General Data Protection Regulation / GDPR — Privacy Notice
This document aims to inform our clients and contractors – individuals about how we, "A&D Brokers" EOOD, collect, use or share the personal data that you provide to us, or that we have otherwise received or created and that is related to you, in carrying out our activities. It is advisable that you take the time to familiarize yourself with this Privacy Notice.
When you contact us to assign us insurance brokerage (to assist you in obtaining an offer from insurers for insurance of interest to you, to conclude insurance through us, to submit a damage notification, to renew insurance, etc.), or when we assign you to perform a delivery or service, you provide us with certain information about yourself – such as names, personal identification number, address, etc. According to the legislation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("Regulation"), the Personal Data Protection Act ("PDPA") and Ordinance No. 1 of 30 January 2013 on the minimum level of technical and organizational measures and the admissible type of protection of personal data ("Ordinance No. 1")), this information about you constitutes your personal data, and you are their subject. In turn, we are the controller of your personal data. The data that identify us as the controller and the ways to contact us are specified at the end of this document.
In order to carry out our business and provide you with our services in the best possible way, we collect personal data. We may collect personal data in the process of monitoring our technological means and services, including email communication sent to and from us or by using technologies called "cookies". Otherwise, we collect and process information about you, whom you provide to us or interact with us directly. We may use your personal data for the following purposes:
We process your personal data based on:
The personal data that we ask you to provide to us, as clients or business partners, are defined in the applicable regulations and our contracts with the insurance companies whose products we offer.
In carrying out our activities, we need to share your personal data with some of the following persons:
We do not transfer your personal data to other persons in another Member State or third country or to international organizations.
We have an internal policy that determines how long we store your personal data. It is built on the basis of
In principle, we store your personal data for as long as is necessary to carry out our business and to fulfill our obligations under the law. This means that we store your personal data for the entire duration of our contractual relationship with you and 5 (five) years after the expiration of your last insurance contract concluded with our mediation.
We use a variety of procedures and technologies to protect the personal data you provide to us from unauthorized access, use or disclosure. We require our suppliers and partners who have access to your personal data to use appropriate measures to ensure the protection and confidentiality of your personal data. Unfortunately, the transmission of information over the Internet or by telephone may not be completely secure despite the measures we have taken. Any transmission of personal data is at your own risk.
In relation to your personal data, you have certain rights against us that are granted to you by law. Sometimes certain rights may arise and be exercised only under certain grounds for processing your personal data; others are subject to certain limitations and exceptions by law. If you do not understand how we process your personal data or have any questions, please contact our Company Data Protection Officer.
In accordance with applicable law, you have the following rights:
Where the processing is based on your consent, you have the right to withdraw your consent to the processing of your personal data at any time, without affecting the lawfulness of the processing based on your consent before it was withdrawn.
To exercise your rights, you can write to us by e-mail at dpo@aanddbrokers.com; or send us your request by post to the following address: Sofia-1404, 49B, Bulgaria Blvd., 4th floor, office 7.
If you wish, we will provide you with access to the personal data that are being processed in the form of a copy. If you have submitted the request by electronic means, we will, if possible, provide you with the information in a widely used electronic form, unless you have requested otherwise from us.
If we do not process your personal data, we will notify you of this. If we reject your request for a copy of the data, we will provide you with the reasons for this decision. The exercise of your right of access should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property, in particular copyright for the protection of software. If we consider that there is reason to expect such a negative impact, we may, on a motivated basis, limit some of the information we will provide to you so that it does not occur. If we process a large amount of information about you, we may ask you to specify the information or processing activities to which your request relates. This will help us to orient ourselves better and faster, and you yourself to receive the data you need sooner. Under applicable law, we have the right to continue processing, despite your request for erasure, in order to comply with legal obligations under Bulgarian or European Union law that require processing or where it is necessary for the establishment, exercise or defence of legal claims.
In order to exercise the right to restriction of processing, the following conditions must be met:
Where the processing of your personal data has been restricted, we may still continue to process it in two cases:
The right to portability exists and can only be exercised where the following two conditions are met: (1) the processing is carried out by automated means (i.e. this right does not apply to the processing of data in the form of paper files) and (2) in addition to being carried out by automated means the processing of your personal data is based on (a) your consent or (b) a contract to which you are a party or to take steps at your request prior to entering into a contract.
You should be aware that when you exercise the right to data portability, this does not result in the deletion of your data from our systems. You will be able to continue to use our services even after the data portability operation. Data portability also does not affect the initial retention period that applies to the data transmitted. You can exercise your other rights, which are specified in the legislation and which we have listed here, while we continue to process the data.
If you have objected to the processing of your personal data based on our legitimate interest or the legitimate interest of a third party or profiling, we may continue the processing despite your objection if we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
If data concerning you are used for direct marketing purposes, you have the right to object free of charge and at any time to the processing of your personal data for such marketing, which includes profiling to the extent that it is related to direct marketing, and we will cease the processing.
In what form will we respond to you? In the form in which you sent us your request – in writing on paper or in electronic form. Where you have submitted a request by electronic means, the information will be provided to you in a widely used electronic form, if possible, unless you have requested otherwise.
How long will you receive a response? Within one month of receiving your request, we will provide you with information on the actions we have taken on it. If necessary, this period may be extended by a further two months, taking into account the complexity and number of requests. If such an extension is necessary, we will notify you within one month of submitting your request, explaining the reasons for this extension.
What if we do not respond to you? If we do not take action on your request, we will inform you without delay and at the latest within one month of receiving the request, of: the reasons for not taking action, of the possibility of filing a complaint with a supervisory authority (the supervisory authority for personal data protection in Bulgaria is the Personal Data Protection Commission, with address 2 Tsvetan Lazarov Blvd., Sofia, PO Box 1592), and of seeking judicial protection.
(1) Where a citizen makes requests to us that are manifestly unfounded or excessive, in particular because of their repetition, we have the right either:
(2) Where we have reasonable concerns regarding the identity of the individual submitting the request to us, we may request the provision of additional information necessary to confirm the identity of the data subject. If we do not receive such information and are unable to identify the data subject, we may refuse to take action on the basis of a request made to us to exercise any of the rights specified in this document.
Personal Data Administrator A&D Brokers EOOD, UIC 130277837, with registered office and registered address at 49B, Bulgaria Blvd., 4th floor, office 7, Sofia-1404. Please direct any questions, comments or requests in relation to this Privacy Notice to the address specified above or to the email address dpo@aanddbrokers.com.
