Fulbright Bulgaria Privacy Statement
Our commitment to your privacy
We, the Bulgarian-American Commission for Educational Exchange (the “Commission” or “Fulbright”) acting as personal data controller in the meaning of EU’s General Data Protection Regulation (EU Regulation 2016/679) (“GDPR”), are committed to protecting and respecting your privacy.
Please read the following statement carefully as it details the way in which we process your personal data. Please note that the types of data that we process and how they are handled, as outlined below, may vary both from program to program and by your role as an applicant, participant or alumnus of a particular program.
Types of personal data we process
Throughout the lifecycle of a particular program, and depending on your status as an applicant, participant or alumnus, we may process the following types of information:
- Identifying contact informationsuch as your contact details, age, gender, marital status, user-name, government issued identification (passport/ID) and picture;
- Academic and professional informationsuch as your academic history, job titles, work and employment history, school attended, evaluations, professional references, interviews and certifications;
- Family informationsuch as your family structure;
- Information about your personal historysuch as your travel history and other events in your life;
- Information about your preferences, your opinions, intentions and interests.
- Financial information such as your bank account;
- Photographs or recordings of you during your participation in a program or from one of our program dedicated events;
- Information related to dependants accompanying you on your program, including minors;
In addition, we may process data that is generally considered sensitive in nature and that you may choose voluntarily to provide as part of the Award Selection Process. This sensitive personal data may include the following (the “Volunteered Sensitive Personal Data“):
- Information concerning your health;
- Information about your political views;
- Information about your sexual orientation;
- Data revealing racial or ethnic origin;
- Political, religious or philosophical beliefs;
- Information relating to criminal convictions and offences or related security measures;
- Trade union membership
The most common scenarios of processing special categories of personal data are when we need to determine your eligibility or additional accommodations to participate in a program; when we are required to run a background check; we are required to process certain information for visa sponsorship. In most cases, we only process special categories of personal data when it is necessary and required for the purposes listed in the “Purposes of processing” section below or if you voluntarily provide it to us, such as referring to religious or political views in an application essay.
Purposes of processing
The Commission may carry out the following processes as part of the management of a program:
- Application/Selection (Collecting and reviewing applications for the purpose of selecting potential program participants and/or notifying them of their selection for a program).
- Record Creation/Management (Creating and maintaining a record in our systems, electronic or otherwise, in order to carry out the management of the program).
- Financial Verification (Verifying availability of funds or income to cover program-related costs/expenses, financial need, or other financial requirements of a program).
- Medical Review (Reviewing medical information for the purpose of determining visa eligibility, identifying any issues that would prohibit an individual from participating in a program or activity, or would require additional accommodations to be arranged).
- Participant Agreements (Drafting, sending, receiving agreement documents with program participants).
- Insurance/Health Benefit Enrolment and/or Management (Enrolling a participant in a health benefit plan to ensure coverage in the case of medical issues or emergencies).
- Event Management (Planning and/or executing events including registration, scheduling of participants, or any other event-related activities for purposes including program enrichment or external engagements by Commission).
- Program Reporting (Producing and sharing reports about progress, activities and other program related information).
- Program and Commission’s activity Promotion and Outreach
- Participant Progress Management (Collecting and analyzing any academic, employment or other information to ensure a participant is meeting the requirements of a program or on track for successful completion of an award).
- Financial Management (Processing payment transactions to or from participants, vendors, or other payees using a bank transfer or other methods).
- Emergency Management (Assisting, corresponding and handling emergencies during a program participation).
- Program Evaluation (Reporting, exporting, or compiling of data for the purposes of understanding and/or evaluating the state of the program/participants, impacts, or any other legitimate interest).
- Alumni Management (Managing data of participants whose programs have ended, including the production of statistical reports, alumni correspondence and organizing alumni events).
- Technical and Administrative Management (Ensuring the security of the IT system and to manage this system, as well as for analytical and statistical purposes).
Basis for processing
We will only process your data if we have at least one valid lawful basis listed below:
- In order to enter into and to carry out a contract with you when awarding a scholarship;
- Necessity for compliance with a legal obligation to which the Commission is subject, e.g. accounting and tax obligations
- Where you give us consent, e.g. to post photographs and video recordings containing your data on our website and/or social media accounts (Facebook, etc.) to promote events you participated in;
- As required by us to pursue our legitimate interests or the legitimate interests of others, in particular, provided that the legitimate interests below are not overridden by the interests or fundamental rights or freedoms of the individuals whose personal data we are processing:
- ◦when carrying out the processes listed above;
- when investigating any complaints received from you or from others, about us, or our service providers; or
- in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
Disclosure of personal data
We may send your data to or receive it from third parties to carry out the processes listed above. These third parties may include:
- Program and award sponsors, including U.S. State Department, Bureau of Educational and Cultural Affairs (“ECA”),
- The Institute of International Education (“IIE”) – the agency contracted by ECA to administer the Fulbright Program,
- World Learning – the agency contracted by ECA to administer the Fulbright Specialist Program,
- Fulbright Foreign Scholarship Board (FFSB),
- Service providers such as cloud storage, email, CRM, survey platform, email marketing and newsletter platform, external accounting services, postal services, document archiving services,
- The U.S. Embassy and Consulate in Bulgaria,
- The Bulgarian Embassy and Consulates in the U.S,
- Program sponsors,
- Your host institution,
- Alumni associations,
- Additional third parties which may include legal counsels, courts, tribunals, regulators, government authorities and law enforcement officials if required by law or for Commission’s legitimate interest in compliance with applicable laws/regulations,
- Basic information about your grant (such as your name, home and host institutions, project title, award name) may be shared with Bulgarian and US educational institutions.
Moreover, your data may be transferred to entities processing them at our request but only for the purpose and scope necessary for the implementation of the above-mentioned purposes, including entities providing IT services for us. Such entities process data on the basis of contracts concluded with us and only in accordance with our instructions.
Retention of personal data
The Commission will retain your personal data for as long as required to perform the purposes for which the data was collected, depending on the legal basis for which that data was processed and/or whether additional legal/regulatory obligations mandate that we retain your personal data.
We may also retain personal data for the period during which a claim may be made in relation to our professional relationship with you.
The personal data on the Application will be held on the application platform and by the Commission for two years for unsuccessful applicants and for five years for successful applicants for the Fulbright award.
Where we process personal data with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to process your data indefinitely so that we can respect your request in future.
Your rights under the EU General Data Protection Regulation
You have rights under the GDPR including:
- the right to access your personal data;
- the right to have your personal data rectified if it is inaccurate or incomplete;
- the right to have your personal data deleted or removed if there is no reason for its continued storage and processing;
- the right to object to your personal data being processed and to request restriction of the processing of your personal data in certain circumstances;
- the right to request the transfer of your personal data to another party; and
- where you have provided your consent to the processing of your personal data for a specific purpose, you have the right to withdraw your consent. Please note that the withdrawal of your consent will not affect the lawfulness of any processing of personal data based on your consent before its withdrawal.
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.
To exercise any of these rights, you can get in touch with us, using the contact details set out below.
If you have unresolved concerns, you have the right to lodge a complaint with the Bulgarian Data Protection Authority:
Bulgarian Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
Direct marketing and automated decision –making
Fulbright may, from time to time, contact you by email with information about Fulbright activities, newsletters and alumni opportunities. Fulbright will never share your contact information with third parties. If you no longer want to receive email marketing from Fulbright, please let us know by sending an email to us at email@example.com. You can also unsubscribe from our marketing emails by clicking on the unsubscribe link in the emails Fulbright sends to you.
Please, note that Fulbright is not carrying out automated decision – making in the context of your application to and further participation in our programs.
Changes to this Statement
We reserve the right to change this Statement and any other relevant policies or procedures at any time without notice to you. Any changes we may make to this Statement in the future will be posted to the Commission website (fulbright.bg) and you are advised to regularly check and review the Statement to ensure you understand how we may be processing your personal data. Any changes that we may make to this Statement will be effective from the date on which those changes have been posted on this page. Where appropriate, we may also notify you of any changes made by e-mail.
If you have any questions, requests for exercising of rights or need of addinial information regarding this Statement and the processing of your personal data, please contact us at:
Angela Rodel, Executive Director
BULGARIAN-AMERICAN COMMISSION FOR EDUCATIONAL EXCHANGE
12 Vitosha Blvd, 5th Floor, 1000 Sofia, Bulgaria