Date of last update: 15.11.2023

1.       What is the purpose of this policy?

Bulgarian-American Commission for Educational Exchange “Fulbright Bulgaria”, established by PMS No 255 of 29.12.1993, BULSTAT 831485755, with address. 1000 Sofia Blvd. “Vitosha 12, floor 5, represented by Angela Rodel – Executive Director (“the Commission” or “Fulbright”), as the contracting authority for civil service contracts (contracts for work under an outside employment relationship), is obliged to process certain categories of personal data of the contractors under these contracts in order to comply with its legal and contractual obligations and to carry out its activities lawfully, fairly and efficiently. If you have any questions about how the Commission processes your personal data or about the interpretation of any of the terms used herein, please contact us at the following contact details:

The purpose of this policy is to inform civil contractors about the categories of personal data processed for them, the purposes and means of processing, the rights and obligations of the Commission and civil contractors in relation to the processing of that data, and other processing parameters. Please note that without certain personal data that the Commission obtains from you when entering into the contract or data that may be required in the course of its performance, the Commission will not be able to fulfil its obligations under the contract as well as under applicable laws, including the Law on Obligations and Contracts, tax and social security legislation, and other legal requirements that apply to the Commission. It is your responsibility to provide such data and to inform us of any changes to it.

2.       What is “personal data”?

The term “personal data” as used in this Policy means any information that, alone or in combination with other information, can be used to identify you, as well as other data that qualifies as personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the Personal Data Protection Law of the Republic of Bulgaria (“Personal Data Protection Laws”). This policy covers all personal data about you as a contractor under a civil contract that is processed in any form by the Commission.

3.       What personal data do we process about you?

The Commission processes the following personal data and categories of personal data:

(a) physical identity (three names, PIN or other personal identifier);

  1. b) contact details, including home/residential address, telephone number, email address;
  2. c) tax and social security information;
  3. d) bank account number and other details;
  4. e) other data required under the applicable legislation – Social Security Code, Law on Obligations and Contracts, Law on Personal Income Tax, Law on Accounting, etc.;


In cases where health data is processed as a special category of personal data, it shall be processed only for the purposes of complying with social security and tax legislation and in accordance with the requirements of the Personal Data Protection Laws.

4.       For what purposes do we process your personal data?

The personal data of individuals employed under civil contracts at the Commission are processed for the following purposes:

(a) for all activities relating to the conclusion, performance, amendment and termination of the civil contract to which the natural person to whom the data relates is a party, for the production of any documents of the persons in connection with the civil relationship (contracts, supplementary agreements, documents certifying the person’s social security status, service notes, reports, certificates and the like), as well as for actions preceding and conditioning the conclusion of such contract;

(b) for the keeping of accounting records, including those relating to remuneration;

(c) to communicate with the persons, sending correspondence relating to the performance of the contracts concluded;

(d) to use data collected or created in the course of the performance of the civil relationship for other official purposes;

5.       On what basis do we process your personal data?

We process personal data on the following grounds:

(a) the conclusion of a civil contract with the Commission to which you are a party, including actions preceding and conditioning the conclusion of such a contract and undertaken at your request;

  1. b) the fulfilment of a legal requirement applicable to the Commission;
  2. c) the exercise of the Commission’s rights and interests which reasonably override the interests of individuals.

6.       With whom do we share your personal data?

Personal data collected and otherwise processed by the Commission may be provided to the following categories of recipients:

(a) public authorities, institutions and persons to whom the Commission is obliged to provide personal data under an applicable provision of law;

(b) partners and contractors with whom the Commission interacts in connection with its activities;

(b) service providers who assist the Commission in carrying out its activities and/or in the performance of its legal and contractual obligations. Such suppliers include (without limitation) accounting and auditing firms, travel agencies and tour operators, banks, trainers, etc.  Only such personal data will be disclosed to these categories of recipients as is necessary to fulfil the purposes for which the data were collected. All third party recipients of the data are legally or contractually obliged to comply with applicable data protection legislation.

The transfer of your personal data will mainly take place to countries within the European Union or that provide an adequate level of protection. In the event that your personal data is transferred to a country that offers a lower level of protection of personal data than the protection guaranteed by the mandatory provisions of the GDPR, then the Commission will, in accordance with the mandatory requirements for transfers to third countries, take all necessary measures to ensure that your data is protected from data recipients in those countries. Protection usually means imposing on the receiving country contractual obligations that ensure that that country maintains the same high level of data privacy and protection as is maintained by the Commission.

7.       What are your rights?

You have certain rights when it comes to your personal data. These rights are summarised below. Please note that these rights may be limited (taking into account your fundamental rights and legitimate interests) in cases provided for by law, for example where information about you is used in legal or administrative proceedings. Please contact us if you have any questions about your rights and how you can exercise them.

Right of access and right of rectification

You have the right to obtain information about what personal data relating to you is being processed by the Commission, the origin of the data, the purposes for which the data has been used, the recipients or categories of recipients of that data, and other aspects of the processing of your data. You also have the right to request rectification of inaccurate or incomplete personal data at any time.

Right to erasure of data (right to be forgotten)

You may request that your personal data be erased in the following specific circumstances: (i) you consider that the personal data are no longer necessary for the purposes for which they were collected, (ii) you have withdrawn the consent to the processing on which the processing of your data is based and you consider that the Commission has no other legal basis for continuing the processing, (iii) you consider that the processing is unlawful, or (iv) your personal data must be erased in order to comply with a legal obligation to which the Commission is subject.

Right to object

You have the right to object to the processing of your personal data for certain purposes. Please note that even if you object to us processing your personal data in a particular way, we may continue to process it where this is permitted or required by law, for example to comply with a legal requirement applicable to the Commission, administer the employment relationship, perform an obligation under an employment contract or other agreement with you.

Right to restrict processing

You may request that the processing of personal data be restricted if (i) you believe that your personal data is inaccurate for us to verify its accuracy, or (ii) you believe that the processing is unlawful but you do not want the data to be erased, or (iii) you have objected to the processing for the purposes of our legitimate interests, or (iv) you believe that we no longer need your personal data but you require it to establish, exercise or defend legal claims. The Commission will restrict the processing of your personal data without erasing it where the accuracy of the personal data is contested by you and this cannot be verified, or where the retention of your personal data is necessary for evidentiary purposes.

Right to withdraw consent

If at any time you have provided your consent to the processing of your personal data for certain purposes, you can always withdraw that consent for future processing. Please note that withdrawal of consent does not affect the lawfulness of the processing of your personal data on any other valid legal basis, nor the lawfulness of processing based on consent given before it was withdrawn, i.e. withdrawal of consent applies prospectively and cannot have retroactive effect. The processing activities undertaken by the Commission in accordance with the consent previously given are lawful as it had a valid legal basis for processing your data.

Right to data portability

In certain cases, you have the right to receive your personal data that you have provided to us on the basis of a contract or with your explicit consent, in a structured, commonly used and machine-readable format, and possibly to request that we transfer that data directly to another controller where this is technically feasible.

8.       How can you exercise your rights as a data subject?

If you wish to exercise any of the above rights, you should submit a written request to the contact details above. Please note that we will contact you and ask you to confirm your identity to ensure that we do not disclose your personal data to an unauthorised person, and we may ask you to specify your request before we take action. Once we have confirmed your identity, we will consider your request in relation to your personal data in accordance with applicable law.

The Commission may refuse to comply with your request to exercise rights where it is unfounded and where it is necessary for reasons of important public interest or in order to protect the rights and freedoms of others. In any event, you will be promptly and duly informed of the decision and the reasons for it in respect of any request for the exercise of rights made by you.

9.       What should you do if you believe that your rights as a data subject have been violated?

If you believe that your right to the protection of your personal data has been violated, you may file a complaint with the Commission for Personal Data Protection, address. You may file a complaint with the Personal Data Protection Board, 1592 Sofia Blvd. “1595 Prof., website: You can also take your claims to the competent court.

In order to achieve an effective and quick resolution of the matter, we advise you to first address your claim to us before addressing it to the competent authorities.

10.    How long do we keep your personal data?

The personal data of persons under civil contracts, for which a longer retention period is not required by law, will be kept for a period of 3 or 5 years ( depending on the categories of data) from the date on which the basis for their processing ceases to exist. The period shall be determined by the expiry of the limitation period for bringing claims against the Commission.

11.    Other

In order to ensure compliance with data protection legislation, the Commission may amend this policy at any time, which we will inform you of in a timely and appropriate manner.

Please notify the Commission’s Finance Department of any changes to your personal data so that we can keep it accurate and up to date and adequately protect it.

If we intend to use your personal data for other purposes not set out in this policy, we will provide you with a new data protection notice and, if necessary, seek your prior consent to the new processing.

Skip to content