Mandatory information about the rights of individuals for the protection of personal data for prospective candidate students, students, and doctoral students at IBS
Information about the personal data admin:
Name:
International Business School
BULSTAT: 122037746
Registered office and management address:
2140 Botevgrad, 14 Gurko Street, International Business School
Correspondence address:
2140 Botevgrad, 14 Gurko Street info@ibsedu.bg
Name of the responsible person:
Stela Parvanova Milanova
Information about the competent supervisory authority for personal data protection
Name: Commission for Personal Data Protection
Registered office and management address:
1592 Sofia, Prof. Tsvetan Lazarov Blvd. №2
Correspondence address: 1592 Sofia, Prof. Tsvetan Lazarov Blvd. №2
Phone: 02/915 3 518
Website: www.cpdp.bg
The International Business School (referred to below as the “Administrator,” “IBS,” or “we”) conducts its activities in accordance with the Personal Data Protection Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The purpose of this information is to inform you about all aspects of the processing of your personal data by the University and the rights you have in connection with this processing.
Basis for collecting, processing, and storing your personal data
Article 1. (1) IBS collects and processes personal data of the following categories of individuals for conducting the candidate-student campaign, contests for obtaining a doctoral degree, and carrying out the education process: prospective students and students enrolled in regular or distance learning for obtaining a bachelor’s or master’s degree; Doctoral candidates; Doctoral students. The personal data of the mentioned individuals are collected and processed on the basis of Article 6, paragraph 1 of Regulation (EU) 2016/679 (GDPR), specifically based on the following grounds:
To comply with a legal obligation applicable to the University;
For the performance of a task carried out in the public interest or in the exercise of official authority vested in the Administrator;
Your explicit consent to the processing of certain categories of personal data.
IBS adopts Rules for admission of students for each candidate-student campaign based on Article 5 of the Regulation on state requirements for admission of students to higher education institutions in the Republic of Bulgaria in connection with Article 68, paragraph 1, item 2 of the Higher Education Act, which defines the requirements and conditions for admission of Bulgarian citizens and citizens of European Union and European Economic Area countries who have completed secondary education as students at the International Business School.
The University adopts Rules for educational activities, which determine the overall procedure for conducting the education of students, including doctoral students, trainees, and course participants. IBS conducts its activities in compliance with the requirements of the regulatory framework and the application of the Higher Education Act, published in the State Gazette, issue 112 of December 1995, and with all subsequent amendments and supplements thereto, Decrees of the Council of Ministers, as well as internal acts of IBS authorities.
Purposes and principles in collecting, processing, and storing your personal data
Article 2. (1) In collecting, processing, and storing your personal data for participation in the candidate-student campaign and admission, IBS collects and processes personal data for the purpose of registering the candidate in the electronic system for participation in the candidate-student campaign, individualizing the candidate, establishing contact, sending information to the candidate, and assessing whether the candidate meets the requirements defined in the Rules. The University uses your data in anonymized form, which does not allow your individual identification, for statistical purposes and for summarizing information about trends in candidate-student campaigns.
Article 3. The University collects and uses only your personal data as enrolled students, which are necessary for your individualization as a student of IBS and for conducting the educational process, providing administrative services, and other activities necessary during your education as a student.
Article 4. The University collects and processes personal data of doctoral candidates for the purposes of administering the competition process, ranking, announcement of results, enrollment, as well as throughout the training and acquisition process of the doctoral scientific and educational degree.
Article 5. The University adheres to the following principles in processing your personal data:
- legality, fairness, and transparency; purpose limitation;
- data minimization and relevance to the purposes of processing;
- accuracy and timeliness of the data;
- limitation of storage for the purpose of achieving the goals;
- integrity and confidentiality of processing and ensuring an appropriate level of security of personal data.
Article 6. In processing and storing personal data, the University may process and store personal data, including for the fulfillment of its obligations to state, judicial, and municipal authorities. What types of personal data does the University collect, process, and store for prospective students, newly enrolled, and enrolled students?
Article 7. (1) The University collects, processes, and stores the following personal data for prospective students upon registration in the “Candidate Student Admission” electronic system by submitting an application to take the candidate student exam in person at the IBS building or through the online platform:
- Full name of the individual;
- Personal identification number;
- Address as per ID card;
- ID card details – number, date of issue, expiry date, issuing authority, citizenship;
- Health status data;
- Marital status data;
- Education completed data;
- Gender;
- Faculty number;
- Foreigner’s personal ID number;
- Performance data;
- Contact phone number;
- Email address;
- Citizenship and residency status.
IBS performs the following operations with the personal data provided by you during registration in the electronic system as a prospective student:
Organizing and conducting candidate student campaigns: IBS processes your personal data for 1) accepting and processing the application and set of documents for candidacy, 2) creating a user profile in the “Candidate Student Admission” system for the respective individual for the purpose of identifying the person as a candidate student in the system and during the exam, 3) administering the process of allocating exam halls for distributing students in different exam halls, 4) identifying the candidate student during the exam and for preparation for ranking based on the results of the conducted exams to assess whether the results are sufficient for admission to the desired professional fields at IBS.
Conclusion from the assessment of the impact of the personal data operation: The operation “Organizing and conducting candidate student campaigns” is permissible to conduct and provides sufficient guarantees for the protection of the rights and legitimate interests of the data subjects in accordance with the requirements of Regulation (EU) 2016/679 (GDPR).
Article 7. (1) The University processes personal data under Article 6, paragraph 1 for prospective students upon submission of documents and application for enrollment in the desired area and professional direction following the respective ranking. All personal data when enrolling in the professional direction is transferred from the already submitted personal data in the candidate student admission system, and IBS does not collect new personal data from the individual.
IBS performs the following operations with the provided personal data upon enrollment in the desired professional direction following successful ranking:
Enrolling newly admitted students: The processing of personal data is done by capturing the personal data from the information already entered in the “Candidate Student Admission” system and transferring it to the “Student” system. The individual’s personal data is used to enroll the newly admitted student at IBS and to create an electronic file.
Conclusion from the assessment of the impact of the operation: The operation “Enrolling newly admitted students” is permissible to conduct and provides sufficient guarantees for the protection of the rights and legitimate interests of the data subjects in accordance with the requirements of Regulation (EU) 2016/679 (GDPR).
Article 8. (1) IBS processes the personal data collected under Article 6, paragraph 1, and Article 7, paragraph 2, contained in the “Student” system, throughout the entire educational process in the respective professional field of the student, with additional data possibly collected in certain cases (e.g., grades, marital status, etc.). IBS performs the following operations with the personal data provided by you as a student enrolled in regular, part-time, or distance learning:
Administration of the educational process, exam grades, and ranking for scholarships: The purpose of processing personal data in this operation is to serve the educational process at IBS, including conducting exams, preparing exam protocols, ranking for scholarships, updating the student record in the main books and the “Student” system, issuing certificates, academic transcripts, service notes, and other documents requested by the student.
Conclusion of the impact assessment of the operation: The operation “Administration of the educational process, exam grades, and ranking for scholarships” is permissible and provides sufficient guarantees for protecting the rights and legitimate interests of data subjects in accordance with the requirements of Regulation (EU) 2016/679 (GDPR).
Graduation of students: IBS processes data of its students provided during enrollment for the purpose of issuing a diploma for completing higher education for the respective educational qualification degree.
Conclusion of the impact assessment of the operation: The operation “Graduation of students” is permissible and provides sufficient guarantees for protecting the rights and legitimate interests of data subjects in accordance with the requirements of Regulation (EU) 2016/679 (GDPR).
Exchange of Bulgarian and foreign students and recognition of diplomas issued abroad: IBS processes personal data of students who wish to apply for an exchange program, including the Erasmus program, for participation in ranking and implementation of the exchange program, as well as students who have completed education abroad and apply for diploma recognition. Additional data may be collected during this operation (e.g., bank account, language proficiency, etc.).
Conclusion of the impact assessment of the operation: The operation “Exchange of Bulgarian and foreign students and recognition of diplomas issued abroad” is permissible and provides sufficient guarantees for protecting the rights and legitimate interests of data subjects in accordance with the requirements of Regulation (EU) 2016/679 (GDPR).
Article 9. (1) Personal data is collected by IBS from the individuals to whom it pertains. IBS does not engage in automated decision-making with data. IBS does not collect and process data for individuals under 16 years of age.
What types of personal data does the University collect, process, and store for doctoral candidates and enrolled doctoral students?
Article 10. (1) IBS collects and processes data for doctoral candidates when applying for participation, as well as when successfully ranked and enrolled as a doctoral student (e.g., names, address, Personal Identification Number, phone number, email, data on completed higher education and obtained educational qualification degree, etc.).
IBS performs the following operations with the personal data provided by you as a doctoral candidate:
Conducting competitions for doctoral students: The purpose of the operation is to administer the process of conducting a competition for doctoral students, ranking the participants in the competition, enrolling the doctoral student in regular, distance, or self-study form, conducting the training process, taking exams, etc.
Conclusion of the impact assessment of the operation: The operation “Conducting competitions for doctoral students” is permissible and provides sufficient guarantees for protecting the rights and legitimate interests of data subjects in accordance with the requirements of Regulation (EU) 2016/679 (GDPR).
Article 11. (1) Personal data is collected by IBS from the individuals to whom it pertains. IBS does not engage in automated decision-making with data. IBS does not collect and process data for individuals under 16 years of age.
Term of storage of your personal data
Article 12. (1) IBS retains your personal data as a candidate student for the entire duration of the candidate student campaign for which you have enrolled, and for a period of up to 5 years after its conclusion, after which IBS takes necessary steps to delete and destroy all your personal data without undue delay or anonymize them (i.e., render them in a form that does not reveal your identity) and deletes your profile in the electronic system.
IBS retains your personal data provided during enrollment as a newly admitted student for the entire duration of your studies. After the student graduates, the data is archived and stored indefinitely for the purposes of protecting IBS’s legitimate interests.
IBS retains your personal data provided during enrollment as a doctoral candidate and enrolled doctoral student for the entire duration of the education and until the acquisition of the doctoral scientific and educational degree. After this period expires, the data is archived and stored indefinitely for the purposes of protecting the student’s legitimate interests.
IBS will notify you when the data retention period needs to be extended to fulfill a regulatory obligation or to protect the legitimate interests of the University or others.
Transfer of Your Personal Data for Processing:
Article 13. (1) The University may, at its own discretion, transfer some or all of your personal data to data processors for the purpose of processing, with which you have agreed, while complying with the requirements of Regulation (EU) 2016/679 (GDPR).
The University will inform you if it intends to transfer some or all of your personal data to third countries or international organizations.
Rights in the Collection, Processing, and Storage of your Personal Data:
Withdrawal of Consent for Processing your Personal Data:
Article 14. (1) If you do not want all or part of your personal data to continue to be processed by the University for specific or all processing purposes, you can withdraw your consent for processing at any time by making a free-text request or completing the form in Appendix No. 1, sent by email or on paper.
IBS may request you to verify your identity and identity with the person to whom the data relates by asking you to present an identity document in person.
Withdrawal of consent does not affect the lawfulness of processing your personal data provided by you until the withdrawal of consent.
IBS may continue to process some or all of your data if there is a legal obligation to do so or for the purposes of protecting its legitimate interests.
Right of Access:
Article 15. (1) You have the right to request and receive confirmation from IBS whether your personal data is being processed.
You have the right to access the data related to you, as well as information related to the collection, processing, and storage of your personal data.
IBS provides you, upon request, a copy of the processed personal data related to you, in electronic or other appropriate form.
Access to the data is free of charge, but the University reserves the right to impose an administrative fee in case of repeated or excessive requests.
Right to Correction, Completion, and/or Amendment:
Article 16. You have the right to request IBS to:
correct inaccurate personal data related to you;
complete and/or supplement incomplete personal data related to you.
Right to Erasure (“Right to be Forgotten”):
Article 17. (1) You have the right to request IBS to delete some or all of your personal data, and IBS is obliged to delete them without undue delay when one of the following grounds applies:
the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
you withdraw your consent, which is the basis for data processing, and there is no other legal basis for processing;
you object to the processing of your personal data, and there are no overriding legitimate grounds for the processing;
the personal data has been processed unlawfully;
the personal data must be erased to comply with a legal obligation under EU law or the law of a Member State that applies to the University;
the personal data has been collected in connection with the provision of information society services.
The University is not obliged to delete personal data if it retains and processes it:
for the exercise of the right to freedom of expression and information;
to comply with a legal obligation requiring processing provided for in EU law or the law of the Member State applicable to the University, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in it;
for reasons of public interest in the field of public health;
for archiving purposes in the public interest, for scientific or historical research purposes, or for statistical purposes;
for the establishment, exercise, or defense of legal claims.
In case of exercising your right to be forgotten, IBS will delete all your data, except for your unique civil registration number for reporting purposes.
To exercise your right to be forgotten, you need to send a free-text request or complete the form according to Appendix No. 2 by email or on paper, and to authenticate yourself with an identity document in person.
Right to Restriction:
Article 18. You have the right to request IBS to restrict the processing of your data when:
you contest the accuracy of the personal data for a period that allows IBS to verify the accuracy of the personal data;
the processing is unlawful, but you do not want your personal data to be deleted and only request the restriction of their use;
IBS no longer needs your personal data for processing purposes, but you need them to establish, exercise, or defend legal claims;
you have objected to processing pending verification whether the legitimate grounds of IBS override yours.
Right to portability
Article 19. (1) If you have given consent for the processing of your personal data or processing is necessary for the performance of a contract with IBS, or if your data is processed by automated means, you may, after legitimizing yourself to IBSs: request IBS to provide you with your personal data in a suitable format and transfer them to another administrator; request the University to directly transfer your personal data to an administrator specified by you, when this is technically feasible. You can exercise your right to portability by sending a request in free text or a completed form according to Appendix No. 3 by email or on paper.
Right to receive information
Article 20. You may request IBSs to inform you about all recipients to whom the personal data for which correction, deletion, or processing restriction has been requested have been disclosed. IBS may refuse to provide this information if it is impossible or requires disproportionate effort.
Right to object
Article 21. You may object at any time to the processing of your personal data by IBS, including if they are processed for profiling or direct marketing purposes.
Your rights in case of a personal data breach
Article 22. (1) If IBS detects a breach of the security of your personal data, which may pose a high risk to your rights and freedoms, it shall inform you of the breach without undue delay, as well as of the measures taken or to be taken. IBS is not obliged to inform you if: appropriate technical and organizational measures have been taken to protect the data affected by the security breach; subsequent measures have been taken to ensure that the breach will not lead to a high risk to your rights; notification would require disproportionate effort.
Persons to whom your personal data are provided
Article 23. For the purposes of processing your personal data and executing concluded contracts, IBS may provide your data to third parties, processing personal data, who comply with all requirements for legality and security in the processing and storage of your personal data.
Article 24. IBS does not transfer your data to third countries or international organizations.
Article 25. In case of violation of your rights, according to the above or the applicable legislation for personal data protection, you have the right to file a complaint with the Commission for Personal Data Protection, as follows:
Article 26. You can exercise all your rights regarding the protection of your personal data through the forms attached to this information. These forms are not mandatory; you can submit your requests in any form that contains a statement to this effect and identifies you as the data subject.
PRIVACY NOTICE – PASSIVE MODE (in Bulgarian)
