Privacy Policy

I. GENERAL INFORMATION ABOUT THE PERSONAL DATA CONTROLLER AND THE PROCESSING ACTIVITIES 

 

This Privacy Policy governs the protection of natural persons with respect to the processing of their personal data by Power Partner Solutions Ltd. when: 

  • they access and interact with the website https://uppsgroup.com; 
  • they are clients or suppliers of the company; 
  • they visit sites of the company or send inquiries, requests or initiate correspondence with it regarding any request or issue; 

Through this policy we strive to provide you with comprehensive information regarding the processing of your personal data in a transparent, accessible and easily understandable manner in accordance with Art. 13 and Art. 14 of (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation or known as the GDPR), hereinafter referred to as "the Regulation”. 

Power Partner Solutions Ltd. (referred to as the "Controller") is a company that processes personal data of natural persons in accordance with the requirements of the Regulation, the Personal Data Protection Act (PDPA), as well as all other regulations related to the processing and protection of personal data of natural persons. For the purposes of this policy, Power Partner Solutions Ltd. is a controller of personal data within the meaning of Art. 4, § 7 of the Regulation, as it determines the purposes and means for processing the personal data of natural persons in carrying out their activities. In certain cases, the company can be defined as a processor. 

 

DATA ABOUT THE PERSONAL DATA CONTROLLER 
Name Power Partner Solutions Ltd. 
UIC 205877724 
Seat and address of management Louis Eyer Str. 67, A-12, Sofia 1404
Contact person Nadezhda Myashkova 
Telephone +359 889 409 999 
Email privacy@uppsgroup.com 

 

If you have any questions, suggestions or need additional information related to the processing of personal data and / or their protection, you can contact us at the coordinates indicated above. 

 

Through the website https://www.itmetamorphosis.com, owned by Power Partner Solutions Ltd., and the services provided through it, the company processes personal data of natural persons. More information about this processing can be found in the specially developed privacy policy posted here.  

 

This policy will provide information on: 

I. General information about the controller of personal data and the processing activities 

II. Terms used and their meaning 

III. Categories of data, purposes, legal bases and retention periods 

IV. What rights do you have and how to exercise them 

V. Information on the supervisory authority 

VI. To whom we provide the personal data related to you 

VII. Security measures 

 

II. TERMS USED AND THEIR MEANING 

 

For the purposes of this policy, the terms used have the following meaning:  

  • „controller“ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Power Partner Solutions Ltd. is the controller of your data. 
  • „personal data“ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; 
  • “supervisory authority ” means an independent public authority which is responsible for monitoring the application of the Regulation in order to protect the fundamental rights and freedoms of natural persons with regard to the processing and to facilitate the free movement of personal data within the Union; 
  •  „personal data breach“ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; 
  • „processing“ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; 
  • „processor“  means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; 
  • „restriction of processing“ means the marking of stored personal data with the aim of limiting their processing in the future; 
  • „consent“ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her; 
  • „data subject“ within the meaning of this Privacy Policy is a natural person whose personal data are subject to processing in the framework of the activities of Power Partner Solutions Ltd. 
  • “destruction“ is the irreversible physical destruction of a material medium. 

Terms not defined in the text above will be interpreted within the meaning given to them in Regulation (EU) 2016/679 (the full text of the Regulation is available at the following link: https://eur-lex.europa.eu/eli/reg/2016/679/oj ) or the relevant normative act, which explicitly provides a definition. 

 

III. CATEGORIES OF DATA, PURPOSES OF THE PROCESSING, LEGAL GROUNDS AND STORAGE PERIODS 

 

The processing of personal data for the purposes of human resources management, incl. of personnel selection and processing of personal data of current and former employees of Power Partner Solutions Ltd., is described in detail in the Internal Rules for Personal Data Protection of which the relevant persons are familiar. Therefore, this category of data subjects is not affected by the present policy.  

 

A.) Personal data obtained from the subject (described in the table below) 

 

Category of subjects; 

Categories and types of personal data 

Purpose of the processing Legal ground and storage period  
Service inquiries; Conclusion and implementation of a contract for software development / consulting services. 

Clients 

Physical identity: name and surname (for clients natural persons - three names and PIN); 

Contact details: email and phone number; 

For clients – legal entities: Three names of the legal representative; two names of a contact person, as well as data on social status: place of work, position. 

1. Individualization of the legal relations with the respective persons; 

2. Information support of activities related to the existence, amendment and termination of the legal relations and preparation of all types of documents in this regard (contracts, handover protocols, invoices, etc.); 

3. Making correspondence related to the fulfillment of contractual obligations; 

4. Implementation of legal requirements of the Commercial Law, Acc. Act, the Law on Corporate Income Tax, etc. 

Conclusion and Performance of a contract / art. 6, § 1, letter “b” of the GDPR/; 

Storage period: up to 5 years from the termination of the contractual basis; 

 

Website visitors using the contact form or making direct inquiries to the company's email; Other persons making inquiries and initiating correspondence 

Physical identity: two or three names; 

Contact details: phone or email address. 

Other information that you provided in your inquiry (which cannot be identified exhaustively in advance). 

 

Processing the inquiry and providing an answer and assistance in connection with the subject of the correspondence; In certain cases - clarification of contractual relations. 

Pre-contractual relations /art. 6, § 1, letter “b” of the GDPR/ or 

Legitimate interest /art. 6, § 1, letter “e” of the GDPR1 / 

Storage period: Up to 1 year, unless the correspondence concerns pre-contractual relations; 

 

Concluding and performing a contract with a supplier (of goods or services) 

Suppliers 

For suppliers – natural persons: Three names and PIN; Contact details: email and phone;  

For suppliers - legal entities: three names of the legal representative of the company, two names of the contact person under the contract, e-mail and telephone, data on his social identity: place of work and position; 

Identical to those described for clients (row 1 of the table); 

Under items 1-3: Conclusion or execution of a contract /Art. 6, § 1, letter “b” of the GDPR/; Storage period: up to 5 years from the termination of the contractual basis; 

Under item 4 - legal obligation / art. 6, § 1, letter “c” of the GDPR /; 

Storage period: according to the law. 

Registration and participation in an event, organized by/together with Power Partner Solutions Ltd.; 

Physical identity: First and last name; 

Contact details: Email; 

Social identity: Place of work;  

1. Individualizing the participant in the event and administering the participation; 

2. Sending a reminder message about the upcoming event and related details. 

3. Other activities directly related to organizing the event and administering your participation in the event. 

Conclusion and performance of a contract / art. 6, § 1, letter “b” of the GDPR/; 

Storage period: up to 5 years from the termination of the contractual basis; 

Contact details: Email; Providing information about future events organized by the Controller. 

Legitimate interest /Art. 6, § 1, letter “е” GDPR/; 

Storage period: 5 years or until objection. 

Image (photograph); Event coverage; Advertising and promotion; 

Consent /Art. 6, § 1, letter “a” GDPR/; 

Storage period: until withdrawal; 

Exercise of rights under the Regulation and undertaking actions in the event of security breaches 

Persons exercising their rights provided for in the Regulation and persons affected by a security breach; 

Physical identity: three names, date of birth; 

Fulfillment of normatively established obligations in accordance with Regulation (EU) 2016/679 and PDPA. 

 

Legal obligation / art. 6, § 1, letter “b” of the GDPR/; Storage period: 5 years from the last action taken. 
Log files / system records Technical information: IP address, browser type, internet service provider Website administration, analysis of visits and user activity. 

Legitimate interest /Art. 6, § 1, letter “е” GDPR/ 

Storage period: 1 year 

 

In case the statutory term for storage of a specific type of document is longer than the one indicated in the table above, the controller shall apply the statutory term. If you wish to receive information about the retention period of a specific document, do not hesitate to contact us at the coordinates specified in this policy. 

 

When providing services through https://uppsgroup.com, as well as in our activities outside the website, we do not process personal data of natural persons under 14 years of age. The services we provide are not intended for persons under this age. If you establish such processing, please inform us immediately so that we can take the necessary action. The company does not implement or use technologies for automated decision-making or profiling. 

 

B.) Personal data obtained through the use of cookies 

 

„Cookies” are a small amount of data that a website stores on a visitor's computer or mobile device. Cookies are divided into the following categories: 

  • strictly necessary - session cookies (the website cannot function properly without them); 
  • functional - these are cookies related to the user's preferences for various options on the site, which he has chosen to display by default or not; 
  • statistical/analytical - these are cookies that allow the site owner to track his traffic and other data related to user interaction with the site (information is anonymous); 
  • marketing - they are mainly used between different sites to be able to display the right ads for a particular user. 

 

We use the following cookies on our website in connection with its operation: 

Host Name Type Description Storage period Legal ground 
https://uppsgroup.com  PHPSESSID First Party Cookie – strictly necessary Session cookies For the period of the session Legitimate interest 
https://uppsgroup.com _ga Statistical Used to distinguish users. 1 year Consent 
https://uppsgroup.com _gid Statistical Used to distinguish users. 24 hours Consent 
https://uppsgroup.com _ga_<container-id> Statistical Used to persist session state. 1 year Consent 
https://uppsgroup.com _gac_gb_<container-id>  Statistical Contains campaign-related information. If you have linked your Google Analytics and Google Ads accounts, Google Ads website conversion tags will read this cookie unless you opt out. 90 days Consent 

 

You can give us consent by activating some or all of the cookies which are not strictly necessary for the functioning of the website.  

By setting up your browser accordingly, you can turn off some cookies. In this case, you may lose some of the functionality of some of the services. 

 

IV. WHAT RIGHTS DO YOU HAVE AND HOW TO EXERCISE THEM? 

 

In the event that Power Partner Solutions Ltd. processes your data, you have the following rights: 

 

Right of access by the data subject 

You have the right to receive confirmation whether we process personal data related to you. In the event that we process such data, we will provide you with a copy of the data as well as the following information: 

  • the purposes of the processing; 
  • the categories of personal data concerned; 
  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; 
  • where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; 
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; 
  • the right to lodge a complaint with a supervisory authority; 
  • where the personal data are not collected from the data subject, any available information as to their source; 
  • the existence of automated decision-making, including profiling and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 

In the event that the documents containing personal data about the subject contain personal data of other persons, they will be deleted in an appropriate manner. 

 

Right to rectification 

You have the right to request that we correct the personal data we process about you in the event that it is inaccurate. If you wish us to supplement your personal data, we will ask you to provide us with a declaration/application containing the relevant information. 

Once we receive your request, we will correct / supplement the data as soon as possible. 

 

Right to erasure (‘right to be forgotten’) 

You have the right to request the deletion of personal data related to you, which will be deleted when any of the following grounds apply: 

  • personal data are no longer needed for the purposes for which they were collected or otherwise processed; 
  • you withdraw your consent on which the data processing is based and we have no other legal basis for their processing; 
  • you object to the processing and there are no legal grounds for the processing to take precedence; 
  • When you object to processing that is carried out for marketing purposes, the grounds are not analyzed and the data is subject to deletion. 
  • your personal data has been processed illegally; 
  • personal data must be deleted in order to comply with a legal obligation under EU law or Bulgarian law; 
  • personal data have been collected in connection with the provision of information society services. 
  • An information society service is any service normally provided for remuneration, at a distance, by electronic means and at the individual request of the recipient of the services. 

Even if we find that any of the hypotheses described above are present, we will not delete your personal data when the processing is necessary for: 

  • exercising the right to freedom of expression and the right to information; 
  • compliance with a legal obligation that requires processing provided for in EU law or Bulgarian law, or for the performance of a task in the public interest, or in the exercise of official powers of the controller; 
  • establishing, exercising or defending legal claims; 
  • two more specific hypotheses set out in Art. 17, § 3, letters “c” and “d” of the Regulation. 

 

Right to restriction of processing 

You have the right to ask us to limit the processing when: 

  • You dispute the accuracy of personal data. In this case, the restriction is carried out for the period necessary for Power Partner Solutions Ltd. to verify the accuracy of the data; 
  • The processing is illegal, but you want the use of personal data to be restricted instead of being deleted; 
  • Power Partner Solutions Ltd. no longer needs personal data for the purposes of processing, but you require them for the establishment, exercise or protection of legal claims; 
  • You have objected to the processing and are awaiting verification that the legitimate interests of Power Partner Solutions Ltd. take precedence over your interests. 

The controller will inform any person to whom data have been disclosed that have been corrected, deleted or restricted, except in cases where this is not possible or requires a disproportionate effort. If you wish, we will let you know who these people are. 

 

Right to data portability 

You have the right to receive the personal data you have provided to us in a structured, widely used and machine-readable format, and to request that we transfer them to another controller of your choice. In order to take such action, the following two prerequisites must be met: 

  • the processing is based on consent or a contractual obligation; and 
  • data to be processed in an automated manner. 

 

Right to object to the processing 

You have the right to object to the processing of your personal data when it is based on: 

  • performing a task in the public interest or in the exercise of official powers conferred on the controller, or 
  • legitimate interest. 

We will stop processing your data immediately if we are unable to prove that there are compelling legal grounds for processing that take precedence over your interests, rights and freedoms, or for establishing, exercising or defending legal claims. 

When we process for marketing purposes, we will stop processing your data as soon as we process your request. 

 

Right to withdraw your consent 

When the processing of your data is based on consent, you have the right to withdraw the consent given at any time by notifying us to the specified contacts. 

 

How to exercise the rights described above? 

 

Step 1.  In case you want to exercise any of your rights, please download the application HERE and fill in the necessary information. The application was created for your convenience, but you are not obligated to use it. 

If you prefer, you can send us a request in free form, which must contain the following information: 

  • Name, surname and middle name; 
  • PIN or date of birth (only if you have provided us with such information so far); 
  • address; 
  • address for correspondence; 
  • description of the request; 
  • preferred form of response and information; 
  • signature; 
  • date. 

 

Step 2. Please send your application in one of the following ways: 

  • by email to privacy@uppsgroup.com or 
  • by post or in person at the address: Louis Eyer Str. 67, A-12, Sofia 1404

 
        Where the application is submitted by an authorized person, a power of attorney must be attached. 

 

Step 3. After reviewing your application, we will analyze its content and, if necessary, ask for additional information. You will receive information about its processing within one month of sending it in the manner specified by you as preferred for communication. 

 

Step 4.  In case you need assistance in filling out the form we offer, you can contact us at the contact details provided in this policy. We have prepared brief instructions for your convenience within the application (page 3): HERE  

 

You should be aware that Power Partner Solutions Ltd. may refuse to fully or partially satisfy any of the rights described above when exercising them would pose a risk to public order and security, the prevention, investigation and prosecution of criminal offenses or the execution of criminal penalties, other important objectives of general public interest, in particular an important economic or financial interest, including monetary, budgetary and fiscal matters, public health and social security, the protection of the data subject or the rights and freedoms of others, or the enforcement of civil actions. 

 

 In addition to the rights described above, you have the right to: 

 

Lodge a complaint with a supervisory authority 

 

Every data subject has the right to lodge a complaint with a supervisory authority if he/she considers that the processing of personal data concerning him/her violates the provisions of the Regulation or the LPPD. If the subject has a place of work or habitual residence in the Republic of Bulgaria, as well as when the violation was committed in the Republic of Bulgaria, the latter should refer to the Commission for Personal Data Protection (CPDP) within 6 months of learning of the violation and no later than 2 years from its implementation, by filing a complaint in one of the ways described here: https://www.cpdp.bg/?p=pages&aid=56.  

Following the entry into force of the Regulation, personal data subjects may also lodge complaints with other supervisory authorities in the territory of the European Union, where this is provided for in the Regulation. 

 

Lodge a complaint before the competent administrative court 

 

Without prejudice to your right to lodge a complaint to the CPDP, described in item 1, you have the right to lodge a complaint directly to the competent administrative court when you believe that your rights under the Regulation / LPPD have been violated as a result of the processing of your personal data.

 

Right to compensation and liability for damages 

 

In case you have suffered material or non-material damages as a result of a violation of the Regulation, you have the right to receive compensation from the controller for the damages. 

 

V.  INFORMATION ABOUT THE SUPERVISORY AUTHORITY 

 

The supervisory authority competent on the territory of the Republic of Bulgaria is the Commission for Personal Data Protection (CPDP). 

 

Contact details CPDP: 

Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592 

Email: kzld@cpdp.bg 

Webpage: www.cpdp.bg 

Information and contact center – 02/91-53-518 

 

VI. TO WHOM DO WE PROVIDE PERSONAL DATA RELATED TO YOU? 

 

Your personal data is provided to: 

  • competent public authorities in compliance with legal provisions or other statutory obligations; 
  • our partners with whom we have concluded contracts for the provision of various services, incl. lawyers, licensed postal operators, etc. (all established on the territory of the Republic of Bulgaria). 

All our partners comply with the requirements of Regulation (EU) 2016/679, and those of them, acting as processors on behalf of Power Partner Solutions Ltd., have made such commitments through our data protection agreements (in accordance with Article 28, § 3 of the Regulation). 

Your personal data is not shared with others within the EU or with third countries or international organizations. 

 

VII. SECURITY MEASURES 

 

Power Partner Solutions Ltd. processes the personal data related to you lawfully, in good faith and in a transparent manner, making significant efforts to ensure an appropriate level of security, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage to your data. For this purpose, the company applies appropriate technical and organizational measures, including: 

  • integrated TLS certificate; 
  • limited access to the admin panel of the website; 
  • keeping operating systems up to date; 
  • keeping antivirus programs up to date; 
  • other measures for protection of the buildings, premises and facilities in which personal data are processed and stored, described in detail in the Internal Rules of the company; 
  • limited access of employees to information resources in accordance with the principle of "need to know"; 
  • documented procedures for processing personal data of natural persons, etc. 

 

VIII. SOCIAL NETWORKS 

 

We use social networks to promote our activities and provide information about the services offered. Each platform has its own privacy policy regarding the processing of your data, which we recommend that you read. 

Power Partner Solutions Ltd. maintains the following page in LinkedIn: https://www.linkedin.com/company/power-partner-solutions/?originalSubdomain=bg. Privacy policy: https://www.linkedin.com/legal/privacy-policy  

Power Partner Solutions Ltd. maintains the following page in Facebook: https://www.facebook.com/people/PPS/100063497194785/. Privacy policy:: https://www.facebook.com/privacy/policy/  

 

 

FINAL PROVISION 

 

All changes and additions to the Privacy Policy will be applied after the publication of its current content, available through our website. In case the amendments are substantive, in accordance with the Guidelines on Transparency under Regulation 2016/679 of the Article 29 Working Party (now the European Data Protection Board), adopted on 29.11.2017, last revised on 11.04 .2018, we will notify you of them via a pop-up message on the website or via email to the email address you provided (when available). 

Contact Us
By clicking the "Accept" button below, you accept the cookies used as stated in our Privacy Policy.