Privacy Statements of EVN Bulgaria Elektrosnabdiavane EAD

Since your security and observing your rights and freedoms recognized by law are extremely important to us and we appreciate your confidence in us by using our services. Therefore, we have prioritized the protection of your personal data.
 
These Privacy Statements (“Statements”) describe the way we process your personal data and contain the information which should be provided by EVN Bulgaria Elektrosnabdiavane EAD (“EVN EC”) in its capacity as personal data controller according to Regulation 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“the Regulation”).
 
These Privacy Statements are applicable to all cases in which we collect personal data (such as by completing a form, signing a contract, contact on site or by the phone, etc.). 

Relevance and amendments in the statements

In order that these statements are relevant to the requirements of the applicable European and national framework, it is possible that the document is amended. You can get informed about the latest amendments in the statements on our website www.evn.bg or to get a paper version in every EVN office.
Last update: 01.06.2023

Details about the personal data controller

EVN Bulgaria Elektrosnabdiavane EAD
UIC: 123526430 Registered address: Plovdiv, 37 Hristo G. Danov street
Information about the personal data protection officer Elena Valcheva, e-mail: [email protected] 

Purpose and legal basis of personal data processing

EVN EC processes personal data for different purpose and legal grounds related to its function of a licensee for the activities “public supply of electricity”, “electricity supply from supplier of last resort” and “trading with electric energy”, employer according to the PPA, employer, a party to contracts, etc. The specific objectives and legal basis of the processing of personal data are referred to in any form, contract or Annex, with which information is collected for the relevant activity. It is possible that the company processes personal data of one and the same subject for different purpose and legal basis. 

To process your information, we are counting on the following legal grounds:

Contract execution: Processing of your data may be necessary for conclusion and execution of a contract. For example in case of sales of electric energy according to our General Terms and Conditions, in case of buying up electrical energy according to a concluded contract, at deferred payment through an agreement, etc.
Legal obligation: We might process your information on the compliance with legal obligations such as to provide personal data during inspections or consultations to institutions. Apart from this - according to the Energy Act we have the obligation to provide you with certain information, for which we use your contact details.
Consent: It is possible to rely on your consent to use your personal information for certain purposes such as direct marketing, etc. In these cases, it is important to know that you can withdraw your given consent at any time. When you give your consent, you get the necessary information, including how you can withdraw your consent.
 
It is possible that the company processes personal data also on the other legal grounds provided for in the Regulation: to protect the vital interests of the data subjects or of another natural person; to execute a task in the public interest or in the exercise of official powers which are conferred on the controller; data processing is necessary for the purpose of the legitimate interests of the data controller or of a third party, except when priority to such interests have the interests, the rights and freedoms of the data subjects. 

Why EVN EC processes your personal data

Your personal data may be processed for some of the following specific purposes and the listing is not exhaustive but gives only some examples:
Conclusion and execution of contracts - Within these is the processing of personal data in connection with our General Terms and Conditions, contracts for electricity buyout, agreements for deferred payment, contracts according to the PPA, etc.
Customer care - when processing e-mails, telephone service or communication on the spot; when received documents for change of customer’s data; when responding to customers’ complaints, alerts and requests; upon notification with information in accordance with the legal requirements; notification prior to disconnection, etc.
Improvement of our services - We also use personal data for analytical purposes. This is part of our desire to update our services and to improve our customers’ service. Your personal data may be used also for test purposes, troubleshooting and to improve the functionality and the quality of our services.
Financial-accounting activity - We process your personal data as well when invoicing, processing of payments, etc.
Proceedings before the public authorities - There is a need of various activities for processing of your data and in the consultations for institutions, consultations during inspections, answers to complaints, debt collection and other legal purpose, etc.
Campaigns and other direct marketing activities - We can use your information for marketing activities. They may include using your contact details for sending you news, for offering you goods and services by post, by telephone or in any other direct way and consultation with the aim of research on the offered goods and services. 

Types of personal data collected by EVN EC

EVN EC only processes the required set of personal data for each individual case of collecting information. In addition, if you use our website, we collect information from your computer and you can read more for this activity in the Cookie Statement on this link.
The following types of personal data may be processed for the following persons, as the listing is not exhaustive. If you are one of the persons listed below and you want to get specific information on what is your personal data that we process, you may submit such a request using the methods described below:

• Electrical energy customers - names, personal ID number, address, e-mail, telephone number, customer number, metering point number, signature, IBAN, data from power of attorney, data from documents of title, consumption, etc.
• Senders of signals by e-mail or by letter - names, personal ID number, address, client number, metering point number, telephone number, electronic signature, e-mail address, etc.
• Senders of signals on the phone - names, address, e-mail, telephone number, client number, metering point number, sound recording, etc.
• Visitors in EVN Office - names, telephone number, video record,  etc. (in the event that such visitors are customers of EVN, also the other referred to above personal data)
• Partner ledgers according to PPA - names, personal ID number, address, e-mail, telephone number, signature, IBAN, data from power of attorney, data from documents of title, educational data, judicial status, etc.
• Representatives of producers - names, personal ID number, address, client number, telephone number, data from ID card, etc.
• Customers or other individuals to participate in a campaign - names, personal ID number, data from ID card, address, video record, facial image (photos), sound record, written quotation, etc.
• Customers or other natural persons with an inquiry for sponsorship/donation - names, personal ID number, address, client number, metering point number, telephone number, e-mail address, sensitive data (on health or on social status), etc.

* The company is not entitled to process any information and documents relating to the health and social status of its customers and/or of other persons related with them. Please note that we destroy all documents attached concerning this status and please  in the future do not send us or do not submit such documents on the spot here with us. When servicing you on the phone or e-mail we do not require such information from you and please do not provide it in any form. 

Categories of recipients of your data

In the services offered by the company for various reasons and in various methods are involved third parties. Such third parties, which may receive part of your personal data, are those, together with which we provide the services related to the electricity supply, for example: 1) the electricity transmission/distribution grid operator; 2) state and municipal authorities. Below are some examples of how the information that you share with us is used and exchanged with these third parties.
Third parties, service providers, including persons related to the company: We may use the services of service providers to get your personal data processed on our behalf. This processing of data is done for several reasons such as for example sending of marketing materials. The third parties, service providers, will be bound by confidential rules and it is not allowed to use your personal data for other purpose.
To subcontractors of the Company that are personal data processors: The personal data processors perform the processing under a contract/other legal act concluded with the Company and under the instructions of the controller. Data transmission is carried out for the purpose of staff recruitment. The Company uses only personal data processors who provide sufficient guarantees to implement appropriate technical and organizational measures to comply with Regulation 2016/679.
Providers of payment methods and (other) financial institutions: When required processing of payment you have made, including when we need to refund to you an amount you have paid, we can share part of the information with the payment service provider and relevant financial institutions that can address these processes.
Competent authorities: We disclose personal data to the law enforcement authorities, where this is required by law or is absolutely necessary to prevent, ascertain or prosecute criminal activity or fraud. It is possible in the course of the procedure to disclose personal data with the competent authorities in order to protect our rights or the rights of any third parties. 

How long are your personal data stored?

During the storage of personal data the company observes the deadlines regulated by the applicable legislation and for the cases in which there are no deadlines set, the company independently sets such deadlines by considering the need and the purpose of the collected data. The specific storage deadlines of the personal data are referred to in any form, contract or Annex, with which information is collected for the relevant activity.

What arrangements for storage and protection of your personal data does EVN EC make?

In accordance with the existing legal framework, we observe the necessary procedures to process personal data in such a way as to ensure an appropriate level of security of personal data including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage by applying appropriate technical or organizational measures. 

In what way does EVN EC treat the personal data of children?

Services provided by EVN EC are not addressed to children under the age of 18. Using our services is permitted only after the consent of a parent or guardian. If we get information for a child under the age of 18, we reserve the right to erase such information. In rare cases where the owner of a facility is such a person or when organised campaigns and projects the company may collect and use the information for children only after the consent of a parent or guardian. 

Your rights in connection with the personal data provided to us

Right of access to the personal data processed about you
You are entitled to receive confirmation whether personal data related to you is being processed, and if this is so - to obtain access to such data and the following information:

• the purpose of data processing;
• the categories of personal data;
• the recipients / categories of recipients to which are or will be disclosed personal data;
• the intended period for which will be stored personal data or the criteria used for setting this period;
• the personal data source;
• the existence of automated decision-making, including profiling

You have the right to a copy of the personal data, which are being processed, but for any additional copies, the company may impose a reasonable fee.

Right to rectification
As personal data subject you have the right to request the company for rectification and have inaccurate personal data rectified, or completed if it is incomplete.

Right to erasure (“right to be forgotten”)
You have the right to ask the company to erase the associated with your personal data as long as any of the following reasons is available:

• personal data are no longer necessary for the purposes for which they were collected or have been treated in another way;
• you have withdrawn your consent, on which is based the data treatment and there is no other legal basis for such treatment;
• you have objected against the data processing in the manner provided for
• personal data have been processed unlawfully.
• personal data must be erased in order to comply with a legal obligation

The right shall not apply as far as data processing is necessary for compliance with a legal obligation, for performance of a task in the public interest or for the establishment, exercise or defence of legal claims.

Right to restrict processing
You have the right to demand from the company to restrict the processing of your personal data in the following circumstances:

• when you dispute the accuracy of personal data;
• you find data processing unlawful, but you do not want your personal data to be deleted and instead you demand limitation of their usage;
• the company does no longer need your personal data for the purpose of data processing, but you demand them to establish, exercise or defend legal claims;

Right to data portability
You have the right to obtain your personal data that you provided to the company in a structured, widely used and suitable for machine reading format and you have the right to transfer these data to another company when:

• their processing is based on consent giving or on a contractual obligation and
• data processing is automated.

You have the right directly to transfer personal data from the company to another data controller, where this is technically feasible and does not adversely affect the rights and freedoms of other persons.

Right to object to processing of personal data
You have the right to object to the processing of your personal data when the company processes them on the following grounds:

• performance of a task in the public interest or
• for the purpose of the legitimate interests of the company;

The company terminates data processing, unless proven that there are no convincing legal grounds for data processing.
You have the right at any time to object to the processing of your personal data for the purpose of direct marketing, which includes also profiling.

Automated taking individual decisions, including profiling
You have the right not to be subject to a decision based solely on the automated processing, including profiling, which gives rise to legal consequences for you, unless such decision:

• is necessary for the conclusion or execution of a contract with you;
• is allowed according to the law;
• is based on your express consent.

Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data is made in violation of the applicable regulations, you have the right to submit a complaint to the Commission for Personal Data Protection.