Privacy policy

Ruse Municipality Personal Data Protection Policy

This Personal Data Protection Policy does not establish rights and obligations but aims to explain why and what personal data we collect, how we process and store them, and under what circumstances we may disclose personal data to third parties.
The purpose of this policy is to provide information about the rights that individuals have in relation to the processing of their personal data by Ruse Municipality.

WHY WE COLLECT PERSONAL DATA

We collect and process personal data in connection with the exercise of our official powers, compliance with legal obligations, protection of legitimate interests, or when performing a task carried out in the public interest.

WHAT PERSONAL DATA WE COLLECT

We may collect the following categories of data:

• Names, Personal Identification Number (or Foreigner’s Personal Number);
• Data concerning health status;
• Data from identity documents (these data are not stored by Ruse Municipality but are used to verify the validity of the document and the identity of the individual);
• Data about a proxy (if the person is represented by one) and their power of attorney;
• Contact details (such as email address, telephone number, postal address, etc.).

HOW WE PROCESS PERSONAL DATA

Processing covers a wide range of operations performed on personal data, whether by manual or automated means. This includes collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment or combination, restriction, erasure, or destruction.

KEY PRINCIPLES OF DATA PROCESSING

We process personal data lawfully, fairly, and in a transparent manner with respect to the data subject and for specific, explicit, and legitimate purposes, in accordance with applicable legislation.
We inform citizens about what personal data we collect, as well as why and how we do so.
We process personal data only for lawful purposes and retain them no longer than necessary to achieve those purposes, unless we are legally obliged to keep them for a longer period.

We have implemented the necessary technical and organizational measures to protect your personal data from accidental or unlawful destruction, loss, unauthorized access, alteration, disclosure, or any other unlawful form of processing.

HOW WE OBTAIN PERSONAL DATA

In most cases, we receive information directly from data subjects when they fill out requests, applications, or other documents necessary for the exercise of the municipality’s official powers and legal obligations.

DISCLOSURE TO COMPETENT AUTHORITIES

When provided for by law, personal data collected and processed by Ruse Municipality may be disclosed to competent authorities.

DATA RETENTION PERIOD

Personal data are stored only for as long as necessary to comply with the requirements of applicable legislation.

PUBLIC ADMINISTRATION AND DATA PROTECTION RIGHTS

You may contact us to exercise your rights.
Under the General Data Protection Regulation (GDPR), data subjects (natural persons whose data are processed) have the right to:

• Be informed about the processing of their personal data;
• Access their personal data;
• Rectification (if data are inaccurate);
• Erasure of personal data (“right to be forgotten”)*;
• Restriction of processing by the controller or processor;
• Data portability between controllers;
• Object to the processing of their personal data;
• Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar way;
• Seek judicial or administrative protection if their rights have been violated.

The data subject has the right to receive information about the data controller and the processing of their personal data, including:

• Identification details and contact information of the controller and the Data Protection Officer;
• The purposes and legal basis for processing;
• The recipients or categories of recipients of personal data, if any;
• Any intention of the controller to transfer personal data to a third country (where applicable);
• The retention period of personal data;
• The existence of automated decision-making, including profiling (if applicable);
• Information about all rights of the data subject;
• The right to lodge a complaint with a supervisory authority.

This information shall not be provided if the data subject already possesses it.

If you submit a request to exercise your rights, we will respond within one month. Where necessary, this period may be extended by up to two additional months, and you will be promptly informed.

In the event of refusal to act on your request, you will be notified of the reasons for the refusal, as well as your right to lodge a complaint with the Commission for Personal Data Protection or to seek judicial remedy.

The actions taken by Ruse Municipality in connection with the exercise of individuals’ rights are entirely free of charge. However, where a request is manifestly unfounded or excessive (for example, due to its repetitive character), the municipality may refuse to act on the request or may charge a reasonable fee based on the administrative costs of providing the information or taking the requested action.

THE RIGHT TO ERASURE (“RIGHT TO BE FORGOTTEN”)

The right to erasure allows a data subject to request the deletion of their personal data when they are no longer necessary for the purposes for which they were collected, or when no lawful grounds for retention exist.
This applies in cases where:

• Personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• The data subject withdraws consent on which the processing is based;
• The data subject objects to the processing and there are no overriding legitimate grounds for continuing it;
• Personal data have been unlawfully processed;
• Personal data must be erased for compliance with a legal obligation;
• Personal data have been collected in relation to the offer of information society services to a child.

The “right to be forgotten” is not absolute. Ruse Municipality may refuse erasure when the processing is necessary for:

• Exercising the right of freedom of expression and information;
• Compliance with a legal obligation or performance of a task carried out in the public interest or in the exercise of official authority;
• Reasons of public health;
• Archiving purposes in the public interest, scientific or historical research, or statistical purposes;
• Establishment, exercise, or defense of legal claims.

POLICY UPDATES

This Personal Data Protection Policy is current as of 19 July 2024.
The policy may be amended or supplemented due to changes in applicable legislation, at the initiative of Ruse Municipality, or upon request by a competent authority (e.g., the Commission for Personal Data Protection).