORT” no longer needs your personal data for the purposes of processing, but you require them for the establishment, exercise or protection of legal claims; 

iv. When you object to the processing and expect CARGOFORT to check whether the legal grounds for the processing take precedence over your interests. 
Right to object  You have the right at any time, on grounds related to your specific situation, to object to the processing of your personal data. This right can be exercised only for your personal data processed on the basis of the legitimate interests of “CARGOFORT”. If the objection is justified, CARGOFORT will terminate the processing, unless it is proved that there are compelling legal grounds for the processing that take precedence over your interests. 
Right to data portability  You have the right to receive your personal data in a structured, widely used and machine-readable format for transfer to another administrator. 
Right of appeal  You have the right to file a complaint to the Commission for Personal Data Protection (CPDP), the competent state body in this area. 
The right not to be the subject of profiling  You have the right not to be the subject of a decision based solely on processing by automatic means. 
Right of withdrawal of consent  You have the right to withdraw your consent at any time by sending a written notice to CARGOFORT. 
Right to compensation for damages  In the event of a breach of data protection regulations, you are entitled to compensation for damages. 

Submit a request or complaint 

You can exercise your rights by sending a written request or complaint, by letter or e-mail to CARGOFORT, at any time on grounds related to your specific case or situation, which you should indicate in the complaint. When submitting a request by e-mail, it must be submitted in accordance with the requirements of Art. 37b, para. 2 of the Personal Data Protection Act – under the terms of the Electronic Document and Electronic Certification Services Act, the Electronic Government Act and the Electronic Identification Act. 

The request or complaint should allow the identification of the data subject, and when submitting them, at least the following information must be indicated: 1) three names of the data subject; 2) PIN; 3) physical and / or e-mail address to which the subject wishes to receive a response; 4) contact telephone; 5) description of the request (in free text). At the request of the subject, additional documents may be attached to the request or complaint. 

CARGOFORT has the obligation to consider your request within two months of receiving the request. The period may be extended by another month when this is necessary due to the complexity or number of requests. 

In case the data subject does not have the right to exercise the right requested by him, within 2 months from the receipt of the request, a representative of “CARGOFORT” sends to the data subject a reasoned refusal. 

 

Terms for storage of personal data 

CARGOFORT applies the following terms for storage of personal data: 

  • 6 (six) months: personal data provided by the data subjects for the purpose of applying for recruitment notices – in case a contract has not been concluded with the respective person;
  • 1 (one) year:
  • personal data contained in working versions of documents;
  • personal data contained in reports serving the internal processes in CARGOFORT;
  • all other documents for which these Rules do not provide for a longer retention period.
  • 3 (three) years and a half, after termination of the employment contract:
  • employment records, unless there is a legal basis for further processing, such as a legal dispute;
  • 5 (five) years:
  • personal data contained in civil contracts, unless there is a legal basis for further processing, such as a legal dispute;
  • 50 (fifty) years: personal data for which there is a legal obligation to be stored for such a period, including:
  • payroll and remuneration and related information – for a period of 50 (fifty) years, as of January 1 of the reporting period following the reporting period to which they relate;
  • Until the withdrawal of the consent: all personal data provided for the purpose of communication and receipt of messages from “CARGOFORT” are kept until the moment when the subject withdraws his / her consent to receive a communication from “CARGOFORT”. The data subject may withdraw his consent at any time.

 

Protection of your data 

CARGOFORT provides and maintains appropriate technical and organizational measures to protect personal data against unauthorized access or illegal use and / or against their accidental loss, alteration, disclosure, access and / or damage or copying. These measures aim to ensure the continued protection and integrity of personal data. CARGOFORT re-evaluates the measures regularly in order to achieve permanent security of personal data. 

CARGOFORT provides physical and logical protection of personal data, as indicated below  

 

Physical protection of personal data 

CARGOFORT applies the following measures to ensure the physical protection of personal data: 

  • restricts the physical access to the premises where personal data are stored (access is carried out only by authorized representatives of “CARGOFORT” within their duties by using locks and other means of physical access);
  • applies a “clean desk” policy, according to which all documents containing personal data should be stored in locked cabinets;
  • stores its paper archive in specially equipped premises, ensuring its protection in case of fire or flood;
  • the exchange of paper documents containing personal data with persons outside “CARGOFORT” is carried out only in sealed envelopes and through the use of authorized representatives and trusted subcontractors, etc.
  • in certain cases the following may have access to personal data: members of the management bodies; providers of external services, such as: postal and accounting services, etc. All third parties that act as processors of personal data hold and use personal data on behalf of “CARGOFORT” only in order to provide us with their services;
  • CARGOFORT may disclose personal data to professional advisors and experts in order to obtain their assistance in carrying out its activities.
  • When CARGOFORT engages third parties to operate with personal data on its own behalf, this is done in writing. CARGOFORT selects processors of personal data who are able to provide sufficient guarantees regarding technical and organizational security measures. The selected processors act on behalf of “CARGOFORT” and according to its instructions, as “CARGOFORT” indicates in writing the necessary requirements for information security. 

 

Personal protection 

Prior to taking up the relevant position at CARGOFORT, the persons performing data protection and processing: 

  • Undertake an obligation not to disclose the personal data to which they have access;
  • Get acquainted with the legal framework, internal rules and policies of “CARGOFORT” for personal data protection;
  • Are instructed about the dangers of violating the security of personal data that are processed by “CARGOFORT”;
  • Undertake not to share critical information (identifiers, access passwords, etc.) with each other and with any other unauthorized persons.
  • Underwent training to respond to events that threaten the security of personal data.

Logical protection of personal data 

CARGOFORT applies the following measures to ensure logical protection of personal data: 

  • restricts the logical access to the information systems through which personal data are processed and stored (the access is carried out only by authorized representatives of “CARGOFORT”, within their obligations, by using individual usernames and passwords).
  • Use of antivirus and encryption programs.

 

This policy was adopted on 01.03.2021. 

 

Any change in the policy will be reflected in its publication on the CARGOFORT’s website.