Privacy statements of EVN Service Center EOOD
Since your security and observing your rights and freedoms recognized by law are extremely important to us and we appreciate your confidence in us by using our services. Therefore, we have prioritized the protection of your personal data.
These Privacy Statements (“Statements”) describe the way we process your personal data and contain the information which should be provided by EVN Service Center EOOD (“EVN SC”) in its capacity as personal data controller according to Regulation 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“the Regulation”).
These Privacy Statements are applicable to all cases in which we collect personal data (such as by completing a form, signing a contract, contact on site or by the phone, etc.).
Relevance and amendments in the statements
In order that these statements are relevant to the requirements of the applicable European and national framework, it is possible that the document is amended. You can get informed about the latest amendments in the statements on our website www.evn.bg and www.elyug.bg or to get a hard copy version in every EVN Office.
Last update: 01.06.2023
Details for the personal data controller
EVN Service Center EOOD
UIC: 200530627, Registered office: Plovdiv, 37 Hristo G. Danov street.
Details for the personal data officer: Elena Valcheva, e-mail: [email protected]
Purpose and legal basis of personal data processing
EVN SC processes personal data for different purposes and legal basis related to its capacity as employer, contracting party, etc. The specific objectives and legal basis of the processing of personal data are referred to in any form, contract or Annex, with which information is collected for the relevant activity. The specific objectives and legal basis of the processing of personal data are referred to in any form, contract or Annex, with which information is collected for the relevant activity. It is possible that the company processes personal data of one and the same subject for different purpose and legal basis.
To process your information, we are counting on the following legal grounds:
Contract execution: Processing of your data may be necessary for conclusion and execution of a contract. For example, when providing distribution of electricity to your site, in accordance with the General Terms and Conditions of the distribution system operator or connecting your site to the grid of the electricity distribution operator, in accordance with the contract that we have concluded with you.
Legal obligation: We might process your information on the compliance with legal obligations such as to provide personal data during inspections or consultations to institutions. Apart from this - according to the Energy Act we have the obligation to provide you with certain information, for which we use your contact details.
Consent giving: It is possible to rely on your consent to use your personal information for certain purposes such as direct marketing, etc. In these cases, it is important to know that you can withdraw your given consent at any time. When you give your consent, you get the necessary information, including how you can withdraw your consent.
It is possible that the company processes personal data also on the other legal grounds provided for in the Regulation: to protect the vital interests of the data subjects or of another natural person; to execute a task in the public interest or in the exercise of official powers which are conferred on the controller; data processing is necessary for the purpose of the legitimate interests of the data controller or of a third party, except when priority to such interests have the interests, the rights and freedoms of the data subjects.
Why EVN SC processes your personal data
Your personal data may be processed for some of the following specific purposes and the listing is not exhaustive but gives only some examples:
-
Conclusion and execution of contracts - Within these cases falls the processing of personal data in connection with the General Terms and Conditions of EVN Bulgaria Elektrosnabdiavane EAD, EVN Bulgaria Toplofikatsia EAD and Elektrorazpredelenie Yug EAD, etc.
-
Customer care – when processing e-mails, telephone service or communication on the spot; when received documents for change of customer’s data; processing of incoming and outgoing correspondence for change of supplier/balancing group coordinator on the free market; when responding to customers’ complaints, alerts and requests; upon registered damages; upon notification with information in accordance with the legal requirements; notification prior to disconnection, etc.
-
Improvement of our services - We also use personal data for analytical purposes. This is part of our desire to update our services and to improve our customers’ service. Your personal data may be used also for test purposes, troubleshooting and to improve the functionality and the quality of our services.
-
Proceedings before the public authorities - There is a need of various activities for processing of your data and in the consultations for institutions, consultations during inspections, answers to complaints, debt collection and other legal purpose, etc.
-
Campaigns and other direct marketing activities - We can use your information for marketing activities. They may include using your contact details for sending you news, for offering you goods and services by post, by telephone or in any other direct way and consultation with the aim of research on the offered goods and services.
-
Customer data update - we can use your information to update your data in our system.
Types of personal data collected by EVN SC
EVN SC only processes the required set of personal data for each individual case of collecting information. In addition, if you use our websites, we collect information from your computer and you can read more about this activity in the Cookies Statement following this link.
The following types of personal data may be processed for the following persons, as the listing is not exhaustive. If you are one of the persons listed below and you want to get specific information on what is your personal data that we process, you may submit such a request using the methods described below:
-
Customers using EVN Online + platform
-
When registering on the platform - user name, password, e-mail address, customer number, invoice number
-
When using the platform - names, personal ID number, address, e-mail, telephone number, customer number, metering point number, telephone number, consumption data, billing data
-
Use of PUK code - names, personal ID number, address, customer number, signature, etc.
-
Customer data update - names, personal ID number, address, customer number, telephone number, signature, e-mail address, etc.
-
Direct marketing - names, personal ID number, address, e-mail, telephone number, client number, metering point number, signature, etc.
*The company is not entitled to process any information and documents relating to the health and social status of its customers and/or of other persons related with them. Please note that we destroy all documents attached concerning this status and please in the future do not send us or do not submit such documents on the spot here with us. When servicing you on the phone or e-mail we do not require such information from you and please do not provide it in any form.
Categories of recipients of your data
In the services offered by the company for various reasons and in various methods are involved third parties. Below are some examples of how the information that you share with us is used and exchanged with these third parties.
Third parties, service providers, including persons related to the company: We may use the services of service providers to get your personal data processed on our behalf. This processing of data is done for several reasons such as for example sending of marketing materials. The third parties, service providers, will be bound by confidential rules and it is not allowed to use your personal data for other purpose.
To subcontractors of the Company that are personal data processors: The personal data processors perform the processing under a contract/other legal act concluded with the Company and under the instructions of the controller. Data transmission is carried out for the purpose of staff recruitment. The Company uses only personal data processors who provide sufficient guarantees to implement appropriate technical and organizational measures to comply with Regulation 2016/679.
Providers of payment methods and (other) financial institutions: When required processing of payment you have made, including when we need to refund to you an amount you have paid, we can share part of the information with the payment service provider and relevant financial institutions that can address these processes.
Competent authorities: We disclose personal data to the law enforcement authorities, where this is required by law or is absolutely necessary to prevent, ascertain or prosecute criminal activity or fraud. It is possible in the course of the procedure to disclose personal data with the competent authorities in order to protect our rights or the rights of any third parties.
How long are your personal data stored
During the storage of personal data the company observes the deadlines regulated by the applicable legislation and for the cases in which there are no deadlines set, the company independently sets such deadlines by considering the need and the purpose of the collected data. The specific storage deadlines of the personal data are referred to in any form, contract or Annex, with which information is collected for the relevant activity. The specific storage deadlines of the personal data are referred to in any form, contract or Annex, with which information is collected for the relevant activity.
What arrangements for storage and protection of your personal data does EVN SC make
In accordance with the existing legal framework, we observe the necessary procedures to process personal data in such a way as to ensure an appropriate level of security of personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage by applying appropriate technical or organizational measures.
In what way EVN SC treats the personal data of children
Services provided by EVN SC are not addressed to children under the age of 18. Using our services is permitted only after the consent of a parent or guardian. If we get information for a child under the age of 18, we reserve the right to erase such information.
Your rights in connection with the personal data provided to us
Right of access to the personal data processed about you
You are entitled to receive confirmation whether personal data related to you is being processed, and if this is so - to obtain access to such data and the following information:
-
the purpose of data processing;
-
the categories of personal data;
-
the recipients / categories of recipients to which are or will be disclosed personal data;
-
the intended period for which will be stored personal data or the criteria used for setting this period;
-
personal data source;
-
the existence of automated decision-making, including profiling
You have the right to a copy of the personal data, which is being processed, but for any additional copies, the company may impose a reasonable fee.
Right to rectification
As personal data subject you have the right to request the company for rectification and have inaccurate personal data rectified, or completed if it is incomplete.
Right to erasure (“right to be forgotten”)
You have the right to ask the company to erase the associated with your personal data as long as any of the following reasons is available:
-
personal data are no longer necessary for the purposes for which they were collected or have been treated in another way;
-
you have withdrawn your consent, on which is based the data treatment and there is no other legal basis for such treatment;
-
you have objected against the data processing in the manner provided for
-
personal data have been processed unlawfully.
-
personal data must be erased in order to comply with a legal obligation
The right shall not apply as far as data processing is necessary for compliance with a legal obligation, for performance of a task in the public interest or for the establishment, exercise or defence of legal claims.
Right to restrict processing
You have the right to demand from the company to restrict the processing of your personal data in the following circumstances:
-
when you dispute the accuracy of personal data;
-
you find data processing unlawful, but you do not want your personal data to be deleted and instead you demand limitation of their usage;
-
the company does no longer need your personal data for the purpose of data processing, but you demand them to establish, exercise or defend legal claims;
Right to data portability
You have the right to obtain your personal data that you provided to the company in a structured, widely used and suitable for machine reading format and you have the right to transfer these data to another company when:
You have the right directly to transfer personal data from the company to another data controller, where this is technically feasible and does not adversely affect the rights and freedoms of other persons.
Right to object to processing of personal data
You have the right to object to the processing of your personal data when the company processes them on the following grounds:
The company terminates data processing, unless proven that there are no convincing legal grounds for data processing.
You have the right at any time to object to the processing of your personal data for the purpose of direct marketing, which includes also profiling.
Automated taking individual decisions, including profiling
You have the right not to be subject to a decision based solely on the automated processing, including profiling, which gives rise to legal consequences for you, unless such decision:
-
is necessary for the conclusion or execution of a contract with you;
-
is allowed according to the law;
-
is based on your express consent.
Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data is made in violation of the applicable regulations, you have the right to submit a complaint to the Commission for Personal Data Protection.