KBC Global Services NV – Branch Bulgaria – Data Protection Statement

KBC Global Services NV – Branch Bulgaria – Data Protection Statement

This Data Protection Statement was last revised on 6th March 2025.

Preliminary: the most significant changes in this version of the Data Protection Statement

We would like to draw your attention to the salient changes in this Data Protection Statement:

  • The contact details for any questions related to this document or your rights as a data subject have been updated (section 1.2)
  • The personal data we collect directly from you (section 2.1.1)
  • The personal data we collect indirectly from you (section 2.1.2)
  • Purposes and legal basis for processing your personal data (section 3.1)
  • Data retention period (3.2)
  • Consultation of personal data by sister/subsidiary companies, part of the KBC Group (4.1)
  • Subcontractors (section 4.3)
  • Updated list of subcontractors (section 4.5)
  • Your rights (part 5)


Part 1: General Provisions

Your privacy is important to Us. Our aim is to process personal data in a manner that is secure, lawful, fair, transparent and in compliance with all applicable national and European data protection laws and regulations.

In this Data Protection Statement, We explain what personal data We collect of visitors of Our Website and of applicants participating in the selection and recruitment process of KBC Global Services, on what basis We process the data and why.

We also inform you about the security measures We take to protect your personal data gathered via Our Website - KBC Global Services | Choose work that works for you

This Data Protection Statement applies to this Website only.

Where the text refers to an ‘applicant’, We mean candidates for work placements, internships and candidates for permanent or temporary employment. Where the text refers to visitors of Our Website – We refer to people who have not registered an account on Our Website to apply for any of Our job positions but only visit and view Our Website and the information posted on it.

We encourage you to read this Data Protection Statement carefully, as it also provides important information on your legal rights.

This Data Protection Statement is regularly reviewed to keep it in line with the law and the changing business practices. We advise you to regularly visit Our Website to stay up to date on any amendments to this statement.

Every amendment of this Data Protection Statement will result in a changed version date marked at the top of this document.

1.1. The data controller

Your data is processed by KBC Global Services N.V. – Branch Bulgaria (referred to as “KBC Global Services”, “We”, “Us” or “Our”, “Controller”), entered into the Commercial register with the Registry Agency under Company Identity Number 206826647, having registered and head office address in the city of Sofia, Triaditsa region, 89B Vitosha Blvd, Millenium Center.  We are a branch of KBC Global Services N.V - a company, incorporated under the Belgian law, under the Company Identity Number: 0772.332.707 with its head office is at Havenlaan 2 1080 (Sint-Jans-Molenbeek) Brussels Belgium. 

1.2. Contacts

If you have any questions regarding this Data Protection Statement, collection and processing of your personal data while using this Website, or you would like to exercise any of your rights under the GDPR, please refer them to:

  1. the KBC Global Services N.V. – Branch Bulgaria - Compliance team via email at: compliance.gs.bg@kbc.com
  2. or if Our Compliance team can't answer your question, you can also consult with Group Data Protection Unit (Group Compliance) by email at: dataprotection@kbc.be  

Part 2: Personal data processing

2.1. What personal data do We collect and process? 

We collect your data when you visit our website, apply for a work internship, placement or vacancy, as follows: 

2.1.1. Personal data We collect directly from you: 

  • personal data you have provided through the form available on Our Website, through documents you downloaded and submitted to Us and/or through Our Talent Acquisition team;
  • personal data that KBC Global Services has received through personal contact, telephone, Microsoft Teams’ conversations with you and/or by e-mails from you; 
  • personal data that KBC Global Services has received through a Talent Acquisition Platform (SAP SuccessFactors);
  • if you are selected to fill in the job vacancy you have applied for, we will ask, upon your explicit consent, for additional personal data such as your personal telephone number – to be able to set up in advance the corporate laptop you will receive on your first working day at KBC Global Services as an employee.

2.1.2. We also indirectly receive personal data from you:

When We use certain external to Our company websites and platforms to which you have uploaded your CV and to which We have access to in order to find suitable candidates for vacancies, We indirectly receive your personal data. This involves personal data which:

  • KBC Global Services obtains as a result of your application on LinkedIn: if you choose to apply using your LinkedIn profile, the data incorporated in your LinkedIn profile will automatically be retrieved for processing for the purpose of your application. By applying, you expressly state that all data you provided is correct and reliable; only data you share on professional social networks is processed for this purpose; 
  • KBC Global Services receives from external selection and recruitment agencies it engages with to find suitable candidates; 
  • KBC Global Services receives from your previous employers and/or the contacts indicated. 
  • KBC Global Services receives from external service providers performing background checks.
  • KBC Global Services reserves the right to supplement the information obtained in the context of an application. The categories of personal data We process include, but are not limited to: 
  • your curriculum vitae, your photograph, if you decide to provide it, your cover letter;
  • identification details such as your first name(s) and last name;
  • other personal data such as place of birth, date of birth, gender, nationality;
  • any work and/or residence permit for the European Economic Area (EEA);
  • contact details such as place of residence, address, e-mail address, telephone number, mobile phone number;
  • information about education/qualification: certificates, work placements, specific training programs, further training and courses; 
  • skills and competences such as driving license, language skills, IT skills, social skills; 
  • professional experience – upon your consent, a reference check with your former and current employer(s), upon your consent – a background check related to your stated professional experience in your social media profiles; 
  • if you choose to provide us with information about your hobbies and memberships (professional associations, sports clubs, youth movements, etc.); 
  • personal test results (i.e. the thinking skills report and the personality profile report, assessments; 
  • your image – if you visit Our office/premises for an interview. 

The above list is not exhaustive.

We do not collect or process any sensitive information about Our Website’s visitors and job applicants, such as information on race, political views, religious or ideological beliefs, membership of a trade union, health, sex life, or suspicions, prosecutions or criminal or administrative convictions against them. 

If, despite all our efforts, a specific situation nevertheless compels Us to collect sensitive information about an applicant, we will do so on the basis of a valid exception (e.g., data disclosed by the candidate, with his/her explicit consent or for the need to comply with Our obligations under the law). 

2.2 Cookies 

This KBC Global Services job webpage uses cookies. More information about our use of cookies is available in Our Cookie policy.

Part 3: Purposes and legal basis

3.1 Why do We use your data and based on what?

The personal data you provide to Us as an applicant and that may be registered during this and/or a subsequent application process is processed with a view to selection and recruitment, in particular with a view to filling vacancies and offering work placements now and in the future. This personal data we process in the context of your application and with a view to the possible conclusion of an employment or a work placement contract.

Your personal data may also be used to inform you of vacancies at KBC Global Services that may interest you. This personal data we process based on your explicit consent, which you can withdraw at any time.

Aside from this, KBC Global Services NV – Branch Bulgaria may send you job offers based on your usage patterns on its websites and apps, albeit only if you agree to the use of cookies. The cookie consent determines which offer KBC Global Services NV – Branch Bulgaria can send you. In order to be able to send you the appropriate message through the correct channel, KBC Global Services NV – Branch Bulgaria may also call on other service providers. For this, KBC Global Services NV – Branch Bulgaria may cooperate with communication and marketing agencies, and similar companies such as social media players (e.g., Facebook, LinkedIn, Instagram, Twitter etc.). Sometimes We only use information We have about you or your personal profile information held by them. In other cases, We combine these data. These third parties may process your data in their capacity as processors or controllers, depending on the type of cooperation. Please, consult their privacy statements for more information.

In some cases, when we assess your suitability for the vacancy or work placement, and to ascertain whether you meet all requirements for the position, we may process your data based on the need to conclude a contract with you, but also based on our legitimate interest (e.g. when We assess potential conflicts of interest) or based on your explicit consent (e.g. when we request for reference checks with your previous employer or when we ask for your permission to check your social media profiles).

If you are invited for an interview in Our office/premises, we may record your image in and around the offices and premises through security cameras. If a security camera is present, KBC informs you with a clearly visible sticker. The legal basis for the processing in this case is Our legitimate interest.

If you have been selected to fill in a vacancy, we may also ask for your consent to provide us with your personal telephone number in order to enable Us setting up in advance your employee’ corporate laptop.

Furthermore, we also use your data for research and statistical purposes, with any connections to individuals being severed as quickly as possible. Collecting data to develop analytical models makes it possible to gain data-driven insights that help KBC Global Services make strategic choices about the quality of Our selection and recruitment process. KBC Global Services aggregates your data to a level where it is no longer personal data, for example to publish insights and trends resulting from a satisfaction survey. 

Based on your consent, we may also process your data (such as location, usage or interactions history to deliver any news, analysis, research, reports,) for training opportunities, academies, webinars, and other marketing purposes. This means that KBC Global Services NV – Branch Bulgaria can only send you a newsletter by email, if you have previously explicitly confirmed to KBC Global Services NV – Branch Bulgaria that We should activate the newsletter service either by submitting an online form, ticking a checkbox, or clicking on a link to confirm that you wish to receive Our newsletter. If you no longer wish to receive newsletters from Us, you can withdraw your consent at any time by simply sending a message to the contact details mentioned in this Data Protection Statement or by selecting the “unsubscribe” link in every newsletter.

Only if having your explicit consent collected via opt-in functionality, We may use the contact information We collect from you for the following specific purposes:

  • To administer a contest, promotion, survey or other site feature
  • To enable you to rate and review Our services

Furthermore, we will request your consent to process:

  • geolocation data (unless expressly stated otherwise)
  • data entered by you in a simulation or competition entry form in order to send you advertising messages
  • underlying data of a form that needs to be completed with certain information for Us to be able to process the form, in which case We will generally ask you to check the data’s accuracy

Monitoring of KBC correspondence in written form any incoming correspondence sent to a KBC staff member in their capacity as KBC employees is considered as business-related and We are entitled to read it in the context of:

  • our duties;
  • the production of evidence;
  • workplace checks;
  • security;
  • fraud prevention;
  • service optimization, efficiency and/or continuity.

In this sense, any e-mail collected and processed personal data of our website visitors and job applicants is monitored based on our legitimate interest.

3.2 Data retention period 

KBC Global Services only uses your personal data for a specific purpose. If the purpose no longer exists, your data will be no longer processed. 

In principle, the personal data of job applicants is retained for no longer than 6 months after the duration of the specific recruitment process is completed, unless the job applicant has explicitly expressed his/her interest in keeping his/her profile open to receive similar job offers from KBC recruiters.

If the selection process results in an employment contract being signed, the data you provided Us during the selection and recruitment process will be included in your employee file and will be processed as long as We have legal basis to do so.

Any Information that you personally registered in the SuccessFactors HR system is retained by KBC Global Services NV – Branch Bulgaria as long as We have legal basis to do so.

Any images recorded by security cameras in and around KBC Global Services NV – Branch Bulgaria premises (identified with a sticker) for no more than two months. They may be kept for longer:

  • if the recorded images serve as evidence of certain dealings or may depict a criminal offence or unruly behavior;
  • as evidence of damage or in order to identify an offender, witness or victim;
  • where a right of access is exercised, for as long as necessary to respond to the request;
  • at locations that present an increased security risk.

3.3 Data accuracy 

As an applicant, you understand that the data you provide needs to be up to date, accurate and complete to ensure a smooth selection and recruitment process. By applying, you expressly state that all data you provide is correct and reliable. 

Part 4: Transfer/consultation of your personal data 

4.1 Consultation of personal data by sister/subsidiary companies, part of the KBC Group

When applying for a job, you make certain personal data available to KBC Global Services. We operate not only in Bulgaria however Our headquarters are in Belgium and We have offices in several other countries in Europe. We are part of an integrated international bank-insurance group, i.e. a group of international companies that cooperate closely in order to create and distribute banking, investment and insurance products and provide financial services. 

In addition to the processing in Our HR department, your data may be processed and shared with the rest of the KBC Group entities (e.g., the HR department and line managers involved in the recruitment, abroad vacancy or work placement or to which your current or future application is relevant).

4.2 Transfer of personal data outside the EEA

KBC Global Services always prefers personal data processing within the European Economic Area (‘EEA’). If, however, We cooperate with a third party, the personal data may end up in countries where that third party’s data centers are located. If data is transferred to another data controller or data processor in a country outside the EEA, KBC Global Services will monitor strictly the transfer, and the necessary measures will be taken.

The law in some countries outside the EEA (like the United States of America or India) doesn’t always afford the same level of data protection as in EEA member states. Where a non-EEA country is viewed by the European Commission as not offering an adequate level of protection, KBC Global Services NV – Branch Bulgaria can cover the deficiency by agreeing the required contractual guarantees with those third parties (such as using standard contractual clauses approved by the European Commission), providing control mechanisms and implementing additional technical and organizational measures. 

The transfer of personal data to countries outside the EEA or to international organizations is screened by KBC. This transfer either takes account of the European Commission’s list of safe countries or is based on reasonable and sufficient security measures or falls under a specific derogation from the GDPR. The most important aspects of international data transfer are explained in more detail below. Feel free to e-mail dataprotection@kbc.be if you have any questions.

When We directly or indirectly cooperate with parties such as Amazon, Microsoft, Meta, LinkedIn personal data transfers may occur. Even if the data center is located within the EEA, access from outside the EEA may still be possible in some cases (e.g., in case of technical problems or when round-the-clock support is required). This is also considered data transfer outside the EEA. For some processes, the processors’ data centers may be located outside the EEA or accessed from outside the EEA, as is the case for the United States of America. Some examples include:

  • Microsoft - data relating to product ownership and product usage, etc.
  • AWS - data relating to product ownership and product usage, financial data, etc.

Additionally, We use the services of the following providers that may transfer and process your personal data within their corporate structures outside the EU/EEA:

  • InnoCraft Ltd - for pseudonymized and encrypted processing of user activity on Our website, storing historical data of user engagement with Our website and services, analyzing on an anonymous and aggregated basis the website users’ behavior. The company is based in New Zealand - one of the countries that the EU considers having an adequate level of data protection. 
  • Meta Platforms Ireland Limited – for interacting with you on the social media platforms associated with Facebook, for analyzing on an anonymous and aggregated basis user interaction with Our social media page as well as with Our advertisement on the platform, for showing users targeted advertisement tailored to their interests and based on their previous interaction with Our social media page or website. The company has a parent company in the USA and may transfer your data to this country considered by the EU as not having an adequate level of data protection according to GDPR. Our use of this company's services up to the extent permitted by law is based on your explicit and informed consent. 
  • LinkedIn Ireland Unlimited Company - for interacting with you on the social media platform, for analyzing on an anonymous and aggregated basis user interaction with Our social media page as well as with Our advertisement on the platform, for showing users targeted advertisement tailored to their interests and based on their previous interaction with Our social media page or website. The company has a parent company in the USA and may transfer your data to this country considered by the EU as not having an adequate level of data protection according to GDPR. Our use of this company's services up to the extent permitted by law is based on your explicit and informed consent. 
  • Twitter International Unlimited Company - for interacting with you on the social media platform, for analyzing on an anonymous and aggregated basis user interaction with Our social media page as well as with Our advertisement on the platform, for showing users targeted advertisement tailored to their interests and based on their previous interaction with Our social media page or website. The company has a parent company in the USA and may transfer your data to this country considered by the EU as not having an adequate level of data protection according to GDPR. Our use of this company's services up to the extent permitted by law is based on your explicit and informed consent.
  • Google Ireland Limited - for showing you targeted advertisement tailored to your interests and based on your previous interaction with Our website. The company has a parent company in the USA and may transfer your data to this country considered by the EU as not having an adequate level of data protection according to GDPR. Our use of this company's services up to the extent permitted by law is based on your explicit and informed consent. 

We share your personal data with the above-listed providers in a secure manner using encryption methods (e.g., data hashing). Please note, however, that your personal data may be transferred to a third country, specifically to a data processor's parent company based in the United States of America. The personal data being transferred is encrypted and aggregated and includes anonymized IP address, details of your browsing activity on Our website and on other website, details about your interactions with Our content and ads on platforms provided by the above-listed processors, user ID, browser language, device ID and other details stored in cookies as described in Our Cookie policy.

For transferring your data outside the EU/EEA, the data processors ensure internally their compliance with applicable data protection laws, including the GDPR via multiple technical and organizational measures, relying on standard contractual clauses and other methods as the appropriate safeguards for such transfers. Nevertheless, We want to inform you that transferring personal data to a third country may involve risks, such as differences in the data protection laws of that country compared to the European Union's General Data Protection Regulation (GDPR), which may not provide the same level of protection for your personal data.

Furthermore, We would like to advise you that in rare occasions, these providers may also receive requests from government agencies for disclosure of your personal data (collected via cookies – user IDs, device IDs, IP addresses) previously encrypted during processing, storage and transfer. Even though the data may be encrypted by these providers on multiple levels (e.g., at rest and during transfer), the encryption key is held by and remains on their servers and can be requested by the government agencies and eventually disclosed for decryption. Such disclosures may take place only if multiple legal criteria are met by the request, including full compliance with GDPR. Nevertheless, the government authorities may be able to access your personal data (even if significant efforts are needed for obtaining such access) once it is transferred outside the EEA. More detailed information on the providers’ data processing terms, including international data transfers transparency reports, you may find in the privacy policies published on their websites.

Please note that you have the right to withdraw your consent at any time by modifying the cookie settings via the Cookie Consent Manager on Our website. Your ability to use Our Website is not dependent on your consent or consent withdrawal.

4.3 Subcontractors 

KBC Global Services engages external selection and recruitment agencies (service providers) to cooperate in the recruitment process and find suitable candidates. These service providers may carry out assessments, prerecorded interviews, live interviews and online tests. 

Prior to the transfer of your data, KBC Global Services will ensure that all data processors take the necessary organizational and technical measures in accordance with the GDPR. 
KBC Global Services collaborates with multiple service providers, such as (the list is representative, but not exhaustive): Microsoft (video interviews), MatrixRelo (visa applications for international candidates), Tack TMI, Motiv P, iMocha (assessments) as well as JOBS.BG, DEV.BG, JobTiger, Tuk-Tam, BulgariaWantsYou, LinkedIn, Adecco, Infosys, Bulwork, Cognizant, Adastra, Yorce and Manpower for recruitment and market research purposes. Our company also collaborates in Varna with the University of Economics, the Technical University, the Naval Academy and the Varna University of Management. 

KBC Global Services NV does not sell candidates’ personal data to third parties. 

Part 5: Your rights 

You have the right to request from Us access to, rectification or erasure of your personal data, restriction of processing concerning the data subject or, where applicable, the right to data portability. Please note that the rights provided to data subjects are not absolute rights and may be subject to exceptions, which may be applied on a case-by-case basis.

If you would like to exercise any of your rights, you can submit to the following form to compliance.gs.bg@kbc.com.

5.1 You have the right to access your data and to have it rectified 

As an applicant, you have the right to access your personal data being processed (summary report) or to have inaccurate or incomplete personal data rectified in the context of the selection and recruitment process. 

5.2 You can request the erasure of your data 

As an applicant, you may also request erasure of the personal data that have been processed. If you have given KBC Global Services consent to process your data, you may withdraw this consent at any time. 

5.3 You can object to your data being processed or ask for restriction of the processing

If you disapprove of the manner in which We process certain data in accordance with Our legitimate interests, you have the right to object. You always have the right to object – on grounds related to your particular situation – to the processing of your personal data on the basis of a legitimate interest pursued by the data controller or a third party, unless the interests or the fundamental rights and freedoms of the data subject that require personal data protection prevail (e.g., storage of your data in Our database after the selection process). If you object to the processing, your personal data will no longer be processed for these purposes.

You can also ask for restriction of your data being processed, if you consider your data is inaccurate or unlawfully held. 

5.4 You can ask Us to provide your data to a third party.

This applies to personal data you have personally provided to Us. Under certain conditions, you may have it transmitted to yourself or to another data controller.

5.5 How can you exercise your rights? 

You can send your request via email at: compliance.gs.bg@kbc.com.

If you wish to exercise your rights, please describe your request as accurately as possible to allow Us handle your request effectively and correctly. 
We can ask you to verify your identity to prevent others from exercising your rights in your name. 

If you cannot get satisfactory resolution of the matter by the above route, you can contact KBC by letter addressed to KBC Group NV, Group Data Protection Unit (Group Compliance), Havenlaan 2, 1080 Brussels, or by e-mail to dataprotection@kbc.be. 

5.6 If you would like more information, please, feel free to visit the website of the Bulgarian Data Protection Authority at: https://www.cpdp.bg. 

You can also ask a question and/or lodge a complaint there.

Contact details: 
Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Е-mail: kzld@cpdp.bg
Website: www.cpdp.bg

Part 6: Data security and confidentiality 

KBC ensures that the European data protection standards for personal data are applied worldwide within companies belonging to the KBC group and their branches. KBC also ensures that companies and corporate branches of the KBC group take appropriate measures to protect the data of legal persons.

KBC Global Services NV – Branch Bulgaria takes appropriate internal technical and organizational measures to protect the data you provide against unauthorized or unlawful access, alteration, loss, destruction or accidental or intentional damage. Strict security measures are in place to protect premises, servers, the network, data transfers and the data itself, and extra checks are also carried out by a specialist department in this regard. These measures take account of the technical possibilities, the nature, scale and context of the data, and the purpose of the processing, as well as the processing risk.

KBC websites may contain links to websites or information of third parties. Parties offering these websites, or this information may have their own privacy policies in place, which We advise you to read.

6.1 Organizational measures 

KBC Global Services takes internal measures to ensure the confidentiality of personal data and to prevent it from becoming accessible to and processed by unauthorized parties, or from being accidentally changed or deleted. 

Access to the personal data you provide as an applicant is limited to those individuals who need to access the data to perform their duties. These individuals may only use the data if this is necessary for the performance of their duties in the context of the selection and recruitment process. 

The individuals who have access to your data are also strictly bound by a professional duty of confidentiality and are required to abide by all technical instructions intended to ensure the confidentiality of your personal data and the security of the systems in which the data is held. 

6.2 Technical measures 

KBC Global Services takes internal technical measures to prevent your personal data finding its way into the hands of, or being processed by, unauthorized parties or being accidentally altered or deleted. Strict security measures are in place to protect premises, servers, the network, data transfers and the data itself.

If data is exchanged, KBC Global Services will ensure that the exchange only takes place if the recipient guarantees that it has taken equivalent organizational and technical measures.