Data Protection Policy of ICAP Employment Solutions Bulgaria EOOD
38, Cherkovna Str., B.L.V.D. Offices, Sofia, Bulgaria
with VAT number 202205529
1. Field of Scope
This privacy notice lays out the way ICAP Employment Solutions Bulgaria EOOD (hereinafter referred to as “ICAP Employment Solutions”) collects, uses, processes, stores, manages, and protects the employment, academic, health and payroll data of individuals; cv data, data related to skills, abilities and psychometric attributes of individuals, as well as development and behavior data of individuals; individuals’ personal data and in general any information regarding entities and individuals (hereinafter referred to as “Personal Data”), so as to meet the data protection standards of the company and comply with the applicable data protection law.
The company's activities include, but are not limited to, the following services: (a) Outsourcing Services, Recruitment Process Outsourcing (RPO), Payroll Services, Staffing Solutions, Business Process Outsourcing), Provision of Training, Executive Search and Selection (ESS) solutions, Human Capital Consulting services; (b) Provision of telephone services to third parties by creating a call center to receive incoming calls and making outgoing calls, (c) Provision of services for promotion and services and products of third parties or themselves, either through telephone or other means of communication, (d) Provision of business advisory services to sales promotion, and design and organization of call centers, (e) Conducting market research for products and third party services, excluding television market, (g) Provision of administrative and technical support to private or public third parties as well as the undertaking of projects with similar context according on the instructions of τhe Client.
(i) that relates to the products and services (hereinafter referred to as “Services”) provided by ICAP Employment Solutions
(ii) pertaining to candidate employee or employment data, academic and payroll data collected through third party recruitment platforms, ICAP’s network or existing Clients
(iii) pertaining to certain health data of employees
(iv) pertaining to Client data obtained during the use of the Services. ICAP Employment Solutions is bound to protect the privacy of Clients, individuals and other data subjects and adhere to the Data Protection legislation currently in effect.
(v) to whom any third party may have access (hereinafter referred to as the “User or/and Client”)
(vi) pertaining to Client and User data obtained during the use of the Services.
This policy shall not apply to information collected through any other website, services, products, platforms or for practices of companies that we do not control. We are not responsible for any personal data protection practices pertaining to websites, services, products, platforms of other companies.
2. Categories & Types of Collected Data
A. Candidate Employee Data: name/surname, date of birth, address, academic and professional qualifications, contact details, address, nationality, candidates suitability evaluation reports, previous employment information, marital status, e-mail, military service completion/exemption certificate, hobbies, interests, references
B. Employment & Payroll data: first name, last name, Tax Registration No. Identification Card/Passport No. (Date of issuance & issuing authority), father's name, mother's name, date of birth, address, contact details, nationality, marital status, protected members (numbers, date of birth, name), social insurance history, educational level, health record for chronic disease, unemployment card nr., bank account particulars, social security stamps, family status certificate, military service completion/exemption certificate
C. Outsourced employees payroll data: all employment registration data (first name, last name, Tax Registration No. Identification Card/Passport No. (Date of issuance & issuing authority), father's name, mother's name, date of birth, address, contact details, nationality, marital status, protected members (numbers, date of birth, name), social insurance history, educational level, health record for chronic disease, unemployment card nr., bank account particulars, social security stamps, family status certificate, military service completion/exemption certificate) salary and benefits package)
D. Employee health/medical data: Names/surnames, diagnostic results, doctors’ notes, health treatments, illnesses, hospital reports
E. Personality Profiling Data: first name, last name, Skills, abilities and psychometric attributes (profiling)
F. Behavioral Profiling Data: name / surname linked with training results, individual’s development and behavior skills and capacity (profiling)
In the cases of services provided by the Contact Center, ICAP Employment Solutions undertakes on behalf of its clients to make and to receive telephone calls according to the instructions of the individual client, as they are imprinted in the relevant contract signed between ICAP and the client. In the context of executing the specific contract, ICAP usually collects on behalf of its clients the following categories of data:
G. Communication Data that includes any communication that any individual or legal entity send to ICAP whether that be through the contact form on our website, through email or especially via telephone calls. It should be mentioned that in most instances the phone calls are recorded via relevant software. This software usually belongs to the ICAP, but in some cases it may be software that belongs to the client itself. If the software belongs to the client, ICAP’s employees have access through the use of passwords. Furthermore, in any case that calls are not being recorded ICAP’s personnel entries to the software data for each (inbound or outbound) call regarding its content.
H. Customer Data that includes data relating to any purchases of goods and/or services that ICAP has undertake the responsibility to communicate to customers on behalf of ICAP’s clients. Customer data usually includes informations such as customer’s name, title, billing address, delivery address email address, phone number, contact details, purchase details, tax number, card details, identity card number, nationality.
I. Marketing Data that includes data about how customers use our website and any online services and especially data about your preferences in receiving marketing from us on behalf of our Clients/Users and your communication preferences.
Furthermore, ICAP collects data of individuals and/or legal entities as a Controller. In such cases ICAP collects, uses, processes, stores and manages the following categories of data:
J. Client’s data: this category of data may include data relating to businesses, legal entities and individuals that want to or already use the Inbound/Outbound services provided by ICAP, such as client’s name, title, billing address, delivery address email address, phone number, contact details, purchase details, tax number, card details, identity card number, the collection, management, and provision of commercial and economic information (business information) etc.
Declaration Regarding The Processing of Personal Data By ICAP Employment Solutions (by its capacity as Data Controller and Processor - in accordance with the General Data Protection Regulation EU 679/2016)
Why will you process my Personal Data (PD)?
ICAP Employment Solutions provides outsourcing, recruitment process outsourcing (RPO), payroll staffing solutions, business process outsourcing services, training, recruitment, executive search and selection solutions and human capital consulting services containing employment, academic, health, payroll, personality and behavioral data of individuals on the basis of the intended purpose, such as described in paragraph 6 hereof. ICAP provides also products and services containing commercial and financial information about legal entities and individuals on the basis of the intended purpose, such as described in detail above and in paragraph 6. The contents of the processed personal data vary depending on the type and purpose of the provided service of ICAP Employment Solutions. The lawful basis of the data processing is ICAP Employment Solutions’s legitimate interest and in some instances the consent of the data subjects.
In addition ICAP Employment Solutions may collect personal data of candidate employees with their consent for the purpose of exploring employment opportunities and related employee training solutions.
Furthermore ICAP Employment Solutions collects candidate employee data through third party sources (online recruitment platforms or business networking sites/platforms or other) on the basis of its legitimate interest.
ICAP Employment Solutions utilizes the online personality assessment platform Hogan (https://www.hoganassessments.com/about/) from which it receives profiling data related to individual skills, abilities and psychometric attributes.
For more information about Hogan please read their Privacy Notice at https://www.hoganassessments.com/privacy-policy/
Lastly ICAP Employment Solutions collects within the framework of the aforementioned provided Services, certain special categories of Personal Data as defined in Article 9 of the GDPR (i.e health records or doctors’ notes, hospital reports etc) with the explicit consent of the Data Subjects. Said data are submitted for absence justification of the employee or his/her inclusion to a private insurance program utilisation. Only data that are essential for those purposes, are being collected and processed. The processing of these data may also be necessary for compliance with a legal obligations to which ICAP Employment Solutions is subject.
Information automatically collected when visiting and interacting in the website https://www.icap.bg/: With regards to the data collected through the website https://www.icap.bg/ (hereinafter referred to as “Website”) you may review the pertinent privacy notice here.
3. Data Collection Points
● Third party business networking platforms (linkedin)- A
● Third party personality assessment platforms (Hogan) - E, F
● ICAP Network - A
● Corporate Clients (employers) - C
● Employees - D
● Individuals (via online forms, e-mails) - A, B, C, D
● Users/Clients - G, H, I, J
● Corporate Customers of Users/Clients - G, H, I, J
4. Transfer of Data to Third Parties
ICAP Employment Solutions reserves the right to disclose your personal data to any member of its affiliate/subsidiary companies (parent company and its subsidiaries) or other third parties to the extent it is reasonably necessary for the purposes determined in this notice and in particular:
● Certain data (CVs and evaluation reports) will be transferred between members of ICAP Group (inter-group data transfers)
● Your employment and payroll data may be transmitted and become accessible by legal entities (corporate customers) with which, we have entered from time to time into contractual agreements for the purpose of fulfilling our company’s legitimate interest (provision of staffing recruiting and payroll services) in a correct and within our contractual terms framework
● Your payroll data may be transmitted and become accessible by bank institutions with which we cooperate for the purpose of processing the payments of employees
● Your data may be transmitted and become accessible by legal entities with which, we have entered from time to time into contractual agreements for the purpose of fulfilling our company’s commitment under any signed contract with any Client/User (provision of inbound and outbound call services and related services) in a correct and within our contractual terms framework. Given that ICAP acts as data processor in these instances, the data subjects are encouraged to review the privacy notices of each respective Client under whose instructions ICAP operates
● Your data may be disclosed to cloud hosting providers for the purpose of storing and safeguarding the data with the appropriate technical and security measures
● Your data may be transmitted, become accessible and processed by subsidiaries of our group within the European union, which apply the appropriate technical, physical and administrative security measures for the protection of the data from loss, misuse, damage, alteration, unauthorised access and disclosure, as provided by article 32 of the GDPR 679/2016
● Your data (specifically employment and payroll data) may be disclosed to public authorities in compliance with pertinent legal obligations of ICAP Employment Solutions
● During all data transfers, we always take all appropriate measures so as to ensure that the transmitted data are the minimum required for the intended processing purpose and that the conditions for legitimate and lawful processing will always be met
● ICAP Employment Solutions’ servers are hosted at IBM’s data centre (hosting provider) located in Athens. You may find more information on IBM’s privacy notice in the following link:
5. Personal Data Retention Period
ICAP Employment Solutions only ever retains personal data for as long as is necessary and we have strict review and retention policies in place to meet these obligations. The data retention period depends on the lawful basis of processing, as set out in detail below:
● In case the lawful basis for processing is the exercise of legitimate interest, the processing of personal data is carried out for as long as it is considered necessary for the achievement of the intended statutory purpose of ICAP Employment Solutions described in paragraph 6 below, and until such time the limitation period of any related claims has expired.
● In case the personal data of the employees have been provided with their own consent and within the framework of our services, we shall retain those data until the granted consent by the data subject has been withdrawn. In case the consent is withdrawn for any valid reason, we shall retain them for as long as it is required until the limitation period of any related claims expires.
● In case the lawful basis for processing is the performance of the contract, we shall retain your data for as long as you retain the contractual relationship with ICAP Employment Solutions in hard copy and in electronic form or we shall retain them for as long as it is required until the limitation period of any related claims expires.
● In case the the lawful basis for processing is the explicit consent of the data subject (such in the case of medical-health records), we shall retain those data until the granted consent by the data subject has been withdrawn unless specific legislation in effect allows us or ordains to retain the data.
6. Legitimate Interest - Intended Purpose - Lawful Basis for Data Processing
Data processing is necessary for the purposes of the legitimate interests pursued by the ICAP Employment Solutions. ICAP Employment Solutions’ statutory purpose is the provision recruitment process outsourcing and payroll Services, staffing solutions and related services.
Within this framework, ICAP Employment Solutions collects, manages and provides employment, academic, health and payroll data, abilities and psychometric attributes of individuals, as well as development and behavior data of individuals for the performance of the contracts with corporate or individual. ICAP Employment Solutions processes and stores the said data within the E.U.
7. Rights of the Data Subjects
You may exercise, as the case may be, the rights deriving from the applicable Bulgarian Legislation and the General Data Protection Regulation (Regulation (EU) 2016/679) which are as follows: (a. the right of information (article 13), b. the right of access (article 15), c. the right to rectification (article 16), d. the right to erasure “right to be forgotten” (article 17), e. the right to restriction of processing (article 18), f. the right to data portability (to receive your personal data in a structured and commonly used format - article 20 where applicable) and g. the right to object (article 21) which applies to certain data processing activities
● These rights shall be exercised free of charge for you by sending a relevant letter to the Data Protection Office of ICAP Employment Solutions: 38, Cherkovna Str., 1505 Sofia, Bulgaria or via e-mail to firstname.lastname@example.org. In case however the aforementioned rights are exercised excessively and without good cause thus causing us administrative burden, we may charge you with the cost related to the exercise of the respective right.
● In case you exercise any of your rights, we will take all appropriate measures available for the satisfaction of your request within thirty (30) days following the receipt of the relevant request. We may either inform you on the acceptance of your request or on any objective grounds that hinder the processing of your request.
● Notwithstanding the above, you may at any time object to the processing of your Personal Data, by withdrawing your consent (article 7, par. 3 of the GDPR 679/2016) by sending a letter to the Data Protection Office of ICAP Employment Solutions: 38, Cherkovna Str., 1505 Sofia, Bulgaria or via e-mail to email@example.com, This right applies only in cases where the lawful basis for the data processing is the consent of the Data Subject.
8. Data Processing by ICAP Employment Solutions
ICAP ιn most instances, collects, uses, processes, stores, manages data provided by ICAP’s clients themselves such as customers, suppliers or third parties’ data - which may contain personal data (who may refer to individuals or companies) - within the framework of provision of our services. Such data in most instances has been collected by ICAP’s clients and are related to data of their customers. However, ICAP may collect customer’s data on behalf of its Client directly from any data subject. ICAP shall operate then as the “Processor” of the personal data, which are included in the said business data. Consequently, in those cases different provisions of the GDPR 679/2016 shall apply, with which we comply.
Additionally, ICAP Employment Solutions applies throughout the data processing procedure, the appropriate technical, physical, and administrative security measures for the protection and security of the personal data from loss, misuse, damage or modification, unauthorised access and disclosure, in compliance with article 32 of the GDPR 679/2016, in order to ensure the appropriate security level against those risks. Those include, among others, as the case may be: a) application of encryption protocols b) the ability to ensure confidentiality (article 90 GDPR 679/2016), the integrity, availability, and resilience of processing systems and services on an ongoing basis, c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. Moreover, ICAP Employment Solutions shall take measures so as to ensure that any physical person acting under the authority of the data controller or of the processor, who has access to personal data, shall not process those data except on instructions from the data controller and limits access to your personal information to authorised employees.
Indicative security measures applied by ICAP Employment Solutions are as follows:
● ICAP Employment Solutions maintains a dedicated information security team that plans, implements and provides surveillance of our information security program
● The company controls the security and functionality of its products and services before they are introduced to the Internet, for any vulnerabilities in technology
● The company performs ongoing infrastructure checks to detect weaknesses and potential intrusions, vulnerabilities in systems etc.
● The company uses https protocols for secure and encrypted client communication with ICAP Employment Solutions
● The company uses the open standard protocol to access Lightweight Directory Access Protocol (LDAP) directory services and uses encrypted passwords
● The company uses a Secure Sockets Layer (SSL) certificate to create an encrypted connection between the web server and the Client’s/User's browser
We use the information we obtain from candidate employees to in order to evaluate and categorize the data based on internal customer requirements. We may also carry out customized candidate suitability evaluation reports.
We recommend to our customers to review and interpret the reports on their own based on their actual business requirements. Our customers may choose to use our evaluation reports alone or combine the reports with other information available to them. We do not maintain blacklists of any kind and we do not encourage our customers to reject or approve candidates under any circumstances based on those reports.
10. Submission of Complaint - Appeal
● For any issue regarding the processing of your personal data, you may contact us via e-mail at firstname.lastname@example.org
● Moreover, you shall always be entitled to contact the Commission for Personal Data Protection, which may accept the submission of relevant complaints in writing at its protocol in its offices 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592 or by e-mail (email@example.com or firstname.lastname@example.org) in accordance with the instructions indicated on its website.
● If you no longer wish to receive newsletters from ICAP, please send an e-mail by visiting the link ‘Newsletter’ at ICAP Web Site or follow the unsubscribe instructions included in each relevant email/communication.
This policy may be renewed from time to time, due to amendments to the related legislation or change to the corporate structure of ICAP Employment Solutions. Thereby, we encourage the Clients to periodically visit the Website so as to be informed regarding recent information of privacy practices. In any case, the Clients may be informed by e-mail or a notice in our Website regarding any amendments to this policy.