Privacy Policy

2.1. Your personal data is processed in accordance with our legal obligation – Art. 6(1)(c) of Regulation (EU) 2016/679.

Various regulatory obligations apply to us, assigned to us by a statutory act in force in the Republic of Bulgaria and/or in the EU, including, but not limited to: BNB Ordinance No. 22; the Measures Against Money Laundering Act, the Measures Against the Financing of Terrorism Act, the Tax and Social Security Procedure Code, the Accountancy Act, the Obligations and Contracts Act, the Civil Procedure Code, the Administrative Procedure Code; fulfilment of legal obligations to state authorities.
Any fulfilment of our legal obligation that is not specified in this Information shall not constitute non-fulfilment of our obligations under the stated purposes.

2.2. Pursuit of our legitimate interest – Art. 6(1)(f) of Regulation (EU) 2016/679 – the controller’s legitimate interest in managing and collecting acquired receivables until their repayment.

In order to manage your obligation, we create a customer record in our system that consolidates information about you. If you have more than one obligation, the data is consolidated into a single profile. This ensures the accuracy, consistency and up-to-date nature of the information about you.

In the course of communication, we may offer you individual solutions for voluntary repayment tailored to your capabilities.

Maintaining up-to-date contact details allows us to communicate with you by phone, email or post regarding the status of the obligation, the amounts due and payment deadlines. We periodically check data in public registers to ensure that the information is correct and up to date.

If we are unable to contact you, we may seek assistance from third parties specified in your agreement (e.g. a co-debtor or guarantor). They receive only a message asking you to contact us, without access to your personal data.

Where we base processing activities on legitimate interest, we balance this interest against your interests or fundamental rights and freedoms in order to ensure that there is a fair balance between them.

2.3. Your personal data is processed if you have given your consent

Additional consent may be requested from you for the processing of your personal data where necessary. In such cases, we will provide you with specific information and request your consent. You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

We process only your personal data that is necessary for the management and collection of acquired receivables:

• Identification information: full name, gender, place and date of birth, nationality, identity document number, signature;
• Contact information: address, email address, telephone number;
• Information on the acquired receivable (loan/s): number, amount, maturity date, payments, overdue amount, accrued amounts;
• Data from judicial and enforcement proceedings;
• Identity data for checks under the Measures Against Money Laundering Act;
• Data collected from our interactions with you: for example, your comments, suggestions and needs collected during exchanges with you in person or during telephone communication (conversation), email discussions, and your latest complaints.

We may collect sensitive data, such as data concerning health, in compliance with the strict conditions, provided by you in connection with a credit agreement with the original creditor, as well as in the event that you provide such information directly to us in connection with the collection of your obligation.

Your personal data has been collected from third parties in the acquisition, administration and collection of receivables under credit agreements acquired through assignment — the original creditor from whom the Company acquired the receivables under an assignment agreement, as well as from public registers and sources. In cases where the receivable has been acquired with an enforcement title, the data has been collected from the relevant court and/or state/private enforcement agent.

In fulfilment of the purposes described in this Information, we may, where necessary, disclose your personal data to the following categories of recipients:

• Data processors – third parties that provide services on our behalf and under our instructions, for example: providers of IT and hosting services, software and telephony support; courier and postal operators that deliver documents and notices; providers of consulting, accounting, logistics, printing and telecommunication services.
  All such processors act on the basis of written agreements pursuant to Regulation (EU) 2016/679 and are obliged to ensure the protection and confidentiality of personal data in accordance with our instructions and the applicable legislation.
• Banks and payment service providers – where payments related to your obligation are made, or where it is necessary to confirm transactions and received funds.
• The assignor (the previous creditor) – in cases where it is necessary to return a transferred receivable or clarify circumstances that have arisen after the transfer of the obligation.
• Competent authorities and institutions – courts, private enforcement agents, notaries, ministries, the prosecutor’s office, the police, the Bulgarian National Bank (including the Central Credit Register), the National Revenue Agency, the State Agency for National Security, the Commission for Anti-Corruption and Forfeiture of Illegally Acquired Assets and other state authorities, where required by law.
• Regulated professions and partners – lawyers, notaries, auditors, as well as our insurers, where necessary in connection with court proceedings, audits, inspections or the protection of our legitimate interests.

Your personal data is processed and stored only within the European Union. If data transfer outside the EU becomes necessary, it will be carried out only where appropriate safeguards are in place, such as standard contractual clauses or other mechanisms approved by the European Commission.

Your personal data is stored for the duration of the existence of the receivable and until the expiry of the periods for the protection of legal claims, as well as the periods provided for in accounting and tax legislation. The duration of storage is determined in accordance with the purposes of processing and the statutory requirements that we are obliged to comply with.

After final repayment of the obligation, the data is processed solely for the purposes of its storage for a period of up to 5 years, on the basis of the Company’s legitimate interest – to comply with statutory obligations and to protect against possible future claims. This period derives from BNB Ordinance No. 22, the Accountancy Act, the Tax and Social Security Procedure Code and the Obligations and Contracts Act.

After the expiry of the respective periods, the data is deleted or anonymized, unless the law provides for a longer retention period.

In certain cases, we may be more specific and inform you that:

• We store your personal data for a period of up to 5 years after final repayment of the obligation or, where we protect our legal and/or legitimate interests, until such protection is achieved, unless we have a ground or obligation to store it for a longer period.
• Personal data for which there is no legal basis for storage for a longer period will be deleted after the purposes for which it was collected and processed have been achieved.

We are committed to reviewing any right you exercise, as expressly specified for all data subjects whose data we process, in Section V of this Information.

We would like to inform you that the provision of personal data during the preparation and/or conclusion of an agreement with us is voluntary, but also a necessary prerequisite. If you do not provide it, we will not be able to conclude an agreement with you.

Where relationships with you have already been established, the provision of personal data may be in fulfilment of our contractual and/or legal obligation. Failure to provide the data in such cases may lead to the termination of agreement(s) concluded between us.

This information applies to natural persons or representatives of legal entities whose personal data is processed by the Company in connection with preparations for, or in connection with, contractual relationships established with us.

This Information on the Processing of Personal Data applies to you if you are:

1.1. in a contractual relationship with us as a counterparty;
1.2. taking steps at your request prior to entering into an agreement with us;
1.3. when you or a person represented by you contact us because you have submitted a request, proposal, inquiry or complaint to us, without being a party to an agreement concluded with us;
1.4. a representative (legal or by virtue of authorization) of a party to an agreement concluded with us;
1.5. a person about whom we have received an inquiry and/or instruction concerning you or a person represented by you, sent by a state authority/institution or a person performing public functions, such as a private/state enforcement agent;
1.6. a visitor to our office where an access regime, access control system and/or video surveillance system has been established;

When you provide us with personal data relating to other people, please make sure that you have informed them about the disclosure of their personal data and invite them to read this Information on the Processing of Personal Data.

2.1. Your personal data is processed in accordance with our legal obligation.

Various regulatory obligations apply to us, assigned to us by a statutory act in force in the Republic of Bulgaria and/or in the EU, including, but not limited to:

2.1.1. fulfilment of statutory obligations (for example, but not limited to, general and special accounting and tax provisions to which we are subject);
2.1.2. preparation, conclusion and performance of an agreement, payments, security agreements and mandatory entries in public registers, including obligations regarding the storage of information related to the stated circumstances;
2.1.3. establishing your identity as our client and the authenticity of your personal data through: collection, use and storage of personal data, including documents and information records certifying identity, in order to take steps towards the performance of an agreement with us;
2.1.4. identification under the Measures Against Money Laundering Act / Measures Against the Financing of Terrorism Act (if applicable to the specific transaction);
2.1.5. reporting to state and supervisory authorities – your personal data will be processed for accounting and tax purposes in fulfilment of reporting requirements to the competent authorities on the basis of obligations arising from the law;
2.1.6. exchanging and reporting various operations, transactions or responding to an official inquiry from duly authorized local or foreign financial, tax, administrative, criminal or judicial authorities, arbitrators or mediators, law enforcement authorities, government agencies or public authorities at your request/complaint or at the request/complaint of an authorized state/public/judicial authority;
2.1.7. complying with the provisions applicable to trust service providers issuing electronic signature certificates;
2.1.8. recording transactions for accounting purposes.

Any fulfilment of our legal obligation that is not specified in this Information shall not constitute non-fulfilment of our obligations under the stated purposes.

2.2. Your personal data is processed for the performance of an agreement to which you are a party, or in order for us to take steps at your request regarding a service offered by us before entering into an agreement.

Your personal data is processed where it is necessary for us to conclude or perform an agreement with you for:

2.2.1. managing the performance of an agreement with counterparties;
2.2.2. contacting you or third parties whose data you have provided to us or which we have received when concluding an agreement with us;
2.2.3. responding to your questions and assisting you by providing the necessary information, including regarding agreements concluded with us and their performance;
2.2.4. managing the services offered by us;
2.2.5. maintaining the up-to-date nature of records on electronic, paper or other media;
2.2.6. transferring our rights to a third party;
2.2.7. sending notices/statements to the provided addresses related to an agreement concluded with us;
2.2.8. ensuring network, information and physical security, including preventing unauthorized access to electronic communications networks, IT management, infrastructure management (e.g. shared platforms) and business continuity.

2.3. Pursuit of our legitimate interest

Where we base processing activities on legitimate interest, we balance this interest against your interests or fundamental rights and freedoms in order to ensure that there is a fair balance between them.

In connection with our activities, we use your data to:

2.3.1. manage the risks to which we are exposed by storing evidence of operations or transactions, including evidence in electronic format; develop individual statistical models for the management of our platforms and websites and ensure business continuity;
2.3.2. establish, exercise or defend legal claims or whenever courts act in their judicial capacity;
2.3.3. transfer receivables and obligations pursuant to the Obligations and Contracts Act and process your personal data by any new controller;
2.3.4. use video surveillance to prevent bodily injury and personal or property damage, and to conduct disciplinary proceedings by the Employer;
2.3.5. improve the automation and efficiency of our operational processes, conduct statistical studies and develop predictive and descriptive models for security reasons: preventing potential incidents and improving security management;
2.3.6. use information about you, but only in a way that would not allow you or another person to be identified, for research, including sharing the information with third parties, such as partners, for historical and marketing purposes;
2.3.7. protect against / bring legal claims.

2.4. Your personal data is processed if you have given your consent

Additional consent may be requested from you for the processing of your personal data where necessary. For certain processing of personal data, we will provide you with specific information and request your consent. You may withdraw your consent at any time.

We process only your personal data that is necessary for the management and performance of contracts with you:

• Identification information: names, Personal Identification Number, identity document number (if necessary), data on representative authority, signature;
• Contact information: data from the contracts for communication purposes;
• Information on the acquired receivable(s) (loan(s)): number, amount, due date, payments, overdue amounts, accruals;
• Financial information: bank account for payments under the contract;
• Information (data) under the Measures Against Money Laundering Act / Measures Against the Financing of Terrorism Act (where applicable).

The data in these categories has been obtained directly from you, from third parties – co-contractors, or collected from publicly accessible sources (Commercial Register).

Disclosure of personal data to third parties

For the purposes described in this Information Notice, we may, where necessary, disclose your personal data to the following categories of recipients:

• Data processors – third parties that provide services on our behalf and under our instructions, for example: providers of IT and hosting services, software and telephony support; courier and postal operators that deliver documents and notices; providers of consulting, accounting, logistics, printing and telecommunications services.
  All such processors act on the basis of written contracts, in accordance with Regulation (EU) 2016/679, and are obliged to ensure the protection and confidentiality of personal data in accordance with our instructions and applicable law.
• Banks and payment service providers – where payments related to our contractual relationship are made.
• Competent authorities and institutions – courts, private enforcement agents, notaries, ministries, the prosecutor’s office, the police, the National Revenue Agency, the State Agency for National Security, the Commission for Anti-Corruption and the Forfeiture of Illegally Acquired Assets, and other state authorities, where required by law.
• Regulated professions and partners – lawyers, notaries, auditors, as well as our insurers, where this is necessary in connection with court proceedings, audits, inspections or the protection of our legitimate interests.

Your personal data is processed and stored only within the European Union. If it becomes necessary to transfer data outside the EU, this will be carried out only where appropriate safeguards for protection are in place, such as standard contractual clauses or other mechanisms approved by the European Commission.

Your personal data is stored for the duration of the existence of the receivable and until the expiry of the periods for protection against/bringing legal claims, as well as the periods provided for in accounting and tax legislation. The storage period is determined in accordance with the purposes of processing and the regulatory requirements with which we are obliged to comply.

After the expiry of the relevant periods, the data is deleted or anonymised, unless the law provides for a longer storage period.

In certain cases, we may be more specific and inform you that:

• We store your personal data for a period of up to 5 years after the termination of our contractual relationship or, where we protect our lawful and/or legitimate interests, until such protection is realised, unless we have grounds or an obligation to store it for a longer period, such as 10 years under the Accountancy Act.
• Personal data for which there is no legal basis for storage for a longer period will be deleted after the purposes for which it was collected and processed have been achieved.