Data Protection Policy

National Crime Prevention Service (NCPS)
NCPS Ltd — Bulstat / UIC: 208390351, Republic of Bulgaria

1. Introduction

NCPS is committed to protecting personal data, respecting individual privacy and ensuring that personal data is processed lawfully, fairly and transparently.

This Policy sets out the principles and responsibilities governing the collection, use, storage, sharing and protection of personal data by NCPS in accordance with applicable Bulgarian and European Union data protection requirements, including the General Data Protection Regulation (GDPR).

2. Purpose

This Policy aims to:

Ensure personal data is processed lawfully, fairly and transparently
Establish appropriate practices for the collection, use, storage, retention and disposal of personal data
Define responsibilities for personnel and third parties handling personal data on behalf of NCPS
Protect personal data against unauthorised access, loss, misuse or disclosure
Support individuals in exercising their data protection rights

3. Scope

This Policy applies to NCPS employees, consultants, contractors, authorised third parties and other persons who process personal data under the responsibility or control of NCPS.

It applies to personal data handled electronically, on paper or through other systems used by NCPS.

4. Data Protection Principles

NCPS applies the following data protection principles:

4.1 Lawfulness, Fairness and Transparency

Personal data will be processed on an appropriate legal basis and individuals will be provided with clear information about how their data is used where required.

4.2 Purpose Limitation

Personal data will be collected for specific, explicit and legitimate purposes and will not be used for incompatible purposes without an appropriate legal basis.

4.3 Data Minimisation

Only personal data that is adequate, relevant and necessary for the relevant purpose will be collected and processed.

4.4 Accuracy

Reasonable steps will be taken to ensure that personal data is accurate and kept up to date where necessary.

4.5 Storage Limitation

Personal data will be retained only for as long as necessary, taking account of applicable legal, regulatory and operational requirements.

4.6 Integrity and Confidentiality

Appropriate technical and organisational measures will be used to protect personal data against unauthorised or unlawful access, loss, destruction, alteration or disclosure.

4.7 Accountability

NCPS will maintain appropriate policies, procedures and records to support compliance with applicable data protection requirements.

5. Rights of Data Subjects

Subject to applicable law and any relevant exemptions, individuals may have the following rights:

5.1 Access

The right to request access to personal data held about them.

5.2 Rectification

The right to request correction of inaccurate or incomplete personal data.

5.3 Erasure

The right to request deletion of personal data where the legal requirements for erasure are met.

5.4 Restriction of Processing

The right to request restriction of processing in circumstances provided for by applicable law.

5.5 Data Portability

The right to receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, request its transfer to another controller.

5.6 Objection

The right to object to certain processing activities where the applicable legal requirements are met.

NCPS will respond to valid data protection requests within the applicable statutory time limits.

6. Data Security

6.1 Technical and Organisational Measures

NCPS will implement appropriate technical and organisational measures proportionate to the nature and risks of the personal data being processed.

These measures may include access controls, secure storage, authentication, appropriate security safeguards and procedures for protecting personal information.

6.2 Third-Party Data Processors

Where third parties process personal data on behalf of NCPS, appropriate contractual and data protection arrangements will be established where required by law.

Third parties will be expected to maintain appropriate confidentiality and security measures.

6.3 Personal Data Breaches

Suspected personal data breaches must be reported to the appropriate person within NCPS as soon as reasonably possible.

NCPS will assess and respond to suspected breaches in accordance with applicable law.

Where notification to a supervisory authority or affected individuals is legally required, NCPS will make the appropriate notification within the applicable statutory timeframe.

7. International Transfers

Where personal data is transferred outside the European Economic Area (EEA), NCPS will ensure that an appropriate legal mechanism and safeguards are in place in accordance with applicable data protection law.

These may include an adequacy decision, appropriate contractual safeguards or another legally recognised transfer mechanism.

8. Training and Awareness

NCPS will provide appropriate information and guidance to personnel who handle personal data.

Training or additional guidance may be provided where required by changes in legislation, operational requirements or identified data protection risks.

9. Data Protection Responsibilities

NCPS will maintain appropriate responsibility for overseeing data protection matters within the organisation.

Personnel who handle personal data are responsible for:

Accessing personal data only when authorised and necessary
Keeping personal data secure and confidential
Following applicable data protection requirements and NCPS procedures
Reporting suspected breaches or inappropriate access promptly
Cooperating with legitimate data protection reviews and requests

10. Non-Compliance

Failure to comply with this Policy or applicable data protection requirements may result in appropriate corrective or disciplinary action.

Serious matters may also be referred to relevant regulatory or law enforcement authorities where required or appropriate.

11. Policy Review

This Policy will be reviewed annually or when significant changes occur to applicable legislation, regulatory requirements, NCPS operations or data protection practices.

All relevant personnel will be informed of significant revisions.visions.