POLICY FOR THE PROCESSING AND PROTECTION OF PERSONAL DATA OF PARTNERS AND CONTRACTORS OF COLDY DENT FUNCTIONAL ATELIER

I. Why should you become familiar with the policy for the processing and protection of personal data applied by COLDY DENT Functional Atelier?

COLDY DENT Functional Atelier (hereinafter referred to as "Coldy Dent") processes personal data in its capacity as controller of personal data of our patients, partners and counterparties, as well as of our employees. This means that your personal data – such as name, address, phone, contact e-mail, position, qualification and work experience, personal health data, conviction data, etc. – may be stored with us.

As an expression of our commitment to ensure the highest level of protection of your personal data, we have drawn up internal rules and follow strict procedures to control the processing of personal data, which are in line with the requirements of the General Data Protection Regulation (GDPR) and the Personal Data Protection Act. This Policy aims to clarify all basic questions relating to our processing of personal data – for what purposes we process data, on what basis and for what periods. Here you can check what your rights in relation to the personal data we process are, and how to contact us to exercise them.

If you cannot find in this Policy an answer to any of your questions related to the processing of personal data, you can contact us in the manners indicated below.

II. Why and how Coldy Dent processes personal data of customers

In these cases, the personal data include both personal data used to individualise and contact the patient, and personal data relating to the patient's health status, including recordings of conference calls where the patient's treatment plan and the required patient's assistance are discussed. In addition, data may be processed in connection with payments made by the patient.

In particular, we process the following groups of personal data regarding the state of health of our patients: data regarding the patient's dental and maxillofacial status, other aspects of his/her state of health related to them, including photographs and video recordings, including of the treatment.

Coldy Dent also processes data of its partners and contractors. These data include data used to individualise the relevant person and/or its representatives, contact details, data regarding services provided and payments made. In respect of certain categories of persons, data on their qualifications and professional specialisation may also be stored with a view to provide better dental care when this is necessary to preserve the health of a particular patient.

Coldy Dent also processes data of its employees for the purposes of concluding employment contracts and fulfilling its obligations under an already concluded employment contract. In this connection, we process data used to individualise the employee and contact him/her, bank account data, education and professional experience, specialisations, bank accounts, and criminal record.

III. What does the term "personal data" include?

Coldy Dent applies its confidentiality standards to all information that comes to our knowledge in the course of our business. Nevertheless, this Policy relates specifically to the protection of personal data – and to guaranteeing the rights of the individuals to whom said data relate.

The personal data that are covered by this Policy include any information relating to a specific natural person, and may include name, address, contact details, qualification and work experience details, personal health details, conviction details, job and employer data. In some cases, the personal data we process may not be sufficient to determine which individual they relate to – for example, data that has been anonymised. We apply to these data the same standards of protection that we apply to all other data, but in order to exercise your rights set out below in relation to such data, you will need to assist us so that we can identify you.

We also process information about visits to our website as personal data, and the information is stored on the terminal devices of registered website users only. You can learn more about our cookie policy at the following link – Cookie Policy.

IV. For what purposes do we process personal data

1. In connection with the provision of dental care

The main activity of Coldy Dent is related to the provision of dental care, and for this purpose it is necessary to individualise our patients, to process data on their dental status, including their overall health condition, in relation to deciding on the most appropriate treatment approach and with a view to preserving their health.

In this case, the basis for processing the data is precisely the fulfilment of a contractual obligation, and this also includes the processing in connection with the provision of certain information and/or services before the conclusion of a contract for the provision of dental care.

For this purpose, we will process each patient's personal data until the termination of the contract (i.e. until the service is refused), as well as for a certain period after that within which additional rights and obligations may arise for the parties to the contract. This term is usually 6 years after termination of the relationship related to the provision of dental care: Warranty periods, time periods for compliance with the obligation of confidentiality.

Information about the treatment provided, its effects and results may, after deletion of the data identifying the patient, be used for the purposes of medical research and training, subject to Article 28(1)(6) of the Health Act.

2. For the purposes of implementing concluded employment or service contracts

Within the framework of a concluded contract, the use of specific data for specific purposes may be provided for, for example, the use of photographs of a party to the contract for marketing purposes.

3. To fulfil legal obligations

Coldy Dent, in its capacity as a commercial company, is obliged by law to keep accounts and maintain an archive of documentation (e.g. employment records, etc.). In addition, Coldy Dent has obligations under the Health Act and the Medical Treatment Facilities Act in relation to the dental care provided. Your personal data may be used in order to fulfil our obligations under the Accountancy Act, the Health Act, the Medical Treatment Facilities Act, as well as our obligations arising from all legal provisions in force on the territory of the Republic of Bulgaria at the time the processing takes place.

According to the Accountancy Act:

• all accounting documents must be kept for a minimum of 3 years, starting from 1 January of the tax year following the tax year in which they were drawn up;
• documents concerning tax and social insurance control – including invoices and others – must be stored for a period of 10 years after 1 January of the tax year following the tax year in which the tax or social insurance liability arose;
• accounting registers and reports must be kept for a period of 10 years after 1 January of the tax year following the tax year to which they relate;
• payroll records must be kept for a period of 50 years.

Pursuant to Ordinance No 8 of 3 November 2016 on preventive examinations and systematic medical observation, personal data must be stored for a period of 3 years, after which those on electronic media must be archived, and those on paper – destroyed.

4. To protect the legitimate interests of Coldy Dent

We may need your personal data to prove to relevant supervisory authorities or third parties that we are fulfilling our legal obligations, as well as in connection with clarifying claims by or against the company. In this regard, we also process the data provided by our access control systems on the media provided to us, including video surveillance systems, physical access control, etc.

For this purpose, personal data are usually stored for a period of up to 6 years from the occurrence of an event that may give rise to claims; if claims have arisen, the data is stored until these claims are settled.

Additionally, Coldy Dent may process personal data for marketing purposes – for instance photos from your treatment. In these cases the personal data is processed on basis of your consent or on basis of a concluded contract, under which you have granted this right explicitly.

5. On the basis of your express consent

We will explicitly state the purposes for which we will use your personal data when we ask for your consent, and we will ensure that such data will only be used for those purposes. In the rare cases where the processing of your personal data is based on your consent, you can withdraw your consent at any time. In this case, we will immediately stop processing data for the relevant purpose; this will not, however, affect processing on another basis – for example where we have a contractual or legal obligation to do so. You can always object to the processing of your personal data for the purposes of being provided with information by us, in which case we will immediately stop the provision of information in question.

V. What are your rights in relation to the personal data processed by us

1. To receive information about the personal data we process and the purposes of the processing

As a rule, this information will be provided at the start of the provision of our services – i.e. at the time of conclusion of a contract with users, or with our contractors and employees, but you can make inquiries in this regard at all times.

In addition, if you are our patient, you also have the rights specified in Article 28b of the Health Act to receive information about your state of health, including a copy of your medical documentation. This information can also be provided to a person authorised by you or to other persons authorised by law.

2. To request that we rectify your personal data that are incorrect or inaccurate

3. To request that we erase your personal data

When there is no reason for us to continue processing your personal data, you can at any time ask us to erase all information about you that we store. If the contractual relationship between us has been completed and we have no legal obligation to retain this information, it will be deleted.

4. To request that we store your personal data without processing it in any other way

If there is no basis for us to continue processing your personal data, but you do not want them to be erased – for example, with a view to future use of our services – you can at any time request that we stop any other form of processing and only store your data. In this case, we will only be able to process your data with your consent or by virtue of the law.

5. To request that we provide your personal data to you

If you would like to receive a copy of any data we process in respect of you, you can always request this. In this case, you must indicate whether we can provide you with the data on paper or electronically in a standard file format (.pdf, .doc).

6. To object to the processing of your personal data

When we process your personal data to protect our interests, you can object to the processing at any time. If we are protecting our legitimate interest with the processing, we will make an assessment as to whether we can stop the processing or not.

Processing timeframes: Your request will be considered within 1 month. If we have difficulties in fulfilling your request, this period can be extended by up to 2 months, and we undertake to notify you of this extension within 1 month of receiving your request.

Grounds for rejection: Your request may be rejected in the following cases:

• if we cannot identify you;
• if we have received a large number of requests from you in a short period of time.

Notwithstanding the foregoing, you may at any time request information about how we store your personal data. For our part, we undertake to provide you with answers to your questions in a short period of time.

If you believe that we are infringing your rights, you can file a complaint with the Commission for the Protection of Personal Data which oversees our processing of personal data.