The personal data controller is Fraport Twin Star Airport Management AD - a concessioner and airport operator of the civil airports for public use of Varna and Burgas, entered in the Commercial Register under UIC 148045472, having its headquarters and registered address at: Varna, POB 9000, Vladislav Varnenchik residential quarter, email:  office@fraport-bulgaria.com, tel.: 052/573 201 and fax: 052/573 245

The company has a specially nominated Data Protection Officer (DPO) – Timex-BG, who can be contacted on

tel.:  0700 14 050

e-mail:  dpo@timex.bg

Your personal data are not collected as an end in itself and in an unlimited manner. Fraport Twin Star Airport Management AD strictly observes the basic principles, introduced as compulsory ones in the processing of personal data: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

Fraport Twin Star Airport Management AD processes personal data of the following categories of natural persons:

• Personnel – current and former Company employees, job candidates
• Counterparties or potential counterparties of the Company and of their employees
• Passengers, aircrews and airport visitors
• Individuals participating in trainings organised by the Company
• Senders of enquiries, requests, signals, complaints or other correspondence addressed to the company.

Depending on the specific goals and grounds, Fraport Twin Star Airport Management AD processes all or some of the personal data listed below, individually or in combination between them:

• Identification data: full name, sex, nationality, personal number/other identifier, date and place of birth, data as per ID document
• Contact data: address, e-mail, telephone numberHealth data
• Data about education, professional qualification and employment
• Data about family status and kinshipData related to convictions and offences
• Financial information, including bank accountsData from airline tickets, boarding passes and bookings
• Other data collectible by virtue of the special laws regulating the labour relations, tax and social security relations, accounting of business operations, occupational health and safety, as well as the social matters
• Other information and personal data necessary for the performance of the legal obligations of the Company for ensuring the civil aviation safety
• Photographs and video recordings of conferences, activities and events
• IP addresses, cookies, data about social networks and other digital information in the event we provide services via our website or provide access to the Internet via our network

Fraport Twin Star Airport Management AD collects the personal data only for specific and legitimate purposes and does not process them further in a manner which is incompatible with them. The Company processes the personal data for the following purposes:

• Compliance with the legal obligations of the company under the Civil Aviation Act, the sublegislation related to its implementation, the National programme for safety in the civil aviation of the Republic of Bulgaria, the National programme for training and certification of safety in the civil aviation of the Republic of Bulgaria, the National programme for quality control of safety in the civil aviation of the Republic of Bulgaria, as well as other regulatory acts applicable to its business operations
• Security check of passengers, personnel, aircrews and visitors
• Compliance with orders by competent public authorities
• Compliance with the provisions of the labour and social security legislation with regard to the employees
• Selection of employees under employment relationsEnsuring the security of the employees, visitors, as well as the property of the Company, through a CCTV system, security guards, access control and registration.Ensuring the normal operation, maintenance and security of the Fraport Twin Star Airport Management AD website and IT systems
• Organisation and holding specialised trainings of employees and external individuals by the Aviation Training Centre (ATC) for the Company
• Implementation and protection of the rights and legal interests of Fraport Twin Star Airport Management AD, including in court
• Entry into contracts and pre-contractual relations
• Implementation of the social policy of Fraport Twin Star Airport Management AD
• Popularisation of the business of Fraport Twin Star Airport Management AD, including through dissemination of advertising materials and brochures, publishing of photographs and/or video recordings on the company website / Facebook page or in other media.

In the event we intend to process your personal data for purposes other than the aforementioned, you will be informed of the new purposes and will be provided with any necessary information prior to the further processing of your personal data.

The Company processes personal data only if one of the alternative legal grounds under the General Regulation is available, more specifically:

• Contractual performance, including the pre-contractual relations prior to its conclusion;
• Legal obligations applicable to the Company;The Company’s legitimate interests, inasmuch as they take priority over the interests or the basic rights and freedoms of the data subjects;
• Protection of the vital interests of the data subject or another natural person
• In some cases, we process personal data only after the preliminary consent of the data subject. The consent comprises separate grounds for processing your personal data, and the purpose of processing is stated therein and differs from the purposes listed in this confidentiality policy. The consent already given may be withdrawn by the person at any time in the same manner in which it was provided.

The personal data of the data subjects are submitted to the Company directly by the very persons or by their employers and are collected by the Controller in performance of a statutory obligation in connection with the compliance with the special provisions for ensuring safety in the field of civil aviation, in connection with employment relations, entry into and performance of a contract, consideration of suggestions, complaints and signals, staff selection, etc., in compliance with the provisions of the effective legislation of the Republic of Bulgaria. In the event the person fails to submit the due information, including the necessary personal data, Fraport Twin Star Airport Management AD will not be able to enter into an agreement with them, respectively will not be able to provide the requested service or information.

• Competent authorities that, by virtue of a regulatory act, have the power to demand from the Company the submission of information, including personal data – court, supervisory, regulatory or control authorities, authorities authorised for national security and public order protection
• Other competent public bodies performing a statutory obligation.
• Trade partners, counterparties and suppliers, for the purposes of performance of contracts or orders by the Company
• Personal data processors with a view to maintenance of the IT systems of the Company, provision of services, implementation of the operations for ground handling of airports, etc. In such cases, the relations between the Company and the Personal data processor are regulated in an agreement or another legal act, which makes provisions for suitable measures to guarantee the security of the personal data

Every natural person whose data are processed by Fraport Twin Star Airport Management AD has the following rights:

• the right of access to their personal data, including to receive a copy of them;
• the right of rectification or completion of inaccurate or incomplete personal data;
• the right to erasure of personal data processed without any legal grounds;
• the right to restrict processing – in the event of a legal dispute between the Company and the person until its resolution or for the establishment, exercising or protection of legal claims;
• the right to object to processing – at any time and based on grounds related to the specific situation of the person, on condition that there are no compelling legal grounds for the processing which override the data subject’s interests, rights and freedoms, or court proceedings;
• the right to data portability – only in the event the personal data are processed automatically on the grounds of consent or contract;
• the right not to be the subject of a decision based solely on an automated processing, including profiling, which produces legal effects concerning the data subject or significantly affects them.

In compliance with the Personal Data Protection Act, the rights listed above can be exercised by filing an application in writing on site at Fraport Twin Star Airport Management AD. An application can also be sent electronically under the procedure of the Electronic Document and Electronic Signature Act. The application is sent by the data subject in person or by a person explicitly authorised by them. The company issues a decision on the data subject’s application within 30 days of its filing. Where the applications by a data subject in connection with exercising the aforementioned rights are clearly unjustified or excessive, Fraport Twin Star Airport Management AD may impose the payment of a charge or refuse to take action under the application.

The Company applies all suitable technical and organisational measures to guarantee the personal data security, including continual training of the employees and employees’ assumption of an explicit obligation for confidentiality.

In compliance with the Personal Data Protection Act and Regulation (EU) 2016/679, each natural person who deems that their right to personal data protection has been violated may lodge a complaint with the Personal Data Protection Commission at: Sofia 1592, 2 Prof. Tsvetan Lazarov St, website:  www.cpdp.bg.

The period of storage of the personal data depends on the purpose of processing for which they are collected. We keep your personal data as long is it is reasonable and necessary to accomplish the purpose for which they have been collected and to comply with the applicable laws.

In order to apply the most up-to-date measures for protection and with a view to comply with the effective legislation, we will update this Personal Data Protection Policy on a regular basis. Should the changes we introduce be significant, we can publish a notice of the changes made on our website or inform you in any other suitable manner.