KBC Global Services NV – Branch Bulgaria – Data Protection Statement

This Data Protection Statement was last revised on 12 May 2023.

Part 1: General Provisions

Your privacy is important to Us. Our aim is to process personal data in a manner that is secure, lawful, fair, transparent and in compliance with all applicable national and European data protection laws and regulations.

In this Data Protection Statement, We explain what personal data We collect of visitors of Our Website and of applicants participating in the selection and recruitment process of KBC Global Services, on what basis We process the data and why. Lastly, We inform you about the security measures We take to protect your personal data gathered via Our Website - https://careers.kbc-group.com/SSC_BG/.

This Data Protection Statement applies to this Website only.

Where the text refers to an ‘applicant’, We mean both candidates for work placements, internships and candidates for permanent or temporary employment. Where the text refers to visitors of Our Website – We refer to people who have not registered an account on Our Website to apply for any of Our job positions, but only visit and view Our Website and the information posted on it.

We encourage you to read this Data Protection Statement carefully, as it also provides important information on your legal rights with respect to the processing of your personal data.

1.1. What is GDPR?

Seeking to protect citizens’ privacy in a more effective way, European institutions drew up the General Data Protection Regulation (GDPR). Furthermore, the Bulgarian Personal Data Protection Act is in force in Bulgaria. You will also find more information about the Bulgarian data protection legislation on the Commission for Personal Data Protection Authority’s website at https://www.cpdp.bg/. 

We advise you to carefully read Our Data Protection Statement, to ensure that you understand for what purposes KBC Global Services may use your personal data. 

This Data Protection Statement is regularly updated to keep it in line with the law and the changing business practices. We advise you to regularly visit Our Website to stay up to date on any amendments to this statement. Every amendment will result in a changed version date of Our Data Protection Statement marked at the top of this document.

1.2. The data controller

Your data is processed by KBC Global Services N.V. – Branch Bulgaria (referred to as “KBC Global Services”, “We”, “Us” or “Our”, “Controller”), entered into the Commercial register with the Registry Agency under Company Identity Number 206826647, having registered and head office address in the city of Sofia, Triaditsa region, 89B Vitosha Blvd, Millenium Center is a branch of KBC Global Services N.V - a company, incorporated under the Belgian law, under the Company Identity Number: 0772.332.707 with its head office is at Havenlaan 2 1080 (Sint-Jans-Molenbeek) Brussels Belgium. 

1.3. Contacts

If you have any questions regarding this Data Protection Statement, collection and processing of your personal data while using this Website, or you would like to exercise any of your rights under the GDPR, please refer them to:

  1. the KBC Global Services Risk & Compliance team via email at: ssc.risk.varna@kbc.com or
  2. If Our KBC Risk & Compliance team can't answer your question, contact the Data Protection Officer:
  • By post mail at: KBC Bank NV, Group Data Protection Unit (Group Compliance), Havenlaan 2, 1080 Brussels
  • By email at: dataprotection@kbc.be 

Part 2: Personal data being processed

2.1. What personal data do We collect and process? 

KBC Global Services collects your data when you apply for a work internship, placement or vacancy, as follows: 

2.1.1. We collect the following personal data directly from you: 

  • personal data you have provided through the form available on Our Website, through documents you downloaded and submitted to Us through and/or through Our Talent Acquisition team;
  • personal data that KBC Global Services has received through personal contact, telephone, Microsoft Teams’ conversations with you and/or by e-mails from you; 
  • personal data that KBC Global Services has received through a Talent Acquisition Platform (SAP SuccessFactors).

2.1.2. We also indirectly receive personal data from you:

When We use certain external to Our company websites, platforms and so on to which you have uploaded your CV and to which We have access in order to find suitable candidates for vacancies, We indirectly receive your personal data. This involves personal data:

that KBC Global Services obtains as a result of your application on LinkedIn: if you choose to apply using your LinkedIn profile, the data incorporated in your LinkedIn profile will automatically be retrieved for processing for the purpose of your application. By applying, you expressly state that all data you provided is correct and reliable; only data you share on professional social networks is processed for this purpose; 

that KBC Global Services receives from external selection and recruitment agencies it engages with to find suitable candidates; 

that KBC Global Services receives from your previous employers and/or the contacts indicated. 
KBC Global Services reserves the right to supplement the information obtained in the context of an application. The categories of personal data We process include, but are not limited to: 

  • your curriculum vitae, your photograph, if you decide to provide it, your cover letter;
  • identification details such as your first name(s) and last name;
  • personal data such as place of birth, date of birth, gender, nationality;
  • any work and/or residence permit for the European Economic Area (EEA);
  • contact details such as place of residence, address, e-mail address, telephone number, mobile phone number;
  • information about education/qualification: certificates, work placements, specific training programs, further training and courses; 
  • skills and competences such as driving license, language skills, IT skills, social skills; 
  • professional experience at former and current employer(s); 
  • hobbies and memberships (professional associations, sports clubs, youth movements, etc.); 
  • personal test results (i.e. the thinking skills report and the personality profile report, assessments and any asynchronous video interviews via SuccessFactors in the context of a vacancy; 
  • your image – if you visit Our office/premises for an interview. 

The above list is not exhaustive.

We do not collect or process any sensitive information about Our Website’s visitors and job applicants, such as information on race, political views, religious or ideological beliefs, membership of a trade union, health, sex life, or suspicions, prosecutions or criminal or administrative convictions against them. 

If, despite all Our efforts, a specific situation nevertheless compels Us to collect sensitive information about an applicant, We will do so on the basis of a valid exception (e.g., data disclosed by the candidate, with his/her explicit consent or for the need to comply with Our obligations under the labor law). 

2.2 Cookies 

This KBC Global Services job webpage uses cookies. More information about Our use of cookies is available in Our Cookie policy.

Part 3: Purposes and legal basis for processing and storing your personal data 

3.1 Why do We use your data?

The personal data you provide to Us as an applicant and that may be registered during this and/or a subsequent application process is processed with a view to selection and recruitment, in particular with a view to filling vacancies and offering work placements now and in the future. 

Your personal data may also be used to inform you of vacancies at KBC Global Services that may interest you. Your data is processed in the context of an application you have submitted and with a view to the possible conclusion of an employment contract or a work placement contract. Your personal data is processed to register your candidacy for a vacancy or work placement at KBC Global Services, to assess your suitability for the vacancy or work placement, and to ascertain whether you meet all requirements for the position.

The basis for processing personal data obtained directly is the implementation of pre-contractual measures necessary to conclude a possible employment contract or work placement contract. In principle, your personal data will be retained for the duration of the selection process on the basis of pre-contractual measures We are required to take at your request. 
After the selection process and irrespective of whether you have been selected for the position, your personal data will be stored in Our database. We will then be able to contact you about any future vacancies or work placements that match your knowledge and skills. The basis for this processing is Our legitimate interest. 

When We indirectly consult your personal data on professional social networks, the basis for the personal data processing is Our legitimate interest. 

If you are invited for an interview in Our office/premises, We may record your image in and around the offices and premises through security cameras. If a security camera is present, KBC informs you with a clearly visible sticker. The legal basis for the processing in this case is Our legitimate interest.

We will ask for your permission to contact your previous and current employers and/or the contacts you have indicated.

KBC Global Services can only rely on a legitimate interest if the processing is necessary to defend this legitimate interest and if the applicant’s interests have been weighed against those of KBC Global Services. 

In the event of a positive assessment and decision, your data will be used to draft an employment contract or work placement contract, for which additional information will be needed. The legal basis for this processing is the performance of the contract.

Furthermore, We also use your data for research and statistical purposes, with any connections to individuals being severed as quickly as possible. Collecting data to develop analytical models makes it possible to gain data-driven insights that help KBC Global Services make strategic choices about the quality of Our selection and recruitment process. KBC Global Services aggregates your data to a level where it is no longer personal data, for example to publish insights and trends resulting from a satisfaction survey. 

We may also process your data for marketing purposes as follows:

KBC Global Services NV – Branch Bulgaria may use your data, such as location, usage or interactions history to deliver any news, analysis, research, reports, marketing campaigns and training opportunities that may interest you.

For sending you email newsletters in which KBC Global Services NV – Branch Bulgaria regularly provides you with news about Our services as well as useful tips, appointments and promotions, We may use the so-called ‘opt-in’ procedure, i.e. KBC Global Services NV – Branch Bulgaria can only send you a newsletter by email if you have previously explicitly confirmed to KBC Global Services NV – Branch Bulgaria that We should activate the newsletter service either by submitting an online form, ticking a checkbox or clicking on a link to confirm that you wish to receive Our newsletter. If you no longer wish to receive newsletters from KBC Global Services NV – Branch Bulgaria later, you can object to them at any time. A message sent to the contact details mentioned in this Privacy statement is sufficient. Of course, you will also find in every newsletter an unsubscribe link.

If you give explicit consent to receive personalized marketing messages, KBC Global Services NV – Branch Bulgaria can make the communication tailored perfectly to your individual situation. You will no longer receive screens of adverts that are of no interest to you. In this regard, KBC Global Services NV – Branch Bulgaria uses your available personal data (including website usage data and information obtained from third-party and public sources). You can withdraw your consent at any time, just as easily as you gave it.

Aside from this, KBC Global Services NV – Branch Bulgaria may send you job offers based on your usage patterns on its websites and apps, albeit only if you agree to the use of cookies. The cookie consent determines which offer KBC Global Services NV – Branch Bulgaria can send you. In order to be able to send you the appropriate message through the correct channel, KBC Global Services NV – Branch Bulgaria may also call on other service providers. For this, KBC Global Services NV – Branch Bulgaria may cooperate with communication and marketing agencies, and similar companies such as social media players (e.g., Facebook, LinkedIn, Instagram, Twitter etc.). Sometimes We only use information We have about you or your personal profile information held by them. In other cases, We combine these data. These third parties may process your data in their capacity as processors or controllers, depending on the type of cooperation. Please, consult their privacy statements for more information.

KBC Global Services NV – Branch Bulgaria may also process personal data for training purposes in case you choose to participate in a training, academy, webinar, etc., organized by KBC Global Services NV – Branch Bulgaria, your personal data, limited to: name and e-mail will be processed. The purpose of the processing of the above-mentioned data is limited to the purposes of the conducted training, namely training registration form, and will be processed for the duration of the training course. The legal basis for such processing is the legitimate interest of both parties. If you expressed interest in a particular job position after the end of the training, your name and email will be used by recruiter for contacting you and starting a regular recruitment process.

Only if having your explicit consent collected via opt-in functionality, We may use the contact information We collect from you for the following specific purposes:

  • To administer a contest, promotion, survey or other site feature
  • To enable you to rate and review Our services

Furthermore, We will request your consent to process:

  • geolocation data (unless expressly stated otherwise)
  • data entered by you in a simulation or competition entry form in order to send you advertising messages
  • underlying data of a form that needs to be completed with certain information for Us to be able to process the form, in which case We will generally ask you to check the data’s accuracy

Any collection and processing of Our website visitors’ and applicant’s data is proportionate, relevant, and strictly necessary for the specific purposes for which the data is collected and processed. 

3.2 Data retention period 

KBC Global Services only uses your personal data for a specific purpose. If the purpose no longer exists, your data will be erased. 

If you are not hired, We will process and retain your data for a period no longer than 6 months after the selection process for the specific position you have applied for has ended. KBC Global Services complies with this obligation by deleting your personal data after the retention period, if you are not hired. 

The information on the application form may also be used for a subsequent application to save you from having to re-enter the same information. Your data will be automatically updated if you begin a new application. 

If the selection process results in an employment contract being signed, the data you provided during the selection and recruitment process will be included in your employee file and will be processed as long as We have legal basis to do so.

Information that you personally register in the SuccessFactors HR system is retained by KBC Global Services NV – Branch Bulgaria for five years.

Any records of conversations with job applicants or such made for training and coaching of Our employees are retained for one month.

Any images recorded by security cameras in and around KBC Global Services NV – Branch Bulgaria premises (identified with a sticker) for no more than one month. They may be kept for longer:

  • if the recorded images serve as evidence of certain dealings or may depict a criminal offence or unruly behavior
  • as evidence of damage or in order to identify an offender, witness or victim
  • where a right of access is exercised, for as long as necessary to respond to the request
  • at locations that present an increased security risk, in which case the period is three months

3.3 Data accuracy 

As an applicant, you understand that the data you provide needs to be up to date, accurate and complete to ensure a smooth selection and recruitment process. By applying, you expressly state that all data you provide is correct and reliable. 

Part 4: Transfer/consultation of your personal data 

4.1 Consultation of personal data by sister/subsidiary companies of the KBC group in Belgium 

When applying for a job, you make certain personal data available to KBC Global Services. We operate not only in Bulgaria, however. Our headquarters are in Belgium and We have offices in several other countries in Europe. We are part of an integrated international bank-insurance group, i.e. a group of companies that cooperate closely in order to create and distribute banking, investment and insurance products and provide financial services. 

In addition to the processing in Our HR department, your data may be processed and shared with the rest of the KBC entities (e.g., the HR department and line managers) involved in am abroad vacancy or work placement or to which your current or future application is relevant. This involves mainly the following KBC entities:

  • KBC Group NV Company number: 0403.227.515 with its registered office at Havenlaan 2, 1080 Brussels, Belgium 
  • KBC Bank NV Company number: 0462.920.226 with its registered office at Havenlaan 2, 1080 Brussels, Belgium
  • KBC Assurances SA Company number: 0403.552.563 with its registered office at Professor Roger Van Overstraetenplein 2, 3000 Leuven, Belgium 7 Version 12 April 2023 Confidential
  • KBC Asset Management NV Company number: 0469.444.267 with its registered office at Havenlaan 2, 1080 Brussels, Belgium 
  • KBC Autolease NV Company number: 0422.562.385 with its registered office at Professor Roger Van Overstraetenplein 5, 3000 Leuven, Belgium 
  • KBC Securities NV Company number: 0437.060.521 with its registered office at Havenlaan 2, 1080 Brussels, Belgium 
  • KBC Commercial Finance NV Company number: 0403.278.488 with its registered office at Havenlaan 6, 1080 Brussels, Belgium.

Each of the KBC companies is responsible for the further processing of your personal data once it receives this data.

4.2 Transfer of personal data outside the EEA

KBC Global Services always prefers personal data processing within the European Economic Area (‘EEA’). If, however, We cooperate with a third party, the personal data may end up in countries where that third party’s data centers are located. If data is transferred to another data controller or data processor in a country outside the EEA, KBC Global Services will monitor the transfer and the necessary measures will be taken.

The law in some countries outside the EEA (like the United States of America or India) doesn’t always afford the same level of data protection as in EEA member states. Where a non-EEA country is viewed by the European Commission as not offering an adequate level of protection, KBC Global Services NV – Branch Bulgaria can cover the deficiency by, say, agreeing the required contractual guarantees with those third parties (such as using standard contractual clauses approved by the European Commission), providing control mechanisms and implementing technical and organizational measures. 

The transfer of personal data to countries outside the European Economic Area or to international organizations is screened by KBC. This transfer either takes account of the European Commission’s list of safe countries or is based on reasonable and sufficient security measures or falls under a specific derogation from the GDPR. The most important aspects of international data transfer are explained in more detail below. Feel free to e-mail dataprotection@kbc.be if you have any questions.

When We directly or indirectly cooperate with parties such as Amazon, Microsoft, Meta, LinkedIn personal data transfers may occur. Even if the data center is located within the EEA, access from outside the EEA may still be possible in some cases (e.g., in case of technical problems or when round-the-clock support is required). This is also considered data transfer outside the EEA. For some processes, the processors’ data centers may be located outside the EEA or accessed from outside the EEA, as is the case for the United States of America. Some examples include:

  • Microsoft - data relating to product ownership and product usage, etc.
  • AWS - data relating to product ownership and product usage, financial data, etc.

Additionally, We use the services of the following providers that may transfer and process your personal data within their corporate structures outside the EU/EEA:

  • InnoCraft Ltd - for pseudonymized and encrypted processing of user activity on Our website, storing historical data of user engagement with Our website and services, analyzing on an anonymous and aggregated basis the website users’ behavior. The company is based in New Zealand - one of the countries that the EU considers having an adequate level of data protection. 
  • Meta Platforms Ireland Limited – for interacting with you on the social media platforms associated with Facebook, for analyzing on an anonymous and aggregated basis user interaction with Our social media page as well as with Our advertisement on the platform, for showing users targeted advertisement tailored to their interests and based on their previous interaction with Our social media page or website. The company has a parent company in the USA and may transfer your data to this country considered by the EU as not having an adequate level of data protection according to GDPR. Our use of this company's services up to the extent permitted by law is based on your explicit and informed consent. 
  • LinkedIn Ireland Unlimited Company - for interacting with you on the social media platform, for analyzing on an anonymous and aggregated basis user interaction with Our social media page as well as with Our advertisement on the platform, for showing users targeted advertisement tailored to their interests and based on their previous interaction with Our social media page or website. The company has a parent company in the USA and may transfer your data to this country considered by the EU as not having an adequate level of data protection according to GDPR. Our use of this company's services up to the extent permitted by law is based on your explicit and informed consent. 
  • Twitter International Unlimited Company - for interacting with you on the social media platform, for analyzing on an anonymous and aggregated basis user interaction with Our social media page as well as with Our advertisement on the platform, for showing users targeted advertisement tailored to their interests and based on their previous interaction with Our social media page or website. The company has a parent company in the USA and may transfer your data to this country considered by the EU as not having an adequate level of data protection according to GDPR. Our use of this company's services up to the extent permitted by law is based on your explicit and informed consent.
  • Google Ireland Limited - for showing you targeted advertisement tailored to your interests and based on your previous interaction with Our website. The company has a parent company in the USA and may transfer your data to this country considered by the EU as not having an adequate level of data protection according to GDPR. Our use of this company's services up to the extent permitted by law is based on your explicit and informed consent. 

We share your personal data with the above-listed providers in a secure manner using encryption methods (e.g., data hashing). Please note, however, that your personal data may be transferred to a third country, specifically to a data processor's parent company based in the United States of America. The personal data being transferred is encrypted and aggregated and includes anonymized IP address, details of your browsing activity on Our website and on other website, details about your interactions with Our content and ads on platforms provided by the above-listed processors, user ID, browser language, device ID and other details stored in cookies as described in Our Cookie policy.

For transferring your data outside the EU/EEA, the data processors ensure internally their compliance with applicable data protection laws, including the GDPR via multiple technical and organizational measures, relying on standard contractual clauses and other methods as the appropriate safeguards for such transfers. Nevertheless, We want to inform you that transferring personal data to a third country may involve risks, such as differences in the data protection laws of that country compared to the European Union's General Data Protection Regulation (GDPR), which may not provide the same level of protection for your personal data.

Furthermore, We would like to advise you that in rare occasions, these providers may also receive requests from government agencies for disclosure of your personal data (collected via cookies – user IDs, device IDs, IP addresses) previously encrypted during processing, storage and transfer. Even though the data may be encrypted by these providers on multiple levels (e.g., at rest and during transfer), the encryption key is held by and remains on their servers and can be requested by the government agencies and eventually disclosed for decryption. Such disclosures may take place only if multiple legal criteria are met by the request, including full compliance with GDPR. Nevertheless, the government authorities may be able to access your personal data (even if significant efforts are needed for obtaining such access) once it is transferred outside the EEA. More detailed information on the providers’ data processing terms, including international data transfers transparency reports, you may find in the privacy policies published on their websites.

Please note that you have the right to withdraw your consent at any time by modifying the cookie settings via the Cookie Consent Manager on Our website. Your ability to use Our Website is not dependent on your consent or consent withdrawal.

4.3 Subcontractors 

KBC Global Services engages external selection and recruitment agencies (service providers) to cooperate in a recruitment process and find suitable candidates. These service providers may carry out assessments, prerecorded interviews, live interviews and online tests. 

Prior to the transfer of your data, KBC Global Services will ensure that all data processors take the necessary organizational and technical measures in accordance with the GDPR. 
KBC Global Services collaborates with Microsoft (video interviews), MatrixRelo (visa applications for international candidates), Tack TMI and Motiv P (assessments) as well as JOBS.BG, DEV.BG, JobTiger, Tuk-Tam, BulgariaWantsYou LinkedIn, Adecco, Infosys, Bulwork, Cognizant, Adastra, Yorce and Manpower for recruitment and market research purposes. Our company also collaborates in Varna with the University of Economics, the Technical University, the Naval Academy and the Varna University of Management. 

KBC Global Services NV does not sell candidates’ personal data to third parties. 

Part 5: The candidate’s rights 

You have the right to request from Us access to, rectification or erasure of your personal data, restriction of processing concerning the data subject or, where applicable, the right to data portability. Please note that the rights provided to data subjects are not absolute rights and may be subject to exceptions, which may be applied on a case-by-case basis

5.1 You have the right to access your data and to have it rectified 

As an applicant, you have the right to access your personal data being processed (summary report) or to have inaccurate or incomplete personal data rectified in the context of the selection and recruitment process. 

5.2 You can request the erasure of your data 

As an applicant, you may also request erasure of the personal data that have been processed. If you have given KBC Global Services consent to process your data, you may withdraw this consent at any time. 

5.3 You can object to your data being processed or ask for restriction of the processing

If you disapprove of the manner in which We process certain data in accordance with Our legitimate interests, you have the right to object. You always have the right to object – on grounds related to your particular situation – to the processing of your personal data on the basis of a legitimate interest pursued by the data controller or a third party, unless the interests or the fundamental rights and freedoms of the data subject that require personal data protection prevail (e.g., storage of your data in Our database after the selection process). If you object to the processing, your personal data will no longer be processed for these purposes.

You can also ask for restriction of your data being processed, if you consider your data is inaccurate or unlawfully held. 

5.4 You can ask Us to provide your data to a third party.

This applies to personal data you have personally provided to Us. Under certain conditions, you may have it transmitted to yourself or to another data controller.

5.5 How can you exercise your rights? 

You can send your query/question/request to Our Risk & Compliance team via email at: ssc.risk.varna@kbc.com

If you cannot get satisfactory resolution of the matter by the above route, you can contact the ‘Data Protection Officer’ at KBC by letter addressed to KBC Group NV, Group Data Protection Unit (Group Compliance), Havenlaan 2, 1080 Brussels, or by e-mail to dataprotection@kbc.be. 

If you wish to exercise your rights, please describe your request as accurately as possible to allow Us handle your request effectively and correctly. 
We can ask you to verify your identity to prevent others from exercising your rights in your name. 

5.6 If you would like more information

Please, feel free to visit the website of the Bulgarian Data Protection Authority at: https://www.cpdp.bg/. 

You can also ask a question and/or lodge a complaint there. Contact details: 
Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Е-mail: kzld@cpdp.bg
Web-site: www.cpdp.bg

Part 6: Data security and confidentiality 

KBC ensures that the European data protection standards for personal data are applied worldwide within companies belonging to the KBC group and their branches. KBC also ensures that companies and corporate branches of the KBC group take appropriate measures to protect the data of legal persons.

KBC Global Services NV – Branch Bulgaria takes appropriate internal technical and organizational measures to protect the data you provide against unauthorized or unlawful access, alteration, loss, destruction or accidental or intentional damage. Strict security measures are in place to protect premises, servers, the network, data transfers and the data itself, and extra checks are also carried out by a specialist department in this regard. These measures take account of the technical possibilities, the nature, scale and context of the data, and the purpose of the processing, as well as the processing risk.

KBC websites may contain links to websites or information of third parties. Parties offering these websites, or this information may have their own privacy policies in place, which We advise you to read.

6.1 Organizational measures 

KBC Global Services takes internal measures to ensure the confidentiality of personal data and to prevent it from becoming accessible to and processed by unauthorized parties, or from being accidentally changed or deleted. 

Access to the personal data you provide as an applicant is limited to those individuals who need to access the data to perform their duties. These individuals may only use the data if this is necessary for the performance of their duties in the context of the selection and recruitment process. 

The individuals who have access to your data are also strictly bound by a professional duty of confidentiality and are required to abide by all technical instructions intended to ensure the confidentiality of your personal data and the security of the systems in which the data is held. 

6.2 Technical measures 

KBC Global Services takes internal technical measures to prevent your personal data finding its way into the hands of, or being processed by, unauthorized parties or being accidentally altered or deleted. Strict security measures are in place to protect premises, servers, the network, data transfers and the data itself.

A specialist department carries out additional checks. If data is exchanged (see 4.1), KBC Global Services will ensure that the exchange only takes place if the recipient guarantees that it has taken equivalent organizational and technical measures.