The right to privacy is the main priority of Fraport Twin Star Airport Management AD (the Company), which makes a serious commitment with regard to the protection and safeguarding of the personal data of employees, counterparties and partners, passengers, visitors and other natural persons in the implementation of its business activities for management and operation of Varna Airport and Burgas Airport and performance of its functions as airport administration and ground handling operator of aircrafts, passengers, cargoes and mail. Fraport Twin Star Airport Management AD processes personal data of natural persons (“data subjects“) in strict compliance with Regulation (EU) 2016/679 (General Data Protection Regulation), the Personal Data Protection Act and the Company’s Personal Data Protection Policy.
In accordance with the General Regulation, “personal data“ is any information relating to a natural person through which it can be directly or indirectly identified.
“Processing of personal data“ is any operation or set of operations which may be performed on personal data, whether or not by automatic means.
The company hereby provides information about:
Who is the personal data controller?
Which natural persons’ personal data are processed by the Company?
For what purposes and on which grounds the personal data are processed?
To whom the personal data are submitted or disclosed?
The time limits for the storage of the personal data
The measures to ensure security of the data
The personal data controller is Fraport Twin Star Airport Management AD – a concessioner and airport operator of the civil airports for public use of Varna and Burgas, entered in the Commercial Register under UIC 148045472, having its headquarters and registered address at: Varna, POB 9000, Vladislav Varnenchik residential quarter, email: email@example.com, tel.: 052/573 201 and fax: 052/573 245
The company has a specially nominated Data Protection Officer (DPO), who can be contacted on tel.: 052/573 567, е-mail: firstname.lastname@example.org
Your personal data are not collected as an end in itself and in an unlimited manner. Fraport Twin Star Airport Management AD strictly observes the basic principles, introduced as compulsory ones in the processing of personal data: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.
Fraport Twin Star Airport Management AD processes personal data of the following categories of natural persons:Personnel – current and former Company employees, job candidatesCounterparties or potential counterparties of the Company and of their employeesPassengers, aircrews and airport visitorsIndividuals participating in trainings organised by the CompanySenders of enquiries, requests, signals, complaints or other correspondence addressed to the company.
Depending on the specific goals and grounds, Fraport Twin Star Airport Management AD processes all or some of the personal data listed below, individually or in combination between them:
Fraport Twin Star Airport Management AD collects the personal data only for specific and legitimate purposes and does not process them further in a manner which is incompatible with them. The Company processes the personal data for the following purposes:
The Company processes personal data only if one of the alternative legal grounds under the General Regulation is available, more specifically:
In some cases, we process personal data only after the preliminary consent of the data subject. The consent comprises separate grounds for processing your personal data, and the purpose of processing is stated therein and differs from the purposes listed in this confidentiality policy. The consent already given may be withdrawn by the person at any time in the same manner in which it was provided.
The personal data of the data subjects are submitted to the Company directly by the very persons or by their employers and are collected by the Controller in performance of a statutory obligation in connection with the compliance with the special provisions for ensuring safety in the field of civil aviation, in connection with employment relations, entry into and performance of a contract, consideration of suggestions, complaints and signals, staff selection, etc., in compliance with the provisions of the effective legislation of the Republic of Bulgaria. In the event the person fails to submit the due information, including the necessary personal data, Fraport Twin Star Airport Management AD will not be able to enter into an agreement with them, respectively will not be able to provide the requested service or information.
Competent authorities that, by virtue of a regulatory act, have the power to demand from the Company the submission of information, including personal data – court, supervisory, regulatory or control authorities, authorities authorised for national security and public order protection
Other competent public bodies performing a statutory obligation.
Trade partners, counterparties and suppliers, for the purposes of performance of contracts or orders by the Company
Personal data processors with a view to maintenance of the IT systems of the Company, provision of services, implementation of the operations for ground handling of airports, etc. In such cases, the relations between the Company and the Personal data processor are regulated in an agreement or another legal act, which makes provisions for suitable measures to guarantee the security of the personal data
Every natural person whose data are processed by Fraport Twin Star Airport Management AD has the following rights:
In compliance with the Personal Data Protection Act, the rights listed above can be exercised by filing an application in writing on site at Fraport Twin Star Airport Management AD. An application can also be sent electronically under the procedure of the Electronic Document and Electronic Signature Act. The application is sent by the data subject in person or by a person explicitly authorised by them. The company issues a decision on the data subject’s application within 30 days of its filing. Where the applications by a data subject in connection with exercising the aforementioned rights are clearly unjustified or excessive, Fraport Twin Star Airport Management AD may impose the payment of a charge or refuse to take action under the application.
The Company applies all suitable technical and organisational measures to guarantee the personal data security, including continual training of the employees and employees’ assumption of an explicit obligation for confidentiality.
In compliance with the Personal Data Protection Act and Regulation (EU) 2016/679, each natural person who deems that their right to personal data protection has been violated may lodge a complaint with the Personal Data Protection Commission at: Sofia 1592, 2 Prof. Tsvetan Lazarov St, website: www.cpdp.bg
The period of storage of the personal data depends on the purpose of processing for which they are collected. We keep your personal data as long is it is reasonable and necessary to accomplish the purpose for which they have been collected and to comply with the applicable laws.
In order to apply the most up-to-date measures for protection and with a view to comply with the effective legislation, we will update this Personal Data Protection Policy on a regular basis. Should the changes we introduce be significant, we can publish a notice of the changes made on our website or inform you in any other suitable manner.