Last updated: 31.08.2025

I. GENERAL INFORMATION

The Association “Bulgarian Library and Information Association” (BLIA) is a data controller within the meaning of the applicable legislation. As such, it is obliged to inform you about what to expect when your personal data is processed.

Data of the Data Controller

Association “Bulgarian Library and Information Association”, registered in the Commercial Register and the Register of Non-Profit Legal Entities with UIC 121514988, with seat and address: Sofia, 2 “Hristo Belchev” St., Floor 5, Office 16.

1. Contact with BLIA

Sofia 1000, 2 “Hristo Belchev” St., Floor 5, Office 16
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Phone: +359 885 311 836
Website: https://www.lib.bg

2. Data Protection Officer

Kalina Yordanova Ivanova, Chairperson of BLIA
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
This email is used only for questions regarding the processing of your personal data by BLIA, as well as for exercising your rights under Articles 15–22 of Regulation (EU) 2016/679.

3. Supervisory Authority

Commission for Personal Data Protection (CPDP)
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Website: www.cpdp.bg

Purposes for which your personal data is processed

• Users / Members of the Association
• Donors
• Employees
• Contractors and publishers

Members or Users of the Association

BLIA processes personal data related to membership – issuing membership cards, financial documents, and statistics. The legal grounds are specified in the Statute and the Code of Ethics of BLIA. Data is collected directly from members and used only for the above purposes. Data is not stored outside the EU/EEA. BLIA provides appropriate technical and organisational measures for protection.

Donors

Personal data of persons who make donations or bequests is processed in accordance with the Obligations and Contracts Act, Inheritance Act, and others. Data may be disclosed to third parties only where provided for by law or with the permission of CPDP.

Employees (Human Resources)

Personal data of applicants, employees, and former employees is processed. This includes data for identification, contact details, education, qualifications, health, and other data required by law. Data may be disclosed to authorities such as the National Revenue Agency, Audit Office, Labour Inspectorate, etc. Retention periods are in accordance with labour and social security legislation.

Contractors and Publishers

Minimal personal data necessary for the execution of contracts is processed under the Obligations and Contracts Act, Public Procurement Act, Commercial Act, etc. Disclosure to third parties is made only where required by law.

Use of Cookies

Our website uses cookies that are necessary for its functioning – to distinguish sessions, process requests, and manage the consent banner. You may disable cookies in your browser settings, but this may affect website functionality.

List of Cookies Used

Note: The information about cookies is periodically updated following new scans with CookieYes.

Log Files

Like most websites, we collect log file data (IP address, browser, operating system, date and time of visit, visited pages). We may use IP addresses to identify users when required by law. This information is stored on the servers of SuperHosting.BG, located in Bulgaria.

Changes to this Privacy Policy

BLIA reserves the right to amend this policy. For questions about the processing of your data: This email address is being protected from spambots. You need JavaScript enabled to view it.

II. SPECIFIC INFORMATION

1. Your rights when your data is processed

You have the right to: access, rectification, erasure, restriction, portability, objection, and protection from automated decision-making. The Controller provides information without undue delay and within one month of receiving a request (extendable by two months for complexity). If no action is taken, you will be informed of the reasons and your right to complain to CPDP.

Right of Access

• Purposes of processing
• Categories of personal data
• Recipients or categories of recipients
• Storage period or criteria for determining it
• Rights of rectification/erasure/restriction/objection
• Right to complain to CPDP
• Source of the data (if not provided by you)
• Existence of automated decision-making, including profiling

Right of Rectification

You may request the correction or completion of your personal data without undue delay.

Right to Erasure (“Right to be Forgotten”)

Data will be erased where: it is no longer necessary; you withdraw consent; you object and no overriding legitimate grounds exist; processing is unlawful; legal obligation requires erasure; or data was collected in relation to information society services.

Right to Restriction

You may request restriction where accuracy is contested, processing is unlawful, data is no longer needed, or for legal claims.

Right to Data Portability

You may receive your personal data in a structured, machine-readable format and transfer it to another controller; where technically feasible, direct transfer between controllers may be possible.

Right to Object

You may object to processing based on legitimate interest or public interest tasks, including profiling. For direct marketing purposes, you may object at any time; processing will then cease.

2. Principles of Processing

• Lawfulness, fairness, transparency
• Specific, explicit, legitimate purposes
• Data minimisation
• Accuracy and up-to-date
• Storage limitation
• Integrity and confidentiality

3. How to report a breach?

A personal data breach is any security incident leading to destruction, loss, alteration, unauthorised disclosure, or access. In case of a breach, immediately contact the Data Protection Officer: This email address is being protected from spambots. You need JavaScript enabled to view it..

4. Data Retention Periods

• Payroll records – 50 years
• Accounting registers and financial statements – permanent
• Tax/social security control documents – 5 years after the limitation period expires
• All other records – 5 years after no longer needed

After expiry, data carriers are destroyed: paper via shredding; electronic via deletion/wiping from BLIA systems.