Privacy Policy

"Personal data" means any information relating to an identified natural person or a natural person who can be identified ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, intellectual, economic, cultural, or social identity of that natural person.

"Processing of personal data" means any operation or set of operations performed on personal data or on sets of personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making data available, alignment or combination, restriction, erasure, or destruction.

"Personal data register" means any structured set of personal data, regardless of type and medium, accessible according to specific criteria, whether centralized, decentralized, or distributed according to a functional or geographical principle.

Principles of Personal Data Protection

Lawfulness, fairness, and transparency - processing based on legal grounds, with due care, and with proper information provided to the data subject.
Purpose limitation - data is collected for specific, explicit, and legitimate purposes and may not be further processed in a way incompatible with those purposes.
Data minimization - data must be adequate, relevant, and limited to what is necessary in relation to the purposes of processing.
Accuracy - data must be kept up to date and all reasonable steps must be taken to ensure timely erasure or rectification of inaccurate data, considering the purposes of processing.
Storage limitation - data is processed for the minimum period necessary according to the purposes. Longer retention is allowed for archiving in the public interest, scientific or historical research, or statistical purposes, provided that appropriate technical and organizational safeguards are applied.
Integrity and confidentiality - data is processed in a manner ensuring an appropriate level of security by applying suitable technical and organizational measures.
Accountability - the controller is responsible for and must be able to demonstrate compliance with all principles related to personal data processing.

Analysis of Which Personal Data Is Collected

Register "Employees and Staff"

Physical identity - names, identification document data (EGN, ID card number, date and place of issue, address, contact phone, and other data required to identify the data subject).
Social identity - data regarding education and additional qualifications, employment activity, and professional biography.
Family identity - data regarding family status.
Economic identity - bank account number information, data regarding property and financial status, participation and/or ownership of company shares or securities, and other data required to assess compatibility requirements for the relevant position.
Personal data regarding judicial background (criminal record certificate depending on the position).
Health data - medical certificate, data contained in sick leave forms submitted by employees as data subjects, decisions of TELK/NELK, etc.

Register "Contractors and Partners"

Physical identity - names, identification document data (EGN, ID card number, date and place of issue, address, contact phone, and other data required to identify the data subject).
Economic identity - general banking information, bank account number information, transaction data on completed deals, goods flow, and other data related to joint activity.

Register "Clients with Whom SPARK-KO OOD Is in Pre-contractual Relations"

Physical identity - names, identification document data (EGN, ID card number, date and place of issue, address, contact phone, and other data required to identify the data subject).
Economic identity - bank account number information, banking information, bank references, etc.
Personal data regarding judicial background (criminal record certificate depending on the type of pre-contractual relations).

Register "Complainants"

Physical identity - names, identification document data (EGN, ID card number, date and place of issue, address, contact phone, and other data required to identify the data subject).
Social identity - data regarding education and additional qualifications, employment activity, and professional biography.
Economic identity - bank account number information, data regarding property and financial status, participation and/or ownership of company shares or securities, and other data required to assess compatibility requirements for the relevant position.

What Personal Data Is Used For

Personal data is used to fulfill the requirements of the Accounting Act, the Labor Code, and other applicable legal regulations.

Article 8

(1) Personal data is collected for specific, legally defined purposes, processed lawfully and in good faith, and may not be further processed in a manner incompatible with those purposes. Further processing for archiving in the public interest, scientific or historical research, or statistical purposes is not considered incompatible with the initial purposes.
(2) Personal data is stored on paper, technical, and/or electronic media only for the period necessary for the exercise of powers, legal obligations of SPARK-KO OOD, and/or its normal functioning.
(3) Collection, processing, and storage of personal data in the registers of SPARK-KO OOD is carried out on paper, technical, and/or electronic media through a centralized and/or distributed method in premises aligned with the prescribed protection measures and the assessed appropriate level of security for the respective register.

Third Parties

Personal data is provided only upon request by a state institution and in cases defined as legal requirements. Personal data is not provided to third parties as private individuals.