1.  Introduction

BCSU values each of our students, supporters and staff. We are committed to good stewardship of your information and to protecting your privacy. We are committed to working in a transparent, ethical, responsible and honest way. This policy outlines what kind of information we gather, how we use it, how we keep it safe and how this affects you. 

​

Your Responsibility

• Familiarize yourself with the policy.

• If you are in a contractual relationship with us, please review the related terms and/or policies: they may contain additional details on how we collect and process your data.

• If you provide us with personal information about other people, or if others provide us with your information, we will only use this information for the specific purpose for which it was provided to us. If you provide us with information about third parties, you should have a legal basis for doing this, and you should also inform the third parties about the way we process their data.

• By providing us with personal data, you declare that you are over eighteen years of age.

​

2. Who we are and how to contact us

BCSU is a movement of students, built into communities of disciples, transformed by the gospel and impacting the university, the church, and society for the glory of Christ. We strive to give every student opportunities to grow in their faith, to develop leadership skills, and to learn to take an active role in their own growth as well as to be positive participants in society. You can find more information about us here.

​

BCSU is a registered organization in Bulgaria. We are "administrators" with respect to your personal data and are responsible for them. Contact us:

Bulgarian Christian Student Union
bul. "Hristo Botev" 13, ap. 8
Sofia, 1606

Bulgaria
tel.: 02/ 953 1092
e-mail: office@bhss-org.com

​

It is very important that the information we have for you is accurate and up-to-date. Please inform us when making changes or if you notice any errors.

​

3. What data do we process - how and why?

We collect only the information we need to do what you specifically ask us to do, to improve our services, to enable staff to perform their work or to fulfill the mission of BCSU. We do not sell, rent out or otherwise provide personal data to parties outside of BCSU. When asked to provide personal information, you will be told why it is collected and how BCSU will use it. In our correspondence we will always offer you the opportunity to opt out of future similar correspondence. You can also contact us at any time to unsubscribe from any correspondence or to delete your data from our archives.

​

We collect data in the following ways:

​

3.1. When you visit our website - bhss-org.com:

A) Automatically collected information: You can access the website without entering personal information. However, we do automatically collect and process some information, such as Log-in Files, Cookies and Website Analytics via Google Analytics.

​

B) Social plug-ins or buttons/Facebook, Instagram or others. Using theses links is your responsibility. These buttons represent a link to third-party sites that, through cookies, collect and process personal data according to their policies. We are not responsible for them, but we encourage you to become aware of their policies. We've added these links to make our website more visitor-friendly and to promote our business and services. We believe that this is according to our rights and interests.

​

C) Links to other sites. Our site includes links to other sites. If you choose to follow these links, please take a closer look at the privacy policies of those sites to understand how your information will be handled by these third parties.

 

D) Personal data you provide us through the website. When you use our contact form or other service on our website, we process the personal data for the purpose for which you provided it. Required fields in contact forms are the minimum information we have deemed necessary to collect for the purposes of these actions. Please do not provide us with personal information about you that is not necessary for the purpose. We also process the information included in these interactions, for example, the content of a message sent via the website. If you apply to work with us, please refer to 3.10. below.

 

G) Personal data collected during online sign-up. You can register for a BCSU event on our website. In this case, we will collect and process the necessary data from you for the event (i.e., name and surname, email, dietary requirements, and required payment information).

​

F) Subscription to newsletters. When you subscribe to our newsletter, we collect and process the data listed on the registration form. We use this data to send you the information you have requested from us. You can contact us at any time to unsubscribe.

​

H) Your sensitive information. We do not collect sensitive data. These categories of data reveal racial or ethnic origin, political opinions, religious or philosophical beliefs or membership of trade unions, genetic data, biometrics, data on health conditions, sexual life, or sexual orientation. Please do not provide us with such data. Providing such data, as well as, other personal data that are not necessary for the purpose of our interaction with you, exposes you to an unnecessary risk.

 

I) Combination of information. Sometimes we combine information collected through the website with data that we have received from you through different channels of communication (for example, by email or phone) or from other sources - public sources such as the Commercial Register or third parties - rating companies, professional profiles, or our common partners. When we combine this information, we do not use it for a different purpose than for which we have informed you.

​

3.2. When you are a participant in one of our events (conference, club, discussion group, etc.): 

We will collect the necessary information for your participation. Sometimes we may ask for information about your preferences to make the event more enjoyable or useful for you. In some cases, events can be filmed with cameras and we may use photos and videos from these events to advertise a similar event on our website or to present our ministry to others. If this concerns you, you may inform us in advance that you do not wish us to post information about you or your image. We will also keep basic information about you in order to  send you information about other similar events. We may also ask you for feedback on our event. You are always entitled to refuse the use of this data as described below in connection with your rights.

​

3.3. When you participate in a promotional event:

Sometimes we organize promotional campaigns, for example through our social networking profile. In this cases, we will process the information you provide to us for the purpose of your participation in the relevant campaign.

​

3.4. When you follow us on social media:
If you "like" our social networking account or "follow" us, you will see messages, advertisements, or posted materials by us on our site. If you contact us through these pages (for example, if you comment on our post) we may use the same network to respond to you, and if you have asked us to contact you otherwise (for example, by giving us your phone number), we will comply with your wish.

​

3.5. When you participate in a conference or training event:
We will collect the necessary information to register you. We will process information about your participation, performance, and exam (if any). We will also keep basic information about you in order to contact you occasionally to send you information about other similar trainings. We may also ask you for feedback on how you evaluate our event. You are always entitled to refuse the use of this data as described below in connection with your rights.

​

3.6. When you are a ministry partner:
This means that you donate financially to BCSU to support its activity and purpose. In this case, we will collect and retain the necessary information, including your name, address, telephone and e-mail, in order to prepare tax documents, send you financial reports, and request additional donations. We will also keep documentation of our correspondence with you so that we know how to contact you in the future.

​

3.7. When you are a potential ministry partner:
This means that you represent a person who shares our values ​​and mission and that you are a potential financial partner in our ministry. We may collect your data from an event, a meeting with one of our staff workers, or a recommendation from another person. In such cases, we will make a determination as to what purpose and on what basis we may use your contact details. We will take into account the context in which this happened and your reasonable expectations about the use of your personal data, if we believe that there is a legitimate interest to contact you in order to present the activities and needs. You are always entitled to refuse the use of this data as described below in connection with your rights.

​

3.8. When you are our buisness partner:
This means that you represent an organization - partner, client or supplier or that you are an employee of such an organization. In order to maintain our business relationship with the organization, we will often need information about you, for example: your name, phone, email, skype contact, business card, and information about your position in the organization. We will also process the following information: correspondence with you, data contained in documentation about our relationship with the organization, such as your signatures, a description of your behavior, your statements, etc ., as well as any other information we need in connection with the business relationship with the organization.

 

3.9. When you are a potential business partner: 
This means that you represent an organization - a potential partner, customer or supplier, or that you are an employee of such an organization. We may have your information from a professional public register, from a common business contact that has recommended you, or from a business card you have given us. In this case, we will make a determination as to what purpose and on what basis we may use your contact details. We will take into account your reasonable expectations about the use of your personal data. If we believe that we have a legitimate interest in contacting you to request an offer, offer a partnership, or offer you a product or service to you, you are always entitled to refuse the use of this data as described below in connection with your rights.

​

3.10. If apply for work or internship: 
This means that you have expressed your desire to become our employee by signing a contract with us or becoming an intern with us. This can be done in two cases: when you apply for an publicized position by sending us your CV and / or motivation letter or when you send us your CV and / or motivation letter without a specific advertised position. We will contact you if there is an appropriate position and we will look at the information you have submitted. If we believe that you are unsuited for a position with us, we will delete your personal data within one week from this decision but no later than two months of the deadline. If you apply for a particular position, but for some reason we cannot hire you at that time, and we wish to keep your information in the future for other relevant positions, we will contact you to request your consent for this. If you are not applying for a particular position, we will assume that you are interested in our organization as a whole. If so, we will keep your information in order to offer you a future job on the basis of our legitimate interest in selecting and hiring employees who have shown interest in our organization. In this situation, we will keep information about you for the period you have expressed, or if you have not specified, we will keep it for a period of up to three years. During your application, we will also collect and store additional information about you to assess whether we want to hire you, for example, information about your interview with us, and the references you have provided. When we consider that you are unqualified, we will delete the information we have about you. Please do not provide us with any information that is not necessary in order to apply for work with us.

​

3.11. What are other reasons we might collect your data?
Above we have described the most typical reasons for processing your data, but you should also keep in mind the following reasons:

• to administer our business, including accounting and analysis within the company itself;

• prevention of fraud and other illegal and criminal activities;

• for establishing and protecting legal claims;

• to fulfill our obligations under a contract to which you are a party to;

• to fulfill our obligations under a contract to which you are not a party to;

• to analyze the effectiveness of our services and activities and to improve them;

• to fulfill our statutory obligations, such as accounting, tax and other obligations.

​

3.12. On what basis do we process your data?

3.12.1. Our legal obligation

These are the cases in which the processing of your personal data is necessary to comply with our legal obligation.

​

3.12.2.Our legitimate interest  
When we define our legal basis as "legitimate interest", we first determine what this is and whether processing your data is necessary to achieve it. We also assess whether your interests, fundamental rights and freedoms do not take precedence over these interests. Notwithstanding our judgment, you are always entitled to object to our legitimate interest as described below in paragraph 9.1.4.

​

3.12.3. Pre-agreed or contractual grounds
When we should take the necessary steps, at your request, to conclude a contract with us or to execute a contract already concluded between us. In these cases, we will be careful to process only the vital information.

​

3.12.4. Your agreement.
This is a free, specific, informed and unambiguous expression of your consent to process your personal data by means of a statement or a clear act of confirmation. If we need to process your "sensitive data" on your consent, it should also be explicitly given. 9.1.7. describes how you can withdraw your consent at any time. If you have concerns about the exact reason for processing your data, you can always contact us.

​

4. Can you not provide your personal data?

You are required to provide us with your personal data if there is such a contractual or statutory obligation. If, in such cases, you do not provide us with this data on request, we may not be able to conclude or execute the contract or realize other purposes. In this case, we will let you know.

 

5. With whom do we share your personal data?  

We may need to share your personal information with the parties listed below:

 

5.1. Within our team based on our legitimate interest in administering and reporting our business.

 

5.2. Service Providers - Processors of Personal Data. These can be hosting companies, IT service providers, system administration, couriers, mobile operators. We create contracts with them that guarantee the security of your data.

 

5.3. Other personal data administrators who provide us with relevant services - banks, auditors, lawyers, professional consultants and insurers, event organizers, etc. - when it is necessary for our legitimate interest to provide us with a particular service.

​

5.4. Public bodies that require us to declare and process activities.

​

5.5. Third parties with whom we sell, transfer or merge parts of our business or assets - where necessary in view of their legitimate interest in conducting an analysis of our business and entering into the relevant transaction.

 

6. International transaction of information

6.1. Your personal data is usually processed within the European Union or the European Economic Area and is rarely transferred to other countries ("third countries").

​

6.2. If data transmission is required in "another country", we ensure that prior to such transmission the necessary data protection level in the third country or recipient in that third country is ensured. This may be based on a European Commission decision on the adequate level of data protection in a particular third country as a whole. Alternatively, data transmission may be based on "Standard Contractual Clauses in the EU", or if the recipients are in the United States on the basis of the US-EU Privacy Program. Information on EU-US Privacy Shield participants can be found at www.privacyshield.gov/list.

​

7. Information security

We have implemented security measures to prevent the accidental loss, use, modification, disclosure or access of your personal data without permission. We also provide access to your personal data only to those employees and partners who have a specific need to access such data.

​

BCSU does its best to maintain a high level of data security for all data possessed. The information is stored on secure servers in our office and on a cloud. We also store information in paper files in locked cabinets. We guarantee that access to personal data is restricted to authorized personnel who are appropriately trained. Online forms are protected and routinely monitored. By sending your personal data, you agree to the transfer, storage, or processing described above. We will take all necessary steps to ensure that your data is treated properly and in accordance with these rules.

 

8. Deadline for data storage

We will only retain your personal data for as long as we need to meet the purposes for which we have collected it, including for the purposes of complying with statutory, accounting, tax or reporting requirements.

​

When deciding the exact length of storage for personal data, we take into account their nature and sensitivity, the potential risk of harm from unauthorized use or disclosure, the purposes of processing, and whether they can be achieved by other means as well as legal requirements.

​

For tax purposes, the law requires us to store basic information about our clients (including contact details, identity, financial data, and transaction data) for five years (including the current year) after the relevant relationship has ended.

​

In many cases, we will comply with the limitation periods under applicable law, for example, for bringing certain claims, which is in our legitimate interest.

​

In some circumstances, we may anonymize your personal data for research, statistical or other purposes, in which case we may use this information for an unlimited period of time without further notice to you.

 

9. Your rights

9.1. Under certain circumstances, you are legally entitled to:

9.1.1. request access to the personal information we have on you (commonly referred to as "data access request"). This enables you to obtain a copy of the personal information we hold on you and to verify that we are processing it legally.

​

9.1.2. request a correction of the personal information we hold on you. This allows you to correct and update incomplete or inaccurate information we hold on you.

 

9.1.3. ask for the deletion of your personal information. This allows you to ask us to delete or remove personal information when there is no good reason to continue processing it.

​

9.1.4. refuse us to process your personal data when the basis of this processing is our legitimate interest (or that of a third party) and you provide grounds about your particular situation. In addition, you have the right to object to the processing of your personal information when the purpose is direct marketing.

​

9.1.5. request a restriction on the processing of your personal information. This allows you to ask us to stop processing personal information about you, while we determine the accuracy or reason for processing it.

 

9.1.6. request transfer of your personal information to another party.

 

9.1.7. withdraw your consent - if we process personal data on your consent or express consent, you have the right to withdraw your consent at any time, without prejudice to the lawfulness of the processing under consent, before it is withdrawn.

 

You can see more about these rights also on the Commission's Privacy Website

​

9.2. Exercising your rights.

If you wish to exercise any of the rights mentioned above or to receive more information about them, please send us an email at office@bhss-org.com or send us a letter to our physical address mentioned in item 3.

​

You will not pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your application is manifestly unfounded, repeated or excessive, or we will refuse to execute your request in these circumstances.

​

We may need to ask you for specific information to help us verify your identity and to guarantee your right to access your personal data (or to exercise any of your other rights). This is a security measure that ensures that personal data is not disclosed to a person who is not entitled to receive them. We may also contact you to request additional information about your request to expedite your response.

​

We try to respond to all legitimate requests within one month. Sometimes it can take us more than a month, in which case we will let you know.

​

10. Contacting a supervisory authority.

If you are not satisfied with any aspects of how we collect and use your data, you have the right to complain to the relevant supervisory authority. The Commission for the Protection of Personal Data is the Supervisory Authority of the Republic of Bulgaria, as defined by the Personal Data Protection Act, as follows:

Center for information and contact
bul. "Professor Tvetan Lazarov" № 2
Sofia 1592

telephone: 02/91-53-518.
e-mail: kzld@cpdp.bg
Website: www.cpdp.bg

​

We would be grateful if you contacted us first about any complaints so that we might try to help you.

​

11. Change of this policy

We have the right to change and update this Policy. We will publish such changes on our bhss-org.com website. If these changes are significant, we will inform you through email or other appropriate means.