PERSONAL DATA PROTECTION POLICY OF NATSIONALNA ELEKTRICHESKA KOMPANIA EAD

1. Natsionalna Elektricheska Kompania EAD (NEK EAD) respects the privacy of natural persons based on the understanding that the right to protection of personal data is a fundamental human right. In light of this, NEK EAD takes the necessary measures to ensure the confidentiality of personal data, compliance with the applicable principles relating to processing of such data and procures the application of appropriate measures with respect to the security of personal data in accordance with the principle of proportionality and the level of technological developments.

2. NEK EAD, having been established in the territory of the Republic of Bulgaria, is a personal data controller within the meaning of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural person with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data protection Regulation) and national legislation of the Republic of Bulgaria in the field of personal data protection. NEK EAD is a commercial company incorporated and existing under the laws of the Republic of Bulgaria, entered in the Commercial Register to the registry Agency. You can contact NEK EAD at/by:

3. NEK EAD has designated a data protection officer who can be contacted for any queries you may have concerning processing of your personal data at/by:

4. NEK EAD processes personal data concerning the following persons:

In addition to data about its employees, NEK EAD can process personal data relating to contracting parties/ authorized representatives of contracting parties to NEK EAD, including contractors under public procurement contracts; representing participants/candidates in procedures under the Public Procurement Act ("PPA"); complainants who has submitted a request / claim / complaint / notice to NEK EAD; visitors to the holiday homes owned by NEK EAD or visitors to the Internet pages of NEK EAD, including those of Hydropower Plants Enterprise and Dams & Cascades Enterprise.

5 . NEK EAD shall process the following data based on the purposes, legal basis and processing time-limits as specified below:

5 .1. In case that you are contracting parties, respectively authorized representatives of contracting parties to NEK EAD, НЕК ЕАД shall process the following categories of personal data:

• Data: names; UIC number or personal ID number for foreign nationals; address; telephone number; email address; data of your authorized representative; bank account number; data needed by NEK EAD as sector contracting authority under the Public Procurement ACT (PPA) such as criminal record and data required under the Law on Measures against Money Laundering, and the like, if required;
• Purpose: performance under contractual relationship (contract execution, implementation, amendment, termination); protection of the legitimate interests of the parties to the contract; exchange of correspondence; compliance with the legal obligations of NEK EAD as contracting authority under the PPA;
• Legal basis: performance of a contract;
• Storage period: in general, the period shall be the duration of the contract plus 5 or 3 years depending on the applicable limitation period under the Obligations and Contracts Act (OCA) Art. 110 or Art. 111, as well as until final settlement of the financial obligations between the parties, and according to Art. 122 (1) of the PPA concerning public procurement contracts.

5 .2. In case that you are candidates / participants in public procurement procedures, NEK EAD shall process the following categories of personal data:

• Data: names; UIC or personal ID number for foreign nationals; ID document data; date of birth; address; telephone number; email address; education/ qualification;
• Purpose: compliance with legal obligations in the field of public procurement; carrying out a procedure for selection of a contractor and entering into a procurement contract under the PPA by using established standard forms, including the standard form for the European Single Procurement Document;
• Basis: compliance with a legal obligation;
• Storage period: pursuant to Art. 122 (1) of the PPA with reference to Art. 121 of the PPA.

5 .3. In case that you have made a reservation in a holiday home of NEK EAD and you are staying thereat, NEK EAD shall process the following categories of personal data:

• Data: names; UIC or personal ID number for foreign nationals; address; identity card data; marital status; telephone number and/or email address for contact with you; bank account.
• Purpose: compliance with legislation in the field of accommodation in holiday homes and recreational facilities; for the purpose of reservations and confirmation of reservations and charging of service costs;
• Basis: compliance with a legal obligation under Art. 116 of the Tourism Act; Art. 61q of the Local Taxes and Fees Act and Art. 18 and Art. 28 of the Law on Aliens in the Republic of Bulgaria, as well as performance of a contract;
• Storage period: NEK EAD shall process personal data of visitors staying at the holiday homes according to the register details as required under Art. 116 of the Tourism Act until filing of a tax return under Art. 61q of the LTFA; personally filled out registration cards of Bulgarian nationals shall be destroyed not later than two days following the date of check out, and those for foreign nationals – shall be submitted to the competent authorities, according to Art. 28 (4) of the LARB. Personal data for the purposes of making and confirming reservations shall be processed until the moment of accommodation.

5 .4. In case that you have lodged a request / claim / complaint / notice to NEK EAD, NEK EAD can process the following categories of personal data:

• Data: names; UIC or personal ID number for foreign nationals; ID document data; address; email address; signature, and the like, provided at the option of the data subject;
• Purpose: protection of the legitimate interests of NEK EAD and exchange of correspondence, please note that NEK EAD does not provide administrative services;
• Basis: legitimate interests of NEK EAD where the data subject has on his/her own initiative approached NEK EAD and provided such personal data;
• Storage period: 1 year as from closure of the correspondence with the claimant of the request/ claim/ complaint, registered in the documents filing system of NEK EAD.

5 .5. For visitors to this site as well as the sites www.dams.nek.bg and www.vec.nek.bg , NEK EAD shall process the following categories of personal data:

• Data: log files containing your IP address; the browser you use (Mozilla Firefox, IE, Google Chrome and the like); operating system (Windows, Linux, IOS); time and pages you have visited on the sites of NEK EAD;
• Purpose: access control to prevent unauthorized operations during access to the internet page of www.nek.bg, including the internet pages of enterprises www.dams.nek.bg ; www.vec.nek.bg and ensuring smooth and continuous availability of the sites;
• Basis: protection of the legitimate interests of NEK EAD;
• Storage period: up to 10 days from creation.

6.  Data Recipients

NEK EAD shall not disclose your personal data to third parties, unless such disclosure is required for performance of a legal obligation or of a contract, as well as to competent authorities that by virtue of a regulatory document have the authority to require from NEK EAD to disclose information, including information containing personal data.

7. Your rights pertaining to the processing of personal data by NEK EAD

• Right to information, according to paragraphs 58, 60-62 of the Whereas clauses and Articles 12-14 of the General Data Protection Regulation;
• Right to access, according to paragraph 63 of the Whereas clauses and Articles 12 and 15 of the General Data Protection Regulation;
• Right to transmit personal data to another controller (Right to data portability), according to paragraph 68 of the Whereas clauses and Articles 12 and 20 of the General Data Protection Regulation;
• Right to rectification, according to Articles 5, 12, 16 and 19 of the General Data Protection Regulation;
• Right to erasure (‘right to be forgotten’) according to paragraphs 65 and 66 of the Whereas clauses and Articles 6, 9, 12 and 17 of the General Data Protection Regulation;
• Right to restriction of processing, according to paragraph 67 of the Whereas clauses and Articles 18 and 19 of the General Data Protection Regulation;
• Right to object, according to paragraphs 69 and 70 of the Whereas clauses and Articles 12 and 21 of the General Data Protection Regulation;
• Right to lodge a complaint against processing with a supervisory authority; whereas for Bulgaria the competent authority is the Commission for Personal Data Protection, address: 2, Prof. Tsvetan Lazarov Blvd., Sofia 1592, Internet page www.cpdp.bg ; email: This email address is being protected from spambots. You need JavaScript enabled to view it.; Information and communication center - Tel. 02/91-53-518.

In the light of the above, on the page www.nek.bg you can find and use an application form Request for exercising rights by data subjects.

8. Cookies Policy

8 .1. What are cookies and why do we use them?

Cookies are small text files for temporary storage of information concerning user’s operations, user’s preferences or any other activity when a user visits a website. They are stored on the user’s computer or mobile devices for a certain period of time, depending on their type.

That way, a user does not have to re-enter his/her preferences every time the user visits the site or browses around the site.

Cookies allow the website to function properly, maintain a secure session for the user, during his/her visit, and determine how we can improve the service we provide to all our users.

8 .2. Types of cookies

The site www.nek.bg, and the internet pages of the enterprises www.dams.nek.bg ; www.vec.nek.bg use the following type of cookies for technical reasons:

8.2.1. Operational cookies

There are some cookies that we have to include in order for the site to function and not to be at risk.

These are cookies that maintain a secure session for the user and protect against external interferences.

This type of cookies is defined as temporary or session cookies, which are deleted when the user quits the browser.

8 .3. Blocking cookies

You as user can control the use of site-specific cookies, delete all cookies that are already on your device and prevent any cookies being placed on your device. For details about different browsers and operating system, see http://www.aboutcookies.org/.