Employees

I.

Controller

 

For the Processing of Your personal data, Controller is Aurubis Bulgaria AD, a joint stock company, registered in the Company Register with the Registry Agency under uniform ID code 832046871, having its registered seat and management address in:

 

Aurubis Bulgaria AD

            Industrial zone

            2070 Pirdop

            Bulgaria

 

Aurubis Bulgaria AD is represented by Tim Kurt, Executive Director.

 

II.

Contact details of the Data Protection Officer

 

Data Protection Officer, Security and Risk Management department, Aurubis Bulgaria AD, Industrial zone, 2070 Pirdop

Tel.:        +359 7286 2280

Fax:        + 359 7286 2646

E-mail:   d.temelkova(at)aurubis.com

 

III.

Collection and processing of personal data of Aurubis Bulgaria employees

1.

Personal data, collected directly from the data subject in written or verbal prior to entering into employment or in civil contract:

  • Identification data: names, personal address, personal phone number, personal email add., date of birth, Civil Number, ID number, photo, marital status;
  • Other Data: In compliance with the Conflict of Interests policy in the Company, are collected names and position of family members, as family members we consider spouses or persons who are in a real spouses cohabitation, relatives in a straight line and a collateral line - up to the second grade inclusive, and kinship by marriage - to a second grade inclusive;
  • CVs, summaries, applications, referrals, offers.

 

2.

Personal data, collected directly from the employee in written at the beginning or at time of contractual relationship:

  • Identification data: names, personal address, date of birth, Civil number, ID number, photo, marital status;
  • Finance details: IBAN, tax information, payments information;
  • Copies of diplomas, driving license, documents for qualifications and trainings, according to the regulatory requirements and procedures of Aurubis Bulgaria AD.
  • Other Data: In compliance with the Conflict of Interests policy in the Company, are collected names and position of family members, as family members we consider spouses or persons who are in a real spouses cohabitation, relatives in a straight line and a collateral line – up to the second grade inclusive, and kinship by marriage - to a second grade inclusive;
  • Sensitive Personal data - health data and non-conviction certificate for certain positions.

 

3.

Personal data, generated by the Company in written or verbal:

  • Details about the employment, e.g. salary, history of employment and compensations, professional growth, paid leaves, sick leaves, level of payment, information about the performance (including job evaluation, internal communication on performance and attendance), etc.

 

4.

Personal data, collected directly from the employee in written or verbal, or received by third parties (medical tests, diagnostic procedures, consultations, documents on temporary disability to work) or are generated by the Health service department throughout the employment period:

  • Identification data: names, personal address, date of birth, Civil number, phone number;
  • Family burden - in terms of socially significant diseases;
  • Working activities – professional history; reduced working capacity;
  • Health status - past diseases; chronic diseases; bad habits; results of medical tests, diagnostic procedures, consultations; disability; accidents at work and data on temporary incapacity for work.

 

5.

Video Surveillance:

·         on the territory of the company are located cameras for 24-hour video surveillance designed for security and operational purposes.

·         on the entrances of the company are located cameras for 24-hour body temperature measurement that aim is to prevent epidemic/ pandemic disease spreading.

 

Photos:

·         on the territory of the company, employees are shot for proving violations.

 

6.

Personal data collected directly from the employees in written or verbal, or received by third parties (medical tests, diagnostic procedures, consultations, documents on temporary disability to work) or are generated by the Health service department throughout pandemics period, in case the person has symptoms or direct contacts with infected people:

·         Identification data: names, personal address, position, phone number;

·         Travel data – travelling location (business and personal) during the last 14 days;

·         Contacts within the family: names;

·         Contacts within Aurubis Bulgaria: names, positions, companies;

·         Records for pandemic’s specific symptoms;

·         Results of pandemic’s specific tests;

·         Body temperature.

 

 

The processing of personal data in p. III (1-6) is necessary for the following purposes:

·         Managing employee relationships with the Company - including, but not limited to, activities related to the existence, modification and termination of labor relations and the preparation of documents of the persons in this respect (contracts, additional agreements, documents certifying length of service, references, statements, certificates, etc.); administration of salaries, bonuses, paid leaves, social benefits, mission orders, etc. The processing of personal data for these purposes is based on the fulfillment of the contractual obligations of Aurubis Bulgaria AD towards the employee.

·         Personnel management – including but not limited to customary business practices related to planning and recruitment; managing and improving the efficiency of the workforce, payments and compensation programs; performance management, training and development; progress and planning of successors; control over the compliance with statutory and contractual obligations and obligations arising from internal policies and procedures; internal reporting; conducting disciplinary proceedings; investigation of work accidents; protection of the rights and interests of the company in various administrative and judicial proceedings. The processing of personal data for these purposes is based on the legitimate interests of the company related to the necessity to develop its business in a sustainable manner and to increase its efficiency as well as the need to ensure that its employees comply with the applicable legal, contractual or intercompany requirements;

·         Operational management – including but not limited to establishment, implementation and management of the business activities of the company, for example: maintenance and monitoring of the use of internal networks and information systems, accounting of business travels and costs, health and safety management, protection against serious cross – border  threats to health, preparation of powers of attorney, administration of insurance claims, use of company cars, preparation of business missions, trips and reservations, and others. The processing of personal data for these purposes is based on the legitimate interests of the company to manage its material resources and workforce, including providing network and information security in its organization, as well as managing its budget effectively;

·         Security management – including but not limited to activities related to access control, video surveillance; ensuring security of the premises, assets and information held by the company, and for the purposes of preventing and investigating theft, fraud, abuse, conflict of interest, audits and controls. The processing of personal data for these purposes is based on the legitimate interests of the company to ensure the safety and security of its assets as well as its employees against any possible risks;

·         Compliance with regulatory requirements and settling of legal disputes - including, but not limited to, the processing of personal data in accordance with regulatory requirements (e.g. tax, social, health, labor and other applicable legislation). The processing of personal data for these purposes is done on the basis of compliance by the company with applicable legal obligations.

 

Personal data will be stored for a period of 11 (eleven) years after termination of employee legal relationship with the Company, same as the absolute limitation period for tax obligations, unless they have become necessary within that period to establish, exercise or protect of any legal claims or administrative proceedings against Aurubis Bulgaria AD. In this case, the personal data will be stored until the end of the relevant legal procedure.

 

Personal data entered into the access control system is processed and kept for up to 3 years from the termination of the employment or civil relationship.

 

Payment records and health dossiers are kept for up to 50 years.

 

Video records are processed and stored for up to 2 months of creation in compliance with the Private Security Services Legislation. The video records of sites under the Waste Management Act are processed for up to 1 year.

Photos of employees are processed for a period of 5 years from committing a violation, unless they have become necessary within that period to establish, exercise or protect of any legal claims or administrative proceedings against Aurubis Bulgaria AD. In this case they will be stored until the end of the relevant legal procedure.

Personal data which is processed in case of work accidents, is stored for up to 5 years after the event.

 

Health records for the purpose to prevent pandemics are processed for up to 2 months after the announcement of the end of pandemics.

 

Video records and indicators of body temperature measurements are processed for up to 2 weeks.

 

Employees provide their personal data to the Company on a voluntary basis. If they do not provide their personal data, the company will not be able to conclude a contract with them or will not be able to fulfill its obligations under such contract, or will not be able to perform its obligations towards the public interest in the area of public health, such as protecting against serious cross-border threats to health, or the employee will not be able to take advantage of certain social benefits / participate in certain processes and projects in the Company.

 

The grounds for processing the personal data under p. III are based on Regulation (EU) 2016/679 as follows: Article 6 (1) (b) of Regulation (EU) 2016/67 and Article 6 (1) (c) of Regulation (EU) 2016/679 and/ or Article 6 (1) (f) of Regulation (EU) 2016/679 and Article 6 (1) (d) of Regulation (EU) 2016/679, in relation with Article 9 (2) (h) of Regulation (EU) 2016/679 and Article 9 (2) (i) of Regulation (EU) 2016/679.

 

IV.

Collection and processing of Personal Data in other cases

 

In other cases, different than the mention in p. III, personal data is collected and processed only if provided voluntarily, as follows:

 

1.

Additional personal data, collected and processed after a written request from the employee:

  • Family status - marriage, divorce, number of family members, including children under 18 years of age;
  • Identity data for family members: names, personal address, date of birth, Civil number, phone number;

·         Labor union’s membership of the employee.

 

The processing of the above mentioned personal data serves for the following purposes:

  • Social responsibility - including but not limited to donation, sponsorship, additional benefits for employees and their family members, addressing labor relations issues and health insurance claims;

·         Labor unions membership data is process only upon a written request by him/ her, to use the more favorable conditions for labor benefits agreed in the Collective Labor Agreement (CTA), withholding unions membership fees and/or loan installments from the salary, etc.;

 

If employee provides to Aurubis Bulgaria AD, personal data of his family members ( e.g. in order to use certain social benefits) or any other third parties, it is his responsibility to:

  • Provide these data subjects with all the relevant information for the lawful disclosure of their personal data to Aurubis Bulgaria AD, details about the data processing and the purposes for which the data is provided; and
  • Receive the consent of these data subjects for the mentioned disclosure of their personal data and its processing by Aurubis Bulgaria AD, if such consent is necessary.

 

Personal data processing for these purposes is based on employee consent, which is expressed unambiguously, by voluntary provision of documents and information, necessary for the purposes of the certain case. Employee may withdraw the consent at any time that will not affect the lawfulness of the processing prior to the withdrawal of the consent.

 

The grounds for processing this personal data is based on Article 6 (1) (a) of Regulation (EU) 2016/679, Article 6 (1) (b) of Regulation (EC) 2016/679, Article 6 (1) (c) of Regulation (EU) 2016/679 and Article 6 (1) (f) of Regulation (EC) 2016/679.

 

V.

Provision of personal data to third parties

 

Aurubis Bulgaria AD uses service providers, who process and store personal data ("Personal Data Processors" pursuant to Article 28 of Regulation (EC) 2016/679). In particular, this is applicable to the security company, insurance companies, mobile operators, travel agencies, transport companies, pension and insurance companies, legal advisers and other third parties with which Aurubis Bulgaria has concluded contracts for provision of training, medical, accounting and other services. These processors work only on contractual basis with Aurubis Bulgaria AD and store and process personal data according to the company's instructions.

 

The above mentioned data for the above purposes will be provided to other Aurubis Group companies only in the volume required by the particular purpose for processing. The reason for the processing of personal data by other Aurubis Group companies is based on a legitimate interest - unification and standardization of processes at the corporate group level.

 

The information for confirmed infected employees, in relation with p. III (6), shall be disclosed only in case it is necessary to assess whether other employees of Aurubis Bulgaria AD or employees of contractors had been in contact with the infected person, and respectively infected too.

 

Out of these three circumstances, data will only be provided in individual cases and in a volume that is in accordance with a specific legal obligation of Aurubis Bulgaria AD, as well as in cases where employee has submitted consent to provide the data.

 

VI.

Employees rights as Data Subject

 

·         Right to withdraw consent at any time (Article 7 (3) of Regulation (EC) 2016/679). As a consequence, the company will not be able to continue processing this data if it was based on consent.

·         Right to request confirmation whether the company processes personal data, and if so, information on the storage and processing (Article 15 of Regulation (EC) 2016/679). In particular, information may be requested about the purposes of processing; categories of personal data; the categories of recipients to whom personal data will be or have been provided; storage period; the right to request correction, erasure and / or limitation of processing, to object to such processing and to lodge a complaint with a supervisory authority; information about the source from which the company have received personal data when it was not collected by the subject; information on the availability of automated decision making (including profiling) and, if applicable, relevant detailed information.

·         Right to request immediate rectification of the personal data (Art. 16 of Regulation (EU) 2016/ 679).

·         Right to request erasure of the personal data, unless its processing is necessary:

1) For exercising the right of freedom of expression and information;

2) For compliance with a legal obligation;

3) For reasons of public interest;

4) For the establishment, exercise or defense of legal claims (Art. 17 of Regulation (EU) 2016/ 679).

·         Right to request restriction of the processing of the personal data if: contest their accuracy; the processing is unlawful; the company does not need the personal data any more, but the data subject require them for establishment, exercise or defense of а legal claim; if the data subject has objected to processing pursuant to Article 21 (1) of Regulation (EU) 2016/ 679 (Art. 18 of Regulation (EU) 2016/ 679).

·         Right to receive the personal data in a structured, widely used and machine readable format or request the transfer of this data to another Administrator (Article 20 of Regulation (EC) 2016/679).

 

When exercising the right to receive personal data or to transfer it to another Controller, more than once within 24 months, Aurubis Bulgaria AD reserves the right, according to Ch. III, Art. 12 par. 5 (a) of Regulation (EU) 2016/679, to require payment of administrative costs of BGN 20 per set of paper copy and BGN 20 per electronic carrier.

 

In order to exercise his rights under the above points, the employee must contact the Data Protection Officer designated by Aurubis Bulgaria AD:

 

Address:         2070. Pirdop, Industrial zone,

Tel :                 + 359 886 131 999

E-mail:            d.temelkova(at)aurubis.com

 

Data subject has the right, under Article 77 of Regulation (EC) 2016/679, to lodge a complaint to the Commission for Personal Data Protection (CPDP) by the ways described in the Commission's website. The contact details of CPDP are:

 

Address:          1592 Sofia, Prof. Tsvetan Lazarov Blvd. 2

Fax:                  02 9153525

E-mail:              kzld(at)cpdp.bg

 

Aurubis Bulgaria AD will cooperate to CPDP in the handling of such complaints and will comply with all recommendations and/ or instructions issued by the supervisory authority.

Data subject has the right to lodge a complaint at Aurubis Group Headquarters by sending an email to dataprotection(at)aurubis.com .

VII.

Right to object

 

If the personal data is processed on the basis of a legitimate interest of the company pursuant to Article 6 (1) (f) of Regulation (EC) 2016/67, the employee has the right to object the processing of these data under Article 21 (1) of Regulation (EC) 2016/679. In this case, the company will not continue the processing of the personal data, unless there are convincing legal grounds for the processing that take precedence over the interests of the data subject, his rights and freedoms or are necessary for the establishment and/ or the defense of legal claims.If the data subject wants to use the right to object, it is enough to send an email to d.temelkova(at)aurubis.com

 

 

Font size
Glossary
onoff
Cookies
We only use necessary cookies on this website. Without these cookies, this website wouldn't function. We use no other cookies on this website. Tracking does not take place on this website. Additional information about the necessary cookies is available here.