Privacy Policy
TRL CONSULTING EOOD
PRIVACY POLICY & PERSONAL DATA PROTECTION NOTICE
In accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act
Effective Date: 15 October 2026
1. INTRODUCTION AND LEGAL FRAMEWORK
TRL CONSULTING EOOD (hereinafter referred to as "TRL CONSULTING" or the "Company") is a company incorporated and operating under the laws of the Republic of Bulgaria, providing recruitment, personnel selection, temporary employment, workforce management and related human resources services.
TRL CONSULTING is committed to ensuring the lawful, fair, transparent and secure processing of personal data belonging to job applicants, employees, temporary workers, clients, business partners and website visitors.
The Company operates in accordance with:
• Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR);
• The Bulgarian Personal Data Protection Act (Закон за защита на личните данни);
• Applicable Bulgarian labour, employment, social security and tax legislation;
• Applicable European Union legislation concerning personal data protection and employment.
TRL CONSULTING recognises that the protection of personal data constitutes a fundamental legal obligation and an essential element of its professional responsibilities.
2. DATA CONTROLLER
For personal data processing activities in which it independently determines the purposes and means of processing, the Data Controller is:
TRL CONSULTING EOOD
Registered Office: Via Akademik Mihail Arnaudov 3, floor 3, Ruse 7000, Bulgaria
Unified Identification Code (UIC/EIK): 208786016
Email: direzione@trlconsulting.eu
Privacy Contact: direzione@trlconsulting.eu
Website: https://trlconsulting.eu
Where TRL CONSULTING processes personal data on behalf of another controller, the respective roles and responsibilities shall be governed by applicable law and appropriate contractual arrangements.
3. CATEGORIES OF PERSONAL DATA COLLECTED
In the performance of its recruitment, employment and personnel management activities, TRL CONSULTING may collect and process the following categories of personal information:
3.1 Personal identification information
• Full name and surname;
• Date and place of birth, where necessary;
• Nationality and citizenship;
• Residential address;
• Telephone number and email address;
• Identification document details, where legally required.
3.2 Professional and employment information
• Curriculum vitae and employment history;
• Educational qualifications and professional certificates;
• Professional licences and technical qualifications;
• Language skills and professional competencies;
• Employment references, where lawfully obtained;
• Previous professional experience;
• Information necessary to assess eligibility for employment.
3.3 Employment administration information
• Employment contracts and related documentation;
• Work assignments and professional duties;
• Payroll and payment information;
• Bank account details;
• Social security and tax information;
• Working time and attendance records;
• Information necessary for compliance with labour legislation.
3.4 Immigration and international employment information
Where relevant to cross-border recruitment or employment:
• Work authorisations;
• Residence permits;
• Visa information;
• Documents necessary to verify the legal right to work;
• Documentation required by competent employment and immigration authorities.
3.5 Special categories of personal data
Special categories of personal data, including health-related information, shall only be processed where permitted under Article 9 GDPR and applicable Bulgarian legislation.
TRL CONSULTING shall apply appropriate additional safeguards to such information.
The Company shall not collect or process personal data that are unnecessary or disproportionate to the legitimate purposes pursued.
4. PURPOSES OF PERSONAL DATA PROCESSING
Personal data may be collected and processed for the following purposes:
A. Recruitment and personnel selection
To receive and evaluate job applications, assess professional qualifications, communicate with candidates and identify suitable employment opportunities.
B. Temporary employment and personnel placement
To organise and administer temporary employment relationships, personnel assignments and workforce management activities.
C. Employment contract administration
To prepare, execute and manage employment contracts and related legal documentation.
D. Legal and regulatory compliance
To comply with applicable employment, tax, social security, immigration, accounting and regulatory obligations.
E. Business relationships
To communicate with clients, employers, suppliers and professional partners.
F. Website management
To respond to enquiries, maintain website functionality, protect information systems and administer online communications.
TRL CONSULTING shall process personal data only for specified, explicit and legitimate purposes.
5. LEGAL BASIS FOR PROCESSING
Personal data shall be processed only where a valid legal basis exists under Article 6 GDPR.
Depending on the circumstances, processing may be based on:
• Article 6(1)(a): Consent of the data subject;
• Article 6(1)(b): Performance of a contract or pre-contractual measures;
• Article 6(1)(c): Compliance with a legal obligation;
• Article 6(1)(f): Legitimate interests pursued by the Company or a third party, provided that the rights and freedoms of the data subject do not override such interests.
Where special categories of personal data are processed, TRL CONSULTING shall also identify an applicable condition under Article 9 GDPR.
Consent shall be requested only where appropriate and shall not replace another legal basis required for statutory employment processing.
6. PERSONAL DATA STORAGE AND RETENTION
TRL CONSULTING assumes responsibility, in its capacity as Data Controller, for implementing lawful and appropriate procedures governing the storage, retention, protection and deletion of personal data.
The Company shall retain personal information only for the period necessary to fulfil the purposes for which it was collected, unless longer retention is required or permitted by applicable law.
6.1 Job applicants and recruitment records
In accordance with Article 25k of the Bulgarian Personal Data Protection Act, personal data collected during recruitment and selection procedures shall not be retained for longer than six months, unless the applicant has consented to a longer retention period or a specific legal provision establishes otherwise.
Where candidates provide valid consent for future recruitment opportunities, their information may be retained for the specific period communicated to them.
Such consent may be withdrawn at any time.
6.2 Employees and temporary workers
Personal data relating to employees and temporary workers shall be retained in accordance with applicable Bulgarian employment, social security, accounting and tax legislation.
The retention period shall depend on the nature of the relevant documents and the applicable statutory requirements.
6.3 Client and commercial records
Information relating to clients, suppliers and commercial partners shall be retained for the duration necessary to manage the contractual relationship and fulfil applicable legal obligations.
6.4 Website enquiries
Personal data submitted through website contact forms shall be retained only for the period necessary to process the enquiry and fulfil any resulting lawful obligations.
6.5 Deletion and destruction
Upon expiry of the applicable retention period, personal data shall be securely deleted, irreversibly anonymised or physically destroyed, unless continued retention is legally required.
TRL CONSULTING shall establish appropriate internal retention and deletion procedures to ensure compliance with these obligations.
7. SECURITY AND PROTECTION OF PERSONAL DATA
TRL CONSULTING undertakes to implement appropriate technical and organisational security measures in accordance with Articles 24, 25 and 32 GDPR.
These measures shall be designed to protect personal data against:
• Unauthorised access;
• Unlawful disclosure;
• Accidental loss;
• Unauthorised alteration;
• Destruction;
• Misuse;
• Unlawful processing.
Security measures may include:
• Restricted access to authorised personnel;
• Secure electronic databases and document management systems;
• Password protection and appropriate authentication procedures;
• Encryption where appropriate;
• Secure storage of physical documentation;
• Confidentiality obligations for employees and authorised service providers;
• Regular assessment of data protection risks;
• Appropriate backup and recovery procedures;
• Secure deletion and document destruction;
• Internal procedures for identifying and responding to security incidents.
Access to personal information shall be limited to individuals who require such access for legitimate professional purposes.
TRL CONSULTING shall periodically review its security arrangements to ensure that they remain appropriate to the risks associated with its processing activities.
8. CORPORATE RESPONSIBILITY AND ACCOUNTABILITY
TRL CONSULTING acknowledges its responsibilities under the accountability principle established by Article 5(2) GDPR.
The Company shall be responsible for demonstrating compliance with the principles of:
• Lawfulness, fairness and transparency;
• Purpose limitation;
• Data minimisation;
• Accuracy;
• Storage limitation;
• Integrity and confidentiality;
• Accountability.
TRL CONSULTING shall maintain appropriate organisational procedures and documentation necessary to demonstrate compliance with applicable data protection requirements.
The Company shall remain responsible for personal data processing activities carried out under its control, including processing entrusted to authorised third-party processors, in accordance with applicable legislation.
The involvement of external service providers shall not, by itself, release TRL CONSULTING from its statutory obligations as Data Controller.
Any liability arising from unlawful processing, unauthorised disclosure, failure to implement legally required safeguards or other breaches of data protection legislation shall be determined in accordance with the GDPR and applicable Bulgarian law.
9. DISCLOSURE OF PERSONAL DATA TO EMPLOYERS AND THIRD PARTIES
In connection with its recruitment and temporary employment activities, TRL CONSULTING may disclose personal data to:
• Client companies seeking personnel;
• Potential employers;
• Companies receiving temporary workers;
• Competent Bulgarian employment authorities;
• Tax and social security institutions;
• Immigration authorities, where applicable;
• Professional advisers and authorised service providers;
• IT, hosting and document management providers.
Personal data shall only be disclosed where a valid legal basis exists and the disclosure is necessary for the relevant legitimate purpose.
TRL CONSULTING shall not sell personal data to third parties.
Where external service providers act as Data Processors, appropriate contractual arrangements shall be established in accordance with Article 28 GDPR.
Where client companies independently determine the purposes and means of processing, they may act as independent Data Controllers and shall be responsible for their respective legal obligations.
10. INTERNATIONAL TRANSFER OF PERSONAL DATA
Due to the international nature of recruitment and temporary employment services, TRL CONSULTING may process or transfer personal data in connection with employment opportunities in other countries.
Transfers within the European Economic Area shall be conducted in accordance with applicable GDPR requirements.
Transfers to countries outside the European Economic Area shall only take place where permitted under Chapter V GDPR.
Where necessary, TRL CONSULTING shall implement appropriate safeguards, including:
• European Commission adequacy decisions;
• Standard Contractual Clauses;
• Other lawful transfer mechanisms recognised under the GDPR.
The Company shall take appropriate measures to ensure that international data transfers comply with applicable legal requirements.
11. RIGHTS OF DATA SUBJECTS
Under Articles 12–22 GDPR, individuals have the following rights, subject to applicable legal conditions and exceptions:
11.1 Right of access
To request confirmation of whether personal data are being processed and obtain access to such information.
11.2 Right to rectification
To request correction of inaccurate or incomplete personal data.
11.3 Right to erasure
To request deletion of personal data where the applicable legal conditions are satisfied.
11.4 Right to restriction of processing
To request restriction of processing in circumstances provided by law.
11.5 Right to data portability
To receive personal data in a structured, commonly used and machine-readable format, where applicable.
11.6 Right to object
To object to processing where such right is provided by the GDPR.
11.7 Right to withdraw consent
To withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
11.8 Rights concerning automated decision-making
To exercise the protections established under Article 22 GDPR, where applicable.
Requests concerning personal data may be submitted to:
TRL CONSULTING EOOD
Privacy Contact: direzione@trlconsulting.eu
The Company shall respond without undue delay and, in principle, within one month of receiving a valid request, subject to the extensions and exceptions permitted by applicable law.
12. PERSONAL DATA BREACHES
TRL CONSULTING shall maintain appropriate procedures for identifying, assessing, managing and documenting personal data breaches.
Where a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, the Company shall notify the competent supervisory authority in accordance with Article 33 GDPR, where legally required.
Where the breach is likely to result in a high risk to the rights and freedoms of affected individuals, the Company shall communicate the breach to those individuals in accordance with Article 34 GDPR, unless an applicable exception applies.
The Company shall take appropriate measures to mitigate the consequences of any breach and prevent similar incidents.
13. CONFIDENTIALITY OBLIGATIONS
All employees, representatives and authorised persons who have access to personal data shall be subject to appropriate confidentiality obligations.
Personal information obtained during recruitment, employment administration or temporary work assignments shall not be used for unauthorised purposes.
TRL CONSULTING shall ensure that personnel authorised to process personal data receive appropriate instructions regarding their responsibilities.
Confidentiality obligations shall continue to apply after termination of the relevant employment or contractual relationship, to the extent required by applicable law and contractual arrangements.
14. COOKIES AND WEBSITE TECHNOLOGIES
The TRL CONSULTING website may use cookies and similar technologies to ensure its proper operation, security and functionality.
Strictly necessary cookies may be used where permitted by applicable law.
Optional analytics, advertising or tracking technologies shall only be used in accordance with applicable data protection and electronic communications requirements, including obtaining prior consent where required.
Where applicable, visitors shall be provided with appropriate information and controls regarding the use of cookies.
Further details shall be provided in the Company's Cookie Policy or cookie management interface.
15. BULGARIAN SUPERVISORY AUTHORITY
The competent supervisory authority for personal data protection in Bulgaria is:
Commission for Personal Data Protection (CPDP)
Комисия за защита на личните данни (КЗЛД)
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Republic of Bulgaria
Official Website: https://www.cpdp.bg
Data subjects have the right to lodge a complaint with the competent supervisory authority if they consider that the processing of their personal data infringes applicable data protection legislation.
16. AMENDMENTS TO THE PRIVACY POLICY
TRL CONSULTING reserves the right to amend or update this Privacy Policy to reflect changes in legislation, regulatory guidance, technological developments or business operations.
The latest version shall be published on the Company's official website.
Where legally required, material changes affecting the processing of personal data shall be communicated to the individuals concerned.
17. CONTACT INFORMATION
For any enquiry concerning the collection, processing, storage, retention, protection or deletion of personal data, please contact:
TRL CONSULTING EOOD
Registered Office: Via Akademik Mihail Arnaudov 3, floor 3, Ruse 7000, Bulgaria
Unified Identification Code (UIC/EIK): 208786016
Official Email: direzione@trlconsulting.eu
Privacy Contact: direzione@trlconsulting.eu
Website: https://trlconsulting.eu
Applicable legislation:
Regulation (EU) 2016/679 (GDPR)
Bulgarian Personal Data Protection Act (Закон за защита на личните данни)
Effective Date: 15 October 2026
© 2026 TRL CONSULTING EOOD – All Rights Reserved.
Privacy Policy & Personal Data Protection Notice