GDPR policy

The Grigor Dimitrov Foundation (GDF) is a non-profit legal entity

Registered as a public benefit organization.

The Foundation pursues the following goals:

1. The development and promotion of spiritual values, civil society, education, and physical culture;
2. Discovering and supporting talented children and young people in their efforts and aspirations to develop in the fields of culture and sports, science and technology, healthy lifestyles, ecology, and civic education;
3. Supporting disadvantaged children and young people, including their integration into society;
4. Supporting children and their families in coping with poverty and social isolation;
5. Encouraging the development of young people’s talents, including, but not limited to, supporting education, the acquisition of knowledge and skills, and cultural development;
6. Promoting the achievements of Bulgarian sport;
7. Creating continuity between generations in sport;
8. Carrying out activities aimed at stimulating the interest of children and young people in systematic and consistent participation in various sports disciplines, arts, and other cultural activities;
9. Encouraging the development and establishment of the principle of non-discrimination and supporting social integration and personal fulfillment;
10. Supporting and encouraging philanthropy and charitable traditions;
11. Supporting other organizations with goals similar to those of the Foundation.

 

The Foundation achieves its goals through the following means and activities:

1. Establishing a special donation fund to finance the Foundation’s projects;
2. Initiating, supporting, and implementing projects in the field of physical education and sports;
3. Initiating and conducting fundraising campaigns and charity events to raise funds and finance the Foundation’s projects;
4. Awarding scholarships to children and young people with outstanding talents and achievements;
5. Supporting the participation of children and young people in competitions, festivals, sports competitions, and other similar forums;
6. Developing and implementing training and educational programs;
7. Organizing and conducting conferences, seminars, training sessions, and other events related to the Foundation’s goals;
8. Organizing all kinds of sports and cultural events to raise money for the Foundation’s projects;
9. Publishing informational materials;
10. Maintaining active contacts with organizations in Bulgaria and abroad for the purpose of exchanging information on good practices in the Foundation’s areas of activity, as well as mutual support in participating in partnership projects;
11. Financing other foundations, provided that the goals/projects of the other foundations fall within the scope of the Foundation’s goals;
12. Other activities related to the Foundation’s goals.

FRGI is a personal data administrator within the meaning of the Personal Data Protection Act (PDPA).

 

1. Objectives and scope of the Personal Data Protection Policy
2. FGD respects the privacy of individuals and takes the necessary measures to protect against the unlawful processing of personal data of individuals with this policy. In accordance with applicable European and national legislation and best practices, FGD implements the required organizational and technical measures for the protection of personal data.
3. With this Personal Data Protection Policy, FGD aims to inform interested parties about the purposes of personal data processing, the grounds for processing, the categories of recipients to whom the data may be disclosed, the consequences of refusing to provide it, as well as information about the right of access, rectification, erasure, and object, in accordance with the requirements of Regulation (EU) 2016/679 and the Personal Data Protection Act.
4. Personal data processed by FGD
5. FGD processes personal data in its capacity as a personal data controller, processing personal data structured in separate registers, which are published in the Public Register of

Registered personal data controllers.

1. FGD processes personal data provided personally by the data subjects to whom it relates in connection with compliance with a legal obligation applicable to the controller.
2. FGD processes personal data provided personally by data subjects in cases the data subject has given consent to the processing of their personal data for one or more specific purposes, where processing is necessary based on contractual requirements or for the purposes of the legitimate interests of the controller.
3. The FGD also processes personal data that has not been received from the data subject to whom it relates, but has been provided by a third party in connection with the performance of a specific contractual obligation for the implementation and management of grant funding programs and projects or activities for the performance of other contractual obligations. In such cases, the person who provided this data to the FRGI is obliged to:
4. provide the data subject with information about the controller – the FGD
5. notify the data subject of the purposes, categories of data provided, and categories of recipients of this data;
6. to provide information on the right of access to and rectification of personal data by the person to whom they relate.
7. (1) The following categories are differentiated from the specific activity or regulatory requirement

Personal data processed by the FGD are data related to:

1. physical identity: name, personal identification number, identity document data, place of birth, address, telephone number, e-mail address;
2. social identity: education, qualifications, legal capacity, position held, employment history and professional biography, citizenship, participation in management bodies of legal entities;
3. economic identity – bank account number (IBAN);

2) In connection with compliance with legal obligations, the FGD collects data on physical and economic identity.

3) Within the framework of a contractual obligation related to the financing of a project/program, with the express consent of the person, information may be requested related to meeting certain requirements for their inclusion (education, belonging to a vulnerable group, ethnicity).

1. The FGD shall specify and announce information on the type of personal data it collects and processes for the various funding programs.

III. Processing of personal data

1. As a personal data controller, FGD processes personal data through a set of actions that can be performed on personal data using automatic or non-automatic means, such as collection, recording, organisation, storage, adaptation or alteration, consultation, use, blocking, erasure and destruction, in compliance with the following principles:
2. lawfulness of personal data processing;
3. proportionality of personal data processing;

Relevance of the personal data processed.

1. The FGD processes personal data independently. Processors on behalf of FGD are, for example, its employees, whose rights and obligations in relation to the processing of personal data of natural persons are duly regulated in the Internal Rules of FGD.
2. Purpose of personal data processing
3. The purpose of personal data processing is to unambiguously identify natural persons, current and future employees of the FGD, contractors, beneficiaries under grant agreements, invitees and participants in events carried out in connection with the performance of the FGD’s activities. The processing of data is a consequence of:
4. the fulfillment of the regulatory obligations of the personal data controller arising from the specific requirements of the legislation governing financial and accounting reporting, pension, health, and social security activities, and human resources management activities;
5. the performance of a contract to which the data subject is a party, or to take

Steps at the request of the data subject prior to entering into a contract;

1. In the performance of activities of the FGD – for one or more specific purposes with the consent of the data subject; for the purposes of the legitimate interests of the controller or a third party with the consent of the data subject.
2. Consequences of refusal to provide personal data
3. The explicit consent of individuals whose data is being processed is not required if the controller has a legal basis for processing personal data. Such grounds include, for example, a statutory obligation in connection with the requirements of labor, tax and social security legislation, the Obligations and Contracts Act, the Accounting Act, the Anti-Money Laundering Act, the Anti-Terrorism Financing Act, etc.
4. In case of refusal to voluntarily provide the requested personal data, the FGD will not be able to fulfill its statutory or contractual obligations, including not being able to provide a free service or funding to the person refusing to provide their personal data, a beneficiary under a project implemented by the FGD or under a project financed by a fund or grant program managed by the FGD.
5. Disclosure of personal data
6. As a personal data controller, the FGD has the right to disclose the personal data it processes only to the following categories of persons:
7. natural persons to whom the data relate;
8. persons whose right of access is established by law;
9. persons whose right derives from a contract.

VII. Rights of data subjects

1. Individuals whose personal data is processed have the following rights:
2. The right to be informed about the data identifying the controller, the purposes of the processing of personal data, the recipients or categories of recipients to whom the data may be disclosed, the mandatory or voluntary nature of the provision of personal data and the consequences of refusing to provide it.
3. Right of access to data relating to natural persons. In cases where granting the right of access to the data subject may reveal personal data about a third party, the controller is obliged to grant partial access to them without revealing data about the third party.
4. Right to correct or supplement inaccurate or incomplete personal data.
5. Right to erasure of personal data whose processing does not comply with the regulatory requirements or whose legal basis has ceased to exist (expired storage period, withdrawn consent, fulfilled initial purpose for which the data was collected, etc.), as well as the right to request that third parties to whom the personal data of the person has been disclosed be notified of any erasure, correction, or blocking that has been carried out, except in cases where this is impossible or involves excessive effort.
6. Right to object to the controller against the processing and/or disclosure of personal data of the data subject where there is a legal basis for doing so. Right to be notified before his/her personal data is disclosed to third parties where there is a legal basis for doing so.
7. Right to protection before the CPDP or through legal proceedings.

VIII. Procedure for exercising rights

1) Natural persons exercise their rights by submitting a written request to the FGD (on paper or by email), containing at least the following information:

1. Name, address, and other data identifying the natural person concerned;
2. Description of the request;
3. Preferred form of providing information;
4. Signature, date of submission of the request, and correspondence address.

2) The entire procedure for exercising the rights of a natural person in relation to their personal data is free of charge for the person.

3) In order to avoid abuse, when submitting an application by an authorized person, a notarized power of attorney shall be attached to the application.

1. The deadline for reviewing the application and issuing a decision by the administrator is 14 days from the date of submission of the application, or 30 days when more time is needed to collect the requested data and in view of the complexity of the request.
2. FRGI shall prepare a written response and communicate it to the applicant in person – against signature or by mail/courier with return receipt, taking into account the applicant’s preferred form of information delivery.
3. Where the data subject to the request does not exist or its provision is prohibited by law, the applicant shall be denied access to it.
4. If the FGDI does not respond to the applicant within the specified time limits or the applicant is not satisfied with the response received and/or considers that his rights relating to the protection of personal data, he/she has the right to exercise his/her right of protection before the competent

Authorities.

1. Terms and definitions used
2. For the purposes of this Policy:
3. “Personal data” means any information relating to an identified natural person or a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, or to one or more specific characteristics.
4. “Processing of personal data” means any operation or set of operations performed on personal data or on sets of personal data, whether by automated means or otherwise, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
5. “Personal data controller” is the FGD.
6. “Personal data register” is any structured set of personal data accessible according to specific criteria, in accordance with the Internal Rules of the GRIGOR DIMITROV FOUNDATION, which may be centralized or decentralized and is distributed on a functional basis. This Personal Data Protection Policy of the GRIGOR DIMITROV Foundation was approved by Order of the Director on ……………….. and enters into force on the same date.