IT Outsource Ltd.

Contacts

Privacy Policy

Information about the Personal Data Controller

IT Outsource Ltd. is a company registered in the Commercial Register of the Registry Agency of the Republic of Bulgaria with UIC (EIK): 200776949.

Contact details:

Email: info@itoutsource.bg
Phone: +359 887 940248

Legal Grounds and Purposes for Processing Your Personal Data

We process your personal data on the following legal grounds:

  • The Terms and Conditions for the use of the Website;
  • Your explicit consent – the purpose of processing is specified for each individual case;
  • Legal obligations applicable to us.

In the following sections, you will find detailed information regarding the processing of your personal data depending on the legal basis on which it is processed.

Processing Based on Contractual Obligations

We process your personal data for the purposes of using the Website in accordance with the rules set out in the Terms and Conditions.

Processing purposes (where applicable):

  1. Identification of your identity;
  2. Providing access to the functionalities of our Website.

On this legal basis, we process only personal data related to the user account created by you.

The data collected on this basis shall be deleted 2 years after the termination of the contractual relationship, regardless of whether the termination occurs due to expiration of the contract, termination, or another legal basis.

Processing Based on Your Consent

We process your personal data on this basis only after receiving your explicit, informed, and voluntary consent.

We will not impose any adverse consequences on you if you refuse to provide consent for the processing of your personal data.

Consent represents a separate legal basis for processing your personal data, and the purpose of processing is specified within the consent itself. Such processing is not covered by the purposes listed in this Privacy Policy.

If you provide the relevant consent, and until its withdrawal or termination of any contractual relationship with you, we may prepare suitable product or service offers by performing analyses based on your personal data.

Data processed on this basis:

On this legal basis, we may process personal data for direct marketing purposes, including:

  • Website usage data;
  • Data related to social media profiles.

Disclosure of data to third parties:

On this basis, we may provide your data to:

  • Marketing agencies;
  • Meta Platforms, Inc.;
  • Google LLC;
  • Other similar service providers.

Withdrawal of Consent

Any consent provided by you may be withdrawn at any time.

Withdrawal of consent shall not affect the performance of contractual obligations.

If you withdraw your consent for processing personal data for one or more of the purposes described above, we will no longer use your personal data for those purposes.

Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.

To withdraw your consent, you only need to contact us through the Website or by using our contact details.

When We Delete Data Collected Based on Consent

The data collected on this basis shall be deleted:

  • Upon your request; or
  • 12 months after the initial collection of the data.

How We Protect Your Personal Data

To ensure adequate protection of the company’s and its customers’ data, we apply all necessary organizational and technical measures required under applicable personal data protection legislation.

The company has established internal procedures aimed at preventing misuse, unauthorized access, and security breaches, supporting the protection and security of your personal data.

To ensure maximum security during the processing, transfer, and storage of your data, we may use additional protection mechanisms such as encryption, pseudonymization, and other security measures.

User Rights

Every Website user benefits from all rights for personal data protection provided under Bulgarian legislation and European Union law.

Users may exercise their rights by sending a request to our email address.

Every user has the right to:

  • Be informed regarding the processing of their personal data by the controller;
  • Access their personal data;
  • Request correction of inaccurate personal data;
  • Request deletion of personal data (“right to be forgotten”);
  • Request restriction of processing by the controller or processor;
  • Request portability of personal data between different controllers;
  • Object to the processing of their personal data;
  • Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar way;
  • Seek protection through judicial or administrative proceedings if their rights have been violated.

Right to Request Deletion of Personal Data

A user may request deletion of their personal data where one of the following conditions applies:

  • The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • The user withdraws their consent on which the processing is based and there is no other legal basis for processing;
  • The user objects to the processing and there are no overriding legitimate grounds for processing;
  • The personal data has been processed unlawfully;
  • The personal data must be deleted in order to comply with a legal obligation under European Union law or applicable national legislation;
  • The personal data has been collected in relation to information society services offered to children and consent was provided by a person holding parental responsibility.

Right to Restriction of Processing

Users have the right to request restriction of the processing of their personal data when:

  • They dispute the accuracy of their personal data. In this case, processing shall be restricted for a period allowing the controller to verify the accuracy of the data;
  • The processing is unlawful, but the user does not wish the data to be deleted and instead requests restriction of its use;
  • The controller no longer needs the personal data for processing purposes, but the user requires it for establishing, exercising, or defending legal claims;
  • The user objects to processing while verification is being carried out regarding whether the legitimate grounds of the controller override the interests, rights, and freedoms of the user.

Right to Data Portability

The data subject has the right to receive personal data concerning them which they have provided to a controller in a structured, commonly used, and machine-readable format.

The data subject also has the right to transfer this data to another controller without obstruction from the controller to whom the personal data was originally provided, where:

  • Processing is based on consent or contractual obligations; and
  • Processing is carried out by automated means.

When exercising the right to data portability, the data subject also has the right to request direct transfer of personal data from one controller to another where technically feasible.

Right to Object

Users have the right to object to the processing of their personal data.

The controller shall stop processing the personal data unless it demonstrates compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject, or where processing is necessary for the establishment, exercise, or defense of legal claims.

Where the objection concerns processing for direct marketing purposes, processing shall cease immediately.

Complaint to the Supervisory Authority

Every user has the right to submit a complaint regarding unlawful processing of their personal data to:

The Commission for Personal Data Protection of the Republic of Bulgaria or to the competent court.