Privacy policy

Data Controller Information

Goldenstein Recruitment EOOD is a company registered in the Commercial Register of the Registry Agency under UIC 207478290, with its registered office and correspondence address at: Sofia, 1 Atanas Dukov Str., 6th Floor, EN Building. Tel.: +359 82 596 087, E-mail: [email protected]

We process your personal data on the following legal grounds:

Your explicit consent – for reviewing your application for a specific job position you have applied for, including recruitment, consulting, analysis, and career support.
The contract concluded between you and us, in order to fulfill our contractual obligations.
Legal obligations imposed by applicable legislation.

The sections below provide information on how your personal data is processed depending on the relevant legal basis.

1. FOR THE PERFORMANCE OF A CONTRACT OR IN THE CONTEXT OF PRE-CONTRACTUAL RELATIONSHIPS AND REVIEW OF YOUR APPLICATION

We process your personal data to review your application, to fulfill contractual and pre-contractual obligations, and to exercise rights under contracts concluded with you.

Purposes of processing:

Establishing your identity
Managing and executing your application, requests, and any concluded contract
Preparing and sending invoices for services used (if applicable)
Storing correspondence related to orders, requests, problem reporting, etc.
Creating a user/candidate profile

Based on the contract between you and us, we process information related to the type and content of the contractual relationship, including:

Contact details
Identification data
Emails, letters, and information regarding your requests, problem reports, complaints, petitions, grievances

Processing these personal data is mandatory for concluding and executing a contract with you.

We may share your personal data with third parties in order to provide high-quality, fast, and comprehensive services.

Recipients of personal data:

Companies – employers

Data collected on this basis is deleted 5 years after the termination of the contractual relationship, regardless of whether it ends due to expiration, termination, or any other reason. This period corresponds to the 5-year limitation period for potential contractual claims.

2. FOR COMPLIANCE WITH LEGAL OBLIGATIONS

Certain legal obligations may require us to process your personal data. In such cases, we must process the data in accordance with applicable laws, for example:

Obligations under the Anti-Money Laundering Act
Providing information to the Consumer Protection Commission or third parties under the Consumer Protection Act
Providing information to the Personal Data Protection Commission under data protection legislation
Obligations under the Accounting Act, the Tax and Social Insurance Procedure Code, and related regulations
Providing information to courts and competent authorities in the context of legal proceedings

Data collected on this basis is deleted after the relevant statutory retention period expires, for example:

Accounting data – 11 years
Information provided to courts or competent authorities – 5 years

When legally required, we may provide your personal data to competent state authorities, natural persons, or legal entities.

3. BASED ON YOUR CONSENT

We process your personal data on this basis only after receiving your explicit, unambiguous, and voluntary consent. Refusing to provide consent will not result in any negative consequences.

Consent constitutes a separate legal basis for processing, and the purposes specified in the consent form do not overlap with those described in this policy. If you give consent, we may send suitable service or product offers until your consent is withdrawn or a contractual relationship ends.

On this basis, we process only the data for which you have given explicit consent. Typical data includes:

Name
Date of birth
Photo
Phone number
Email address
Address
Education, qualifications, and language skills
Work experience, previous employers

We do not share your data with marketing agencies.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Upon withdrawal, we will no longer use your data for the specified purposes.

Data collected on this basis is deleted upon your request or one year after initial collection.

4. PROCESSING OF ANONYMIZED DATA

We process your data for statistical purposes. Such analyses are aggregated and anonymized, making it impossible to identify any specific individual.

5. HOW WE PROTECT YOUR PERSONAL DATA

To ensure adequate protection of company and client data, we implement all necessary organizational and technical measures required by the Personal Data Protection Act and applicable EU legislation.

For maximum security during processing, transfer, and storage, additional mechanisms such as encryption and pseudonymization may be used.

6. RIGHTS OF USERS

Each user of the site has all rights provided under Bulgarian law and EU legislation concerning personal data protection.

Users have the right to:

Be informed about the processing of their personal data
Access their personal data
Correct inaccurate data
Delete personal data (“right to be forgotten”)
Restrict processing
Data portability
Object to processing
Not be subject to automated decision-making, including profiling, which produces legal or significant effects
Seek judicial or administrative remedies in case of violations

Deletion of personal data is possible when:

The data is no longer necessary for the purposes for which it was collected
Consent is withdrawn and no other legal basis exists
The user objects and no overriding legal grounds exist
Data has been processed unlawfully
Data must be deleted to comply with EU or national law
Data was collected in connection with online services offered to children based on parental consent

Restriction of processing is possible when:

The accuracy of personal data is contested
Processing is unlawful but deletion is not desired
Data is required for establishing, exercising, or defending legal claims
An objection has been submitted pending verification of legal grounds

DATA PORTABILITY

Data subjects have the right to receive their personal data in a structured, commonly used, machine-readable format and transfer it to another controller when processing is based on consent or contract and carried out automatically. Direct transfer between controllers is possible when technically feasible.

RIGHT TO OBJECT

Users may object to the processing of their personal data. The controller must cease processing unless compelling legitimate grounds override the interests of the user. For direct marketing purposes, processing must stop immediately upon objection.

COMPLAINT TO SUPERVISORY AUTHORITY

Users have the right to file a complaint with the Personal Data Protection Commission or the competent court if they believe their personal data has been unlawfully processed.

Last updated: 10.12.2025