Personal Data Protection Policy

Infosystems International EAD and the Protection of Your Personal Data

Infosystems International EAD is committed to protecting information relating to identifiable individuals (“personal data”) and complies with the requirements of the Personal Data Protection Regulation, undertaking to:

• Process data in accordance with the personal data protection principles set out in the regulation, and be able to demonstrate this (accountability);
• Ensure data protection by design and by default;
• Appoint a Data Protection Officer who maintains and is responsible for the record of processing activities;
• Notify the supervisory authority and the data subject in the event of a personal data breach, and document every such breach, including the facts relating to the breach, its consequences, and the remedial actions taken;
• Carry out a data protection impact assessment.

Terms and Definitions

Key terms used in personal data protection:

• “personal data” means any information relating to an identified natural person or a natural person who can be identified (“data subject”); a natural person who can be identified is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• “processing of personal data” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• “controller” means a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• “filing system” means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.
• “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• “recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.

Scope of the Personal Data Protection Policy

This Personal Data Protection Policy applies to the personal data we collect from company employees, job applicants, partners, clients and suppliers of products/services.

What Information Do We Collect?

We may collect personal data about you when you are an employee, job applicant, partner, client or supplier. In most cases you provide this information yourself by choosing to send us details about yourself. Depending on the services you use, we may collect the following information about you:

• Name
• Email address
• Postal address
• Date of birth
• Contact telephone number
• Information about your place of work
• IP address
• Device identifier
• Information related to a position you are interested in applying for

Infosystems International EAD may collect information about which parts of our Site you visit, what browser you use and when you visit the Site. However, this information is aggregated and is not used to identify you.

How Do We Use and Share Your Information?

We process the personal data we collect in order to be able to:

• Analyse the use of our Site;
• Respond to your enquiries or other correspondence;
• Provide you with products and services you have requested;
• Meet various requirements — legal, regulatory and compliance-related.

Any information you send us when applying for a job will be used for recruitment purposes; if your application is successful, the relevant information will be used by us to facilitate and maintain the employee-employer relationship.

Infosystems International EAD uses third-party services to support certain activities, including website hosting and maintenance, communications, analytics and recruitment, among others. In some cases these third parties may receive your data. However, Infosystems International EAD will always control and handle the use of your data responsibly.

Cookies and Other Tracking Technologies

Infosystems International EAD uses cookies to collect information about you and to store your online preferences. Cookies are text files containing small amounts of information that are stored on your device when you visit a website. Infosystems International EAD uses the following categories of cookies:

• Category 1: Strictly necessary cookies — required to enable you to navigate the Site and use its features.
• Category 2: Performance cookies — collect information about how visitors use the Site, in order to improve navigation and user experience.
• Category 3: Functionality cookies — remember the choices you make (for example, whether you have accepted or declined analytics and marketing cookies).
• Category 4: Targeting cookies — record the user’s visit to the Site, the pages they have visited and the links they have followed.
• Category 2 and 4 cookies are only set after you click “Accept” in the cookie banner. If you click “Decline”, no such cookies are used. You can change your choice at any time via the “Cookie settings” link at the bottom of every page. Your choice is stored in your browser for 12 months.

Third-Party Analytics and Marketing Services

Once you give your consent via the cookie banner, the Site loads the following services through Google Tag Manager. The legal basis for this processing is your consent (Article 6(1)(a) of Regulation 2016/679), which you may withdraw at any time without affecting the lawfulness of processing carried out before the withdrawal.

• Google Tag Manager and Google Analytics 4 (Google Ireland Limited, Ireland) — visit statistics: pages viewed, traffic source, approximate location (country/city), device and browser type. IP addresses are not stored by Google Analytics 4. Cookies: _ga, _ga_* (up to 2 years). More information: https://policies.google.com/privacy
• HubSpot (HubSpot Ireland Limited, Ireland; data is stored in EU data centres) — analysis of visits and interaction with the Site, and recording of the details you enter in the contact form in our customer relationship management system (only if you have accepted cookies). Cookies: __hstc and hubspotutk (up to 6 months), __hssc (30 minutes), __hssrc (until the browser is closed). More information: https://legal.hubspot.com/privacy-policy
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Ireland) — measuring the performance of our LinkedIn advertising and aggregated statistics about visitors’ professional profiles (e.g. industry, job title). LinkedIn does not provide us with data that identifies you personally. Cookies: li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory, li_fat_id (from 1 day to 1 year). More information: https://www.linkedin.com/legal/privacy-policy
• These providers belong to groups headquartered in the United States and may transfer data outside the European Economic Area. Such transfers take place on the basis of the EU–US Data Privacy Framework or standard contractual clauses approved by the European Commission.

The Contact Form

When you submit a request through the contact form, we process the details you enter: name, organisation, email, phone (optional), the modules you are interested in and your message. We use them to reply to your enquiry and to provide the information or demonstration you requested (Article 6(1)(b) of Regulation 2016/679 — steps taken at your request prior to entering into a contract). The data is sent by email to our sales team and kept for as long as needed for our correspondence with you, unless you ask us to delete it sooner. To protect against abuse, the server keeps the sender’s IP address temporarily, for 10 minutes.

• The Site is hosted by SuperHosting.BG EOOD (Bulgaria). The server records visitors’ IP addresses and browser details in technical logs for security and maintenance purposes.

How We Store Your Information and What Are Your Rights

We retain all information we have collected about you until you request that we amend or delete your personal data, or for as long as permitted by applicable law. You may review, revise, correct, update or change your personal data at any time by contacting us at: office@infosys.bg.

Security

Infosystems International EAD takes measures to protect your personal data from accidental loss and unauthorised access, use, alteration or disclosure. We also take additional information security measures, including access controls, strict physical protection and sound practices for collecting, storing and processing information. However, the Internet is an open system and Infosystems International EAD cannot guarantee that these measures will not be circumvented or that your personal data will not be unlawfully used by unauthorised third parties.

Changes to This Personal Data Protection Policy

If our Personal Data Protection Policy changes in any way, Infosystems International EAD will post an updated version of the policy on this page.

Contact Information

If you have any questions about this policy or your personal data, please contact us at: office@infosys.bg.