Privacy Policy for Academy

PRIVACY POLICY ON THE PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE LEADERSHIP AND ADVOCACY ACADEMY


BULGARIAN ENTREPRENEURSHIP ASSOCIATION, UIC 177239971, with registered office and address of management at 117 Hristo Botev Blvd., floor 2, Vazrazhdane District, 1303 Sofia, Bulgaria (“BESCO”, the “Association”, “we”, “us” or “our”), processes personal data relating to natural persons (“Data Subjects”, “you” or “your”) in accordance with this Privacy Policy in connection with the organisation and delivery of the Leadership and Advocacy Academy (the “Academy”).

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

  1. “Regulation” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – the General Data Protection Regulation (“GDPR”), which replaced Directive 95/46/EC. The Regulation is directly applicable in the Member States of the European Union and is intended to protect the rights and freedoms of natural persons in relation to the processing of their personal data.
  2. “Personal Data” means any information relating to an identified or identifiable natural person. A natural person may be identified, directly or indirectly, by reference to one or more identifiers or characteristics relating to that person. Personal Data may include both objective and subjective information, including opinions or assessments, and may exist in any form, including written, numerical, graphic, photographic, audio or electronic form.
  3. “Special Categories of Personal Data” means categories of Personal Data which, due to the nature of the information they reveal, are subject to enhanced protection. Such information may include data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, data concerning health and biometric data processed for the purpose of uniquely identifying a natural person.
  4. “Controller” means BESCO, which determines the purposes and means of the processing of Personal Data.
  5. “Processing” means any operation or set of operations performed on Personal Data, including collection, recording, organisation, structuring, storage, alteration, use, disclosure by transmission, making available, alignment, restriction, erasure or destruction.
  6. “Data Subject” means any natural person to whom Personal Data processed by the Controller relates.

I. CATEGORIES OF DATA SUBJECTS

The Association processes Personal Data relating to the following categories of Data Subjects:

  1. applicants for participation in the Leadership and Advocacy Academy;
  2. participants in the Academy;
  3. lecturers engaged in the delivery of individual modules or other activities within the Academy;
  4. guest lecturers and other external persons invited to participate in individual events or activities of the Academy;
  5. natural persons communicating with BESCO in connection with the organisation and delivery of the Academy.

II. PERSONAL DATA

Depending on the capacity of the relevant person and the nature of their involvement in the Academy, BESCO may process the following categories of Personal Data:

1. Applicants and Participants

In relation to applicants and Participants, BESCO may process:

  • full name;
  • e-mail address;
  • Bulgarian Personal Identification Number (EGN);
  • telephone number;
  • organisation, employer or place of work;
  • position, profession and information relating to professional activity and experience;
  • information provided as part of the application process and required for the review and assessment of the application;
  • information relating to participation in the Academy, including attendance, absences and online participation in individual Modules and events;
  • information required for the issuance of a certificate and inclusion in the Alumni Network;
  • information relating to payment of the Participation Fee and the issuance of the relevant accounting documents;
  • information provided when applying for financial support, where applicable;
  • photographs and video recordings;
  • information contained in correspondence with BESCO in connection with the application and participation in the Academy.

2. Lecturers and Guest Lecturers

In relation to lecturers and guest lecturers, BESCO may process:

  • full name;
  • e-mail address;
  • telephone number;
  • organisation or place of work;
  • position, professional qualifications, professional experience and biographical information;
  • photographs and video recordings.

3. Other Persons Communicating with BESCO in Connection with the Academy

BESCO may process the names, contact details and content of correspondence of persons who submit enquiries, reports, requests or other communications in connection with the Academy.

Where an application, registration or communication is made through a website or electronic form, BESCO may also process technical data such as IP address and the date and time of access, to the extent that such data is collected through the electronic systems used by BESCO.

BESCO does not process special categories of Personal Data within the meaning of Articles 9 and 10 of the Regulation.

III. PURPOSES AND LEGAL BASES FOR PROCESSING

BESCO collects and processes the Personal Data described above for the following purposes and on the following legal bases:

1. Applicants and Participants

1.1. Application and Selection for Participation in the Academy

BESCO processes applicants’ Personal Data for the purpose of receiving, reviewing and assessing applications, communicating with applicants and taking the necessary steps in connection with their potential participation in the Academy.

Legal basis: Article 6(1)(b) GDPR – taking steps at the request of the Data Subject prior to entering into a contract.

1.2. Organisation, Administration and Delivery of the Academy

BESCO processes Participants’ Personal Data for the purposes of entering into and performing the Participation Agreement, administering participation in the Academy, communicating in relation to the programme, recording attendance, organising the Modules and other activities, issuing certificates and including eligible Participants in the Alumni Network.

Legal basis: Article 6(1)(b) GDPR – performance of a contract to which the Data Subject is a party.

1.3. Review of Applications for Financial Support

Where a Participant applies for financial support, BESCO processes the information provided by the Participant for the purpose of reviewing the application and determining the type and amount of any support that may be granted.

Legal basis: Article 6(1)(b) GDPR – the Processing is related to the conditions for participation and the performance of the Participation Agreement.

1.4. Collection and Analysis of Feedback

BESCO processes feedback provided by Participants for the purpose of evaluating and improving the content, organisation and quality of the Academy and future Academy cohorts, as well as for the preparation of internal analyses and aggregated reports.

Legal basis: Article 6(1)(f) GDPR – BESCO’s legitimate interest in evaluating and improving the programmes it organises.

1.5. Compliance with Accounting, Tax and Other Statutory Obligations

BESCO processes the Personal Data necessary in connection with payments, the issuance and retention of accounting documents and compliance with other applicable statutory obligations.

Legal basis: Article 6(1)(c) GDPR – compliance with a legal obligation to which the Controller is subject.

2. Lecturers

2.1. Organisation and Performance of the Lecturer Engagement

BESCO processes lecturers’ Personal Data for the purposes of communication, negotiation and organisation of their participation, determining the subject matter, date and format of the relevant Module or other activity, and performance of the parties’ contractual obligations.

Legal basis: Article 6(1)(b) GDPR – taking steps prior to entering into a contract and/or performance of a contract.

2.2. Presentation of the Lecturers and the Academy Programme

BESCO may process a lecturer’s name, position, organisation, professional biography and information relating to their participation for the purpose of presenting the programme and providing Participants with information about the content of the Academy and its lecturers.

Legal basis: Article 6(1)(f) GDPR – BESCO’s legitimate interest in presenting the Academy programme and the professionals engaged in its delivery.

2.3. Payment of Remuneration and Reimbursement of Expenses

Where applicable, BESCO processes Personal Data necessary for the payment of remuneration, reimbursement of expenses and compliance with the related accounting and tax obligations.

Legal basis: Article 6(1)(b) and Article 6(1)(c) GDPR.

3. Guest Lecturers

3.1. Invitations and Organisation of Participation

BESCO processes guest lecturers’ Personal Data for the purposes of extending invitations, communicating with them and organising their participation in individual Academy events or activities.

Legal basis: Article 6(1)(b) GDPR.

3.2. Presentation of Guest Lecturers to Participants

BESCO may process the guest lecturer’s name, organisation, position, professional information and topic of participation for the purpose of introducing the guest lecturer to Participants and organising the relevant event.

Legal basis: Article 6(1)(f) GDPR – BESCO’s legitimate interest in informing Participants about the content of the programme and the persons involved in its delivery.

4. Purposes Applicable to All Categories of Data Subjects

4.1. Communication and Handling of Enquiries, Reports and Requests

BESCO processes Personal Data for the purposes of receiving, reviewing and responding to enquiries, reports, requests and other correspondence relating to the Academy.

Legal basis: Article 6(1)(f) GDPR – BESCO’s legitimate interest in ensuring effective communication in connection with the Academy and handling the enquiries, reports and requests it receives.

4.2. Establishment, Exercise and Defence of Rights and Legal Claims

BESCO may retain and process Personal Data where necessary for the establishment, exercise or defence of its rights and legitimate interests, including in the event of a dispute or proceedings before a competent authority or court.

Legal basis: Article 6(1)(f) GDPR – BESCO’s legitimate interest in protecting its rights and legitimate interests.

4.3. Use of Photographs and Video Recordings and Sharing of Contact Details

Where the relevant Processing is based on consent, BESCO uses photographs and video recordings and/or shares certain contact details solely for the purposes and subject to the conditions for which the relevant person has provided their consent.

Legal basis: Article 6(1)(a) GDPR – consent of the Data Subject.

IV. RETENTION PERIODS

BESCO retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, unless applicable law requires a longer retention period.

Personal Data relating to applications and participation in the Academy is retained for the period necessary to organise and deliver the relevant cohort and, where applicable, after completion of the cohort until the expiry of the relevant statutory limitation periods, to the extent necessary for the establishment, exercise or defence of legal claims.

Personal Data contained in accounting and tax documents is retained for the periods prescribed by applicable law.

Personal Data relating to lecturers and guest lecturers is retained for the duration of the relevant engagement and, following its completion, for as long as necessary to comply with applicable legal obligations and to protect BESCO’s rights and legitimate interests.

Where Processing is based on consent, the Personal Data is processed until the consent is withdrawn or until the purpose for which the consent was given no longer exists, unless another applicable legal basis justifies further retention.

Personal Data necessary for participation in the Alumni Network is processed for as long as the relevant person participates in the network, unless applicable law or another legal basis requires or permits a longer retention period.

V. SOURCES OF PERSONAL DATA

BESCO obtains Personal Data:

  1. directly from the relevant applicant, Participant, lecturer or guest lecturer;
  2. from an organisation, partner or other person who has proposed or recommended a lecturer or guest lecturer or provided their contact details;
  3. from publicly available professional sources, including official websites and publicly accessible professional profiles, where this is necessary for identifying, inviting or presenting a lecturer or guest lecturer;
  4. from other sources where this is provided for or otherwise permitted under applicable law.

Where Personal Data has not been obtained directly from the relevant person, BESCO provides the information required under applicable data protection legislation within the applicable time limits.

VI. RECIPIENTS OF PERSONAL DATA

BESCO may grant access to Personal Data only to the extent necessary for the relevant purpose and where an applicable legal basis exists.

Personal Data may be disclosed to the following categories of recipients:

  1. employees and other persons engaged by BESCO in the organisation and delivery of the Academy;
  2. providers of information technology, communication, technical, administrative and other services that process Personal Data on behalf of BESCO;
  3. service providers involved in the delivery of the Academy, including venues, accommodation providers and other organisational service providers, only to the extent that disclosure of the relevant data is necessary for the provision of the relevant service;
  4. accountants, auditors, lawyers and other professional advisers, where this is necessary for compliance with legal obligations or the protection of BESCO’s rights and legitimate interests;
  5. Academy partners, where the provision of information is necessary for the organisation or reporting of the programme;
  6. other Participants in the relevant cohort or persons included in the Alumni Network, where the relevant Participant has consented to the sharing of specified Personal Data;
  7. competent state, administrative or judicial authorities where disclosure of the Personal Data is required under applicable law;
  8. other persons where the Data Subject has expressly consented to such disclosure or where another applicable legal basis exists.

The Personal Data collected will be used only for the purposes relating to the organisation and delivery of the Academy. The Association will process and retain your Personal Data for as long as necessary to achieve the purposes for which the Personal Data was collected and to comply with any statutory retention requirements.

VII. RIGHTS OF DATA SUBJECTS

You have the following rights in relation to the Processing of your Personal Data:

Right to Be Informed

This Privacy Policy is intended to provide you with detailed information about the Processing of your Personal Data in connection with the Academy.

Right of Access

You have the right to obtain confirmation as to whether Personal Data relating to you is being processed and, where that is the case, to obtain access to such Personal Data and information concerning the Processing and your rights in relation to it.

Right to Rectification

You have the right to request the rectification of inaccurate Personal Data concerning you and the completion of incomplete Personal Data.

You may request correction of your Personal Data at any time by contacting us.

Right to Erasure

You have the right to request the erasure of your Personal Data where the applicable legal requirements are met, unless there is an overriding legal basis and/or legal obligation requiring its continued Processing.

Personal Data will be deleted following expiry of the applicable retention period. Until such time, the Personal Data may be disclosed, in accordance with the applicable legal procedure, to competent state authorities in the exercise of their supervisory powers or to a competent court in connection with judicial proceedings to which the Personal Data is relevant.

Where a legal dispute or other proceeding arises which requires the retention of Personal Data, or where a competent state authority requests its preservation, BESCO may retain the relevant Personal Data for a longer period until the final conclusion of the relevant dispute or proceedings.

Right to Restriction of Processing

You have the right to request restriction of the Processing of your Personal Data where the conditions provided for in the Regulation are met.

Notification of Recipients

Where applicable, you may request that the Controller communicate to recipients to whom your Personal Data has been disclosed any rectification or erasure of Personal Data or restriction of Processing.

Please note that BESCO does not act as an intermediary in relationships between you and other persons.

Right to Data Portability

Where the applicable legal requirements are met, you have the right to receive the Personal Data concerning you in a structured, commonly used and machine-readable format and to transmit that Personal Data to another controller.

Automated Decision-Making

You have the right not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless one of the exceptions provided for under applicable data protection law applies and appropriate safeguards are in place to protect your rights, freedoms and legitimate interests.

BESCO does not use technologies in connection with the Academy which fall within this category.

Right to Object

You have the right to object to the Processing of your Personal Data where such Processing is based on public interest, the exercise of official authority or legitimate interests.

Where an objection is submitted, BESCO will review your request and, where justified, will comply with it. Where BESCO considers that there are compelling legitimate grounds for the Processing which override your interests, rights and freedoms, or that the Processing is necessary for the establishment, exercise or defence of legal claims, you will be informed accordingly.

Right to Withdraw Consent

Where Processing is based on your consent, you have the right to withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of Processing carried out on the basis of consent prior to its withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority or seek judicial protection if you consider that the Processing of Personal Data relating to you infringes applicable data protection legislation.

The supervisory authority in the Republic of Bulgaria is:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia, Bulgaria

This Privacy Policy applies to the Processing of Personal Data in connection with the organisation and delivery of the Leadership and Advocacy Academy.

For all other Personal Data Processing activities carried out by BESCO, as well as matters not specifically addressed in this Privacy Policy, BESCO’s general Privacy Policy shall apply and is available at https://besco.bg/.

This Privacy Policy was adopted on 1 September 2026.