Privacy and Personal Data Protection Policy

PRIVACY AND PERSONAL DATA PROTECTION POLICY 1. GENERAL PROVISIONS This Privacy and Personal Data Protection Policy ("the Policy") governs the manner in which "Broker Ins" OOD, in its capacity as a licensed insurance broker and Personal Data Controller, collects, processes, stores, transfers, and protects the personal data of: • Users and visitors of the online portal www.brokerins.bg ("the Site") and its related mobile applications; • Clients (natural persons) and representatives/contact persons of legal entities that are users of insurance services; • Counterparties, contractors, and their representatives; • Third parties involved in the process of administering insurance claims and loss settlement. "Broker Ins" OOD carries out its activity in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation), the Personal Data Protection Act (PDPA), the Insurance Code, the Measures Against Money Laundering Act, the Measures Against the Financing of Terrorism and the Proliferation of Weapons of Mass Destruction Act, the Accountancy Act, and applicable Bulgarian and European legislation. 2. INFORMATION ABOUT THE CONTROLLER AND THE DATA PROTECTION OFFICER (DPO) 2.1. Information about the Controller • Name: "Broker Ins" OOD • UIC: 121773065 • Registered office and address of management: Bulgaria, Sofia 1000, "Triaditsa" district, 3 Karnigradska St. • Phone: 02 422 4244 • E-mail: gdpr@brokerins.bg; office@brokerins.bg • Website: www.24ins.bg • License and registration: "Broker Ins" OOD is an insurance broker entered in the public register under Art. 30, para. 1, item 12 of the Financial Supervision Commission Act, by Decision No. 499-ZB of 21.07.2006, registration No. 11-8. The registration may be verified at: Sofia, 16 Budapeshta St., or on the Financial Supervision Commission's website: www.fsc.bg. • Legal status: "Broker Ins" OOD does not carry out insurance intermediation on behalf of an insurer but represents the users of insurance services. 2.2. Data Protection Officer (DPO) For questions relating to the processing of personal data and the exercise of your rights under the GDPR, you may contact our DPO: • Correspondence address: Sofia 1000, 3 Karnigradska St., for the attention of the DPO • E-mail: gdpr@brokerins.bg • Phone: 02 422 4244 3. PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA When processing personal data, "Broker Ins" OOD is guided by the following core principles: 1. Lawfulness, fairness, and transparency – processing takes place only where an appropriate legal basis exists, and with clear information provided to the data subject; 2. Purpose limitation – data is collected only for specified, explicit, and legitimate purposes; 3. Data minimisation – the data processed is adequate, relevant, and limited to what is necessary for the purposes; 4. Accuracy – data is kept accurate and up to date; 5. Storage limitation – data is kept in a form permitting identification for no longer than is necessary; 6. Integrity and confidentiality – an appropriate level of security is ensured through technical and organisational measures. 4. CATEGORIES OF PERSONAL DATA AND SOURCES 4.1. Categories of Data Processed Depending on the services used, the insurance products, and the type of relationship, we collect and process: 1. Basic identification information: o Full name (first name, middle name, surname); o National ID number (EGN) / personal number of a foreigner (LNCh) / date of birth (for foreign nationals); o Identity document data (number, date of issue, issuing authority). 2. Contact details: o Physical address (permanent, current, correspondence, and/or delivery address for original policies); o Telephone number; o E-mail address. 3. Data about the insured object: o For motor vehicles: registration number, vehicle identification number (VIN), data from the registration certificate, ownership; o For real estate and property: address, floor area, type of construction, structural and security features; o For other types of property/interests: economic, financial, and other characteristics specific to the subject matter of the insurance cover. 4. Special categories of data (health data): o Data relating to health status, medical diagnoses, discharge summaries, TELK (medical disability assessment) decisions, sick-leave certificates, etc. – collected only when concluding health/medical/accident insurance or when administering and settling insurance claims. 5. Financial and payment data: o Bank account (IBAN) and account holder (for making payments under contracts or refunds); o Online payment data – processed through certified payment intermediaries (payment gateways). "Broker Ins" OOD does NOT store full bank card data (cardholder data). 6. User-account and technical data (online portal): o Username, password (encrypted/hashed); o IP address, access log files, browser type and version, operating system, unique device identifiers. 4.2. Sources of the Data "Broker Ins" OOD processes personal data received from the following sources: • Directly from the data subject: completing forms on the Site, submitting requests for a quote, registering a profile, concluding contracts, submitting claim notifications; • Official public registers: the Registry Agency – the Commercial Register and the Register of Non-Profit Legal Entities, the Property Register, and others; • Third parties: insurance companies, medical institutions, employers (in the case of group/collective insurance), for the purpose of performing intermediary functions. 5. PURPOSES AND LEGAL BASES FOR PROCESSING We process your personal data only where a legal basis exists under Art. 6 and Art. 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016: Purpose of processing Categories of data Legal basis under the GDPR Requesting quotes, preparing proposals, and concluding insurance contracts Identification, contact, and insured-object data Art. 6(1)(b) – for taking steps at the request of the data subject prior to entering into a contract, and for the performance of a contract. Administering insurance claims and settling losses Identification, contact, claim data, health data Art. 6(1)(b) (contract) and Art. 9(2) (for special categories of health data). Accounting and making payments Identification, financial, policy/contract data Art. 6(1)(c) – compliance with statutory obligations under the Accountancy Act and the Tax and Social Insurance Procedure Code. Compliance with obligations under the Measures Against Money Laundering Act, the Measures Against the Financing of Terrorism and the Proliferation of Weapons of Mass Destruction Act, and supervisory requirements (FSC, Insurance Code) Identification data, identity document, source of funds Art. 6(1)(c) – compliance with statutory obligations for identification, prevention of money laundering, and conflict of interest. Contacting and communicating about the performance/non-performance of contracts Name, phone, e-mail, address Art. 6(1)(b) (contract) and Art. 6(1)(f) (legitimate interest). Direct marketing, newsletters, and promotional notices Name, e-mail, phone Art. 6(1)(a) – explicit consent (may be withdrawn at any time). Ensuring cybersecurity, fraud prevention, and legitimate defence in disputes IP address, technical logs, contractual and accounting information Art. 6(1)(f) – legitimate interest in protecting the Controller's rights, network, and services. 6. AUTOMATED DECISION-MAKING AND PROFILING "Broker Ins" OOD does not use your personal data for automated decision-making that produces legal effects concerning you, or similarly significantly affects you, within the meaning of Art. 22 of the GDPR. For the purpose of providing electronic insurance services through Broker Ins Mobile, the system carries out automated processing of data to calculate insurance premiums and generate quotes. All rates and quotes are based on objective technical and underwriting criteria (e.g. age, insurance history, characteristics of the insured object) determined by the relevant insurance companies. Where a quote or rate is generated on the basis of wholly automated profiling, you have the right: • To request human intervention and review of the quote by a qualified "Broker Ins" employee; • To express your views or challenge the calculated rate/quote; • To obtain an explanation of the logic used in determining the price. 7. CATEGORIES OF RECIPIENTS OF PERSONAL DATA "Broker Ins" OOD ensures that access to your data is limited to persons who need it to achieve the stated purposes. Data is disclosed only to the following categories of recipients: 1. Insurance companies – licensed insurers with whom "Broker Ins" OOD has concluded intermediation agreements, for the purpose of preparing quotes, issuing insurance policies, and administering/settling claims. 2. Data processors (external service providers): o IT and hosting providers: for maintaining the servers, website, and databases; o Payment service providers: (ePay, Borica, commercial banks) for the secure processing of online payments; o Courier and postal operators: (Econt, Speedy, etc.) for the physical delivery of insurance policies and original documents. 3. State, regulatory, and supervisory authorities: o The Financial Supervision Commission (FSC), the Commission for Personal Data Protection (CPDP), the National Revenue Agency (NRA), the Ministry of Interior, the State Agency for National Security, and judicial authorities – where required by law or upon express order under Bulgarian legislation. 8. INTERNATIONAL DATA TRANSFERS All personal data collected is stored and processed within the territory of the Republic of Bulgaria and within the European Economic Area (EEA). "Broker Ins" OOD does not intend to transfer personal data to third countries outside the EEA or to international organisations without prior notice to and consent from you. Should such a transfer become necessary (e.g. use of global cloud services), it is carried out in compliance with Chapter V of the GDPR through: • European Commission adequacy decisions (e.g. the EU–US Data Privacy Framework); • The application of Standard Contractual Clauses (SCCs) approved by the European Commission. 9. DATA RETENTION PERIODS "Broker Ins" OOD retains your personal data for the period necessary to achieve the purposes for which it was collected, in compliance with applicable legislation and the following specific periods: 1. Insurance policies, files, and contracts – 5 (five) years from termination/expiry of the insurance contract or from the final settlement of an insurance claim (in accordance with the general limitation period under the Obligations and Contracts Act and the requirements of the Insurance Code). 2. Accounting and financial documents – 10 (ten) years, calculated from 1 January of the year following the year in which they were drawn up (in accordance with the Accountancy Act). 3. Data under the anti-money-laundering and counter-terrorist-financing legislation – 5 (five) years from termination of the relationship, with the possibility of extension upon express instruction from the competent authorities. 4. Online profile data on www.brokerins.bg – until the profile is deleted by the user, or after 2 (two) years of complete inactivity (unless the data forms part of active insurance files). 5. Direct marketing data – until the consent given by the data subject is withdrawn. 6. Data processed for legitimate-interest purposes (legal disputes) – until the final resolution of the dispute and/or the extinguishment of the right under the Civil Procedure Code. Upon expiry of the retention period or where the legal basis ceases to apply, personal data is securely destroyed or erased without undue delay. 10. RIGHTS OF DATA SUBJECTS As a data subject under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, you have the following rights: 1. Right of access – to request confirmation as to whether your data is being processed, and to obtain a copy of it. 2. Right to rectification – to request correction of inaccurate data or completion of incomplete personal data. 3. Right to erasure ("right to be forgotten") – to request erasure of your personal data where the statutory grounds for this are met (e.g. the purpose has been achieved, consent has been withdrawn, the data is being processed unlawfully). 4. Right to restriction of processing – to request temporary suspension of processing under the conditions of Art. 18 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. 5. Right to data portability – to receive your data in a structured, commonly used, and machine-readable format, or to request its transfer to another controller. 6. Right to object – to object at any time to processing based on legitimate interest, or for direct marketing purposes. 7. Right to withdraw consent – where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal. Procedure for exercising your rights: • Rights are exercised by submitting a written request, using the template, to the DPO at: Sofia 1000, 3 Karnigradska St., or by e-mail: gdpr@brokerins.bg. • To prevent abuse and protect confidentiality, "Broker Ins" OOD requires identification of the applicant (identity verification). • Fees – exercising your rights is free of charge. A reasonable administrative fee may be charged only for manifestly unfounded, excessive, or repetitive requests. • Response period – 1 (one) month from receipt of the request. 11. RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY If you believe that the processing of your personal data infringes the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 or Bulgarian legislation, you have the right, at any time, to lodge a complaint with the competent supervisory authority: • Commission for Personal Data Protection (CPDP) • Address: Sofia 1592, 2 "Prof. Tsvetan Lazarov" Blvd. • Website: www.cpdp.bg • E-mail: kzld@cpdp.bg • Phone: 02 915 3519 12. PROTECTION OF CHILDREN The services of the www.brokerins.bg portal are not intended for persons under 18 years of age without the involvement and consent of their legal representatives (parents/guardians). We do not knowingly collect personal data from children under 14 years of age without express parental consent. If you become aware that a child has provided data without such consent, please contact us so that it can be promptly removed. 13. AMENDMENTS AND UPDATES TO THE POLICY "Broker Ins" OOD reserves the right to periodically update and amend this Privacy Policy in light of changes in legislation or in processing practices. All amendments will be published on the website in a timely manner, indicating the date of the last update. In the event of material changes, registered users will be notified via a notice on the Site or by e-mail. 14. STATEMENT OF ACKNOWLEDGMENT AND CONSENT (Applicable where physically signed by contractors/clients) By signing this document, I confirm that I am familiar with the content of the Privacy and Personal Data Protection Policy of "Broker Ins" OOD, that I have been informed of my rights and of the purposes, legal bases, and periods for the processing of my personal data. City: ........................................... Date: ........................................... Full name: .................................................................................................... Signature: ...........................................