Privacy policy

1. INTRODUCTION

Medical Centre MedIns – Sveti Gerasim Kefaloniyski EOOD (the “Medical Centre”) adopts this privacy policy in order to make every necessary effort to protect, to the highest degree, the personal data provided when using nuviva.bg

This Privacy Policy also aims to explain clearly and understandably how personal data is processed and what measures are taken to protect it.

This Privacy Policy applies to the services provided by nuviva.bg while the website is being used.

2. PROVIDER

Medical Centre MedIns – Sveti Gerasim Kefaloniyski EOOD is a commercial company registered with the Registry Agency, Commercial Register and Register of Non-Profit Legal Entities, under UIC 207026238, with its registered office and address of management at 155 Cherni Vrah Blvd, Krastova Vada, Lozenets district, Sofia 1407.

Contact phone: +35989 9 999 156

Email for correspondence: info@nuviva.bg

3. DATA PROTECTION OFFICER

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 and the Personal Data Protection Act, the appointed data protection officer is Nadezhda Ilieva.

Data protection officer’s phone: 0899 999156

Email for correspondence: info@nuviva.bg

4. DEFINITIONS

This policy uses terms from European and Bulgarian data protection legislation, as follows:

• Personal data: any information that identifies a specific natural person or relates to a natural person who can be identified;
• Processing (of personal data): any operation performed on personal data, such as collection, recording, use, structuring, destruction, etc.;
• Controller: the person who determines the purposes and means of processing personal data;
• Processor: a person who processes personal data on behalf of the controller;
• Supervisory authority: an independent public authority responsible for enforcing data protection legislation. In Bulgaria, this is the Commission for Personal Data Protection (CPDP);

5. PRINCIPLES

• Compliance with applicable legislation, namely lawfulness, fairness and transparency;
• A specific reason for processing personal data;
• Collecting the minimum amount of personal data, solely for the purposes for which it is needed;
• Storage for the periods set by applicable law and confidential destruction;
• Accuracy and currency, with timely deletion and correction guaranteed;
• Providing timely information on each person’s rights in relation to the processing of their personal data;
• Maintaining our systems so that we can demonstrate at any time compliance with the rules and principles of this Privacy Policy.

6. PERSONAL DATA PROCESSED

Depending on the activity, we process some or all of the following categories of personal data:

• Data on natural persons: first name, middle name, surname, personal identification number (EGN), address;
• Data on legal entities: the company’s representative(s);
• Contact details: phone number, email address;
• Data contained in reports or other documents received, including electronically;
• Data collected when visiting the website: IP address.

7. HOW WE COLLECT PERSONAL DATA

The Medical Centre collects personal data in several ways.

We collect personal data directly from you:

• when you contact us for medical and/or other services;
• when you visit the Medical Centre or submit applications, requests, enquiries, complaints, feedback or other documents, including electronically;

We collect personal data from third parties:

• in connection with applications, requests, complaints, objections, etc.;
• when a public authority carries out an inspection, including when we receive a request to provide data.

8. PURPOSES AND LEGAL BASIS FOR PROCESSING

In providing our services, activities and/or maintenance of the website may be outsourced, which may require the lawful conclusion and performance of contracts that directly affect the services provided. On this basis we process all data listed in section 6, except for data relating to security and/or improving service quality and data collected when visiting the website.

Purposes and a legal basis for processing personal data may also arise in connection with a legal obligation relating to the creation, distribution and/or operation of the website.

In connection with the performance of contracts and/or compliance with legal obligations, we may contact you by sending a message through a mobile app to the phone number provided, or by sending a letter to your postal or email address, in order to provide or request information that is strictly necessary for the services provided.

In certain cases we are required to provide personal data to public authorities in the Republic of Bulgaria, in order to comply with legal obligations.

Tax and accounting legislation in the Republic of Bulgaria requires us to prepare and keep certain accounting and commercial records containing personal data for a set period.

On these grounds we may process all data listed in section 6.

When you use the website, we process your personal data only with your explicit consent, given for specific purposes, which may include:

• Booking an appointment;
• Sending an enquiry through the contact forms;
• Receiving information about one-off and subscription services, as well as other activities of the Medical Centre;
• Receiving our newsletter;

You can withdraw your consent at any time by emailing info@nuviva.bg or by using any of the other means of communication listed in this Privacy Policy.

In certain cases we need to process your personal data for the purposes of the Medical Centre’s legitimate interests.

9. PERSONAL DATA OF JOB APPLICANTS

Your personal data may be processed in order to review your requests or job applications. In this case, Article 25k of the Personal Data Protection Act applies.

10. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

• Registered users:

When a data subject registers and creates a user profile on the website, the controller receives the following personal data: full name, personal identification number (EGN), username, password, email address and IP address.

• Enquiries:

When a data subject contacts the controller through the contact form, they provide their name, email address and a comment on their enquiry.

• Legal interest:

In the event of legal disputes, the Medical Centre may process the following categories of data subjects’ personal data: names, email address and other data.

• Marketing purposes:

Where applicable, the controller may process personal data for marketing purposes. In this case, it collects names, email addresses and phone numbers from data subjects in an appropriate manner.

If personal data has been provided by the data subject to the controller without a legal basis under Article 6(1) of Regulation (EU) 2016/679, or contrary to the principles of Article 5 of the same Regulation, the Medical Centre will return it within one month of becoming aware of this, or, if that is impossible or would require disproportionate effort, will delete or destroy it. Deletion and destruction are documented in writing.

The personal data listed in section 6 may be provided to processors carrying out activities on behalf of the Medical Centre, only after a written agreement has been concluded. The Medical Centre carefully vets its processors and holds them accountable for their activities. They may not process the personal data provided to them for any purpose other than the work assigned to them, and they must follow all instructions and guidance given by the Medical Centre.

The Medical Centre takes the necessary measures to ensure that its processors strictly comply with data protection legislation and the instructions given, and that they have adopted appropriate technical and organisational measures to protect personal data.

Processors acting on behalf of the Medical Centre may include:

• PR service providers;
• Courier service providers;
• IT and telecommunications providers, including database storage, messaging, and equipment, software and hardware maintenance;
• Operators managing, storing and destroying archives;
• Law firms;
• Credit institutions and companies registered under the Payment Services and Payment Systems Act;

Section 8 explains when personal data may need to be provided to public authorities.

If the Medical Centre is transformed into another legal form under the applicable Commerce Act, your personal data may be transferred to the relevant legal successor.

The Medical Centre processes your personal data only within the Republic of Bulgaria, the European Union and the European Economic Area.

11. STORAGE OF PERSONAL DATA

The Medical Centre keeps your personal data for as long as necessary to achieve the purposes set out in this Privacy Policy or to meet legal requirements.

For recruitment procedures, documents containing applicants’ personal data are kept for 6 months from the final completion of the procedure. (Opinion of the Commission for Personal Data Protection, ref. No. NDMSPO-01-142/14.03.2019)

If there are pending court proceedings, or requests, complaints, objections and/or other documents have been received, or if you have exercised certain rights, we may be obliged and/or need to keep your personal data for longer.

Personal data processed by the Medical Centre is kept up to date and corrected where necessary.

The Medical Centre does not keep data that is not needed to achieve the purposes described in this Privacy Policy.

Personal data is destroyed according to a strictly defined procedure, including by technical means such as shredders where necessary, and a record of destruction is drawn up.

12. TECHNICAL AND ORGANISATIONAL MEASURES

Following an assessment of the appropriate level of security in view of the risks associated with processing, the Medical Centre has introduced appropriate technical and organisational measures that fully meet the requirements of applicable legislation.

These measures ensure that, by default, only personal data necessary for each specific purpose is processed. They guarantee:

• the confidentiality, integrity, availability and resilience of processing systems and services;
• the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident;
• regular testing, assessment and evaluation of the effectiveness of technical and organisational measures to ensure the security of processing;

The measures introduced cover the following aspects of protection: physical, personnel, documentary and information security. Encryption and pseudonymisation are used where applicable.

13. USERS’ RIGHTS

Under data protection legislation, you have a wide range of rights regarding the processing of personal data by the controller.

As noted above, you may contact us about an action in which we act not as controller but as processor of personal data. If so, our staff and/or data protection officer will inform you accordingly, including in writing in response to your request.

Please note that rights may be exercised by persons who can be identified by the Medical Centre. A request may be submitted in writing or electronically under the conditions of Article 37b of the Personal Data Protection Act, and must include the following details, including those listed in Article 37c of the same Act:

• name, personal identification number (EGN) or foreigner’s personal number, address;
• a description of the request;
• your preferred way of receiving information about the rights exercised;
• signature, date of submission and correspondence address;

If the request is submitted by an authorised representative, the power of attorney must be attached.

We undertake to act on a request within a reasonable period, no longer than 1 (one) month from the date of receipt.

If we do not act on your request, we will inform you without delay, and no later than 1 (one) month. In that case, the notice will state the reasons, as well as your right to lodge a complaint with the relevant supervisory authority and/or seek judicial remedy.

Exercising your rights is completely free of charge. We cannot refuse to act on a request or charge a fee unless the request is manifestly unfounded and/or repetitive.

14. RIGHT TO INFORMATION AND ACCESS

You have the right:

• to information about the processing of personal data by the Medical Centre, including the types of personal data processed, purposes, recipients, storage, protective measures and rights, including the right to complain. This is the information contained in this Privacy Policy;
• to receive confirmation of whether personal data relating to you is being processed, and to access that data and information about it;

15. RIGHT TO RECTIFICATION

If the personal data processed by the controller is inaccurate or out of date, you have the right to ask the controller to correct it.

16. RIGHT TO ERASURE

In certain cases you may ask the controller to erase personal data relating to you. The law sets out specific cases in which this is permitted:

• the personal data is no longer needed for the purposes for which it was processed;
• you have withdrawn your consent, where processing was based on consent and there is no other legal basis for it;
• you have objected to processing based on the Medical Centre’s legitimate interests and there are no overriding grounds for processing that take precedence over your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims;
• the personal data has been processed unlawfully by the controller;
• the personal data must be erased to comply with a legal obligation of the controller;

If the personal data is needed to comply with a legal obligation that requires processing and/or for the establishment, exercise or defence of legal claims, the right to erasure described in this section does not apply.

17. RIGHT TO RESTRICTION OF PROCESSING

You may ask the controller to restrict the processing of your personal data where:

• you contest the accuracy of the personal data;
• the processing is unlawful, but you do not want the data erased;
• the controller no longer needs the personal data, but you require it for the establishment, exercise or defence of legal claims;
• you have objected to processing based on the controller’s legitimate interests, pending verification;

18. RIGHT TO DATA PORTABILITY

Where you have provided personal data to the controller, you have the right to receive it in a structured, commonly used and machine-readable format, and the right to transfer that data to another controller. You may request a direct transfer where technically feasible.

This right applies in the following cases:

• where processing is based on your consent or on the performance of a contractual obligation of the controller;
• where processing is carried out by automated means.

19. RIGHT TO OBJECT

You have the right to object to processing based on legitimate interests, including processing for direct marketing purposes. In that case processing must stop unless compelling legitimate grounds are shown that override your interests, rights and freedoms. Processing may also continue for the establishment, exercise or defence of legal claims. If you object to processing for direct marketing purposes, processing for those purposes stops immediately.

20. RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) or with another supervisory authority within the European Union.

Address of the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd, Sofia.

Email: kzld@cpdp.bg.

Website: http://www.cpdp.bg.

21. UPDATES TO THIS POLICY

This Privacy Policy applies from 27.10.2025.

It may be amended due to changes in applicable legislation, on the initiative of the Medical Centre or competent authorities, or for other reasons.

To stay informed of the current version, please visit the “Privacy policy” section of nuviva.bg periodically.

‍