Data Subject Complaints and Requests Procedure

PROCEDURE FOR COMMUNICATION METHODS REGARDING COMPLAINTS AND REQUESTS FROM DATA SUBJECTS I. Purpose of the Procedure This procedure covers: - complaints and requests from data subjects related to the processing of their personal data by Broker Ins OOD; - the handling of requests from data subjects concerning the exercise of their rights under the GDPR; - complaints by data subjects regarding the way their requests or complaints have been handled. II. Regulatory Framework - Article 12 of the General Data Protection Regulation (GDPR) - Guidelines on transparency under Regulation 2016/679 III. Duties and Roles All employees of the Controller are responsible for ensuring that complaints and requests submitted by data subjects are forwarded, through the appropriate channel, to the Data Protection Officer. The Data Protection Officer is responsible for handling all requests and complaints in accordance with the provisions of this procedure. IV. Procedure 1. General Information and Notices Broker Ins OOD publishes the contact details of its Data Protection Officer on its website at www.brokerins.bg. Broker Ins OOD provides clear and understandable instructions on its website regarding the submission of requests and complaints at www.brokerins.bg. Broker Ins OOD provides data subjects with public access to its Privacy Statement (Notice on the Confidential Treatment of Personal Data) by publishing it on its website, www.brokerins.bg, so that it is clearly visible. Broker Ins OOD documents all actions relating to communication with data subjects in the Register of Requests. 2. Options Available to the Data Subject Data subjects may submit to Broker Ins OOD: - requests to exercise their data protection rights – a request for access, erasure, restriction of processing, objection to processing, or data portability; - complaints regarding the handling of their request for access to data; - complaints regarding the handling of their request/complaint; - an appeal against any decision made following a submitted request/complaint. 3. How to Submit Requests and Complaints A request to exercise rights is made personally by the data subject, by their legal representative, or by an authorized person on the basis of a written power of attorney with notarized signature. The data subject must submit the request in writing. Oral requests are not valid. Requests filed and sent in paper form must bear the handwritten signature of the data subject or their representative, and when a request is submitted in electronic form, the statement file or the email through which it is sent must be signed with a qualified electronic signature in accordance with the Electronic Document and Electronic Trust Services Act. Data subjects may submit their requests and complaints using the Data Subject Request Form or in free-text form, in Bulgarian. Where the request is submitted in free-text form, it must contain: - identity document details – first name, middle name, surname, and address of the data subject or their representative, together with evidence of the representative's authority (power of attorney, parent–child relationship, guardianship, etc.) – for identification purposes; - the substance of the request; - a physical or electronic address, in accordance with the preferred form of communication. The request must be signed by the data subject or their representative and submitted to Broker Ins OOD by one of the following means: - by post, sent in paper form to the address of Broker Ins OOD – Sofia, 3 Karnigradska St.; - in person, at the address above or at any of the Controller's offices; - by email, to the following address: gdpr@brokerins.bg. 4. Response and Deadlines The receipt, registration, allocation, and response to requests for the exercise of rights by data subjects are governed by the Procedure for Managing Data Subject Requests. Broker Ins OOD reviews and decides on any request or complaint received in accordance with the following rules and deadlines: - Requests/complaints are forwarded to the Data Protection Officer, who must make a decision and provide a response to the data subject no later than one month¹ from the date of receipt; - An appeal against a decision must be reviewed and resolved within one month. - If Broker Ins OOD does not fulfill the data subject's request within the required deadlines, or refuses to uphold the complaint, it shall set out, in clear and understandable language, in its response the reasons for not taking action or for the refusal. - Broker Ins OOD also informs the data subject in its response of their right to lodge a complaint directly with the supervisory authority – the Commission for Personal Data Protection – while at the same time providing the data subject with the supervisory authority's contact details and informing them of their right to seek legal remedy. All actions taken by Broker Ins OOD in the performance of this procedure are carried out free of charge to the data subject. V. Annexes - Data Subject Request Form template; - Privacy Statement (Notice on the Confidential Treatment of Personal Data) Contact with the Data Controller: Website: www.brokerins.bg Email: gdpr@brokerins.bg Phone: 024224244