Rights of data subjects

Yettel takes action at the request of an individual to exercise a right under this section only if Yettel is able to identify the person concerned.

Only individuals who can be identified by Yettel may exercise their rights under this section. If the purposes for which Yettel processes personal data do not require or no longer require the identification of an individual, Yettel has no obligation to keep, obtain or process additional information in order to identify the person for the sole purpose of acting upon a request of that person.

Yettel notifies individuals of the actions taken within one month of receiving a request under this section and in specific cases this period may be extended by another two months.

Yettel provides information to individuals on the actions taken in relation to their requests for the exercise of rights under this section without undue delay and in any event within one month of receipt of the request. If necessary, this period may be extended by another two months, taking into account the complexity and number of requests. Yettel informs the person concerned of any such extension within one month of receipt of the request, indicating also the reasons for any delay.

In case a request is refused, Yettel will notify the individuals concerned of their rights.

If Yettel does not take action on the request of an individual, Yettel will notify the individual without delay and within one month at the latest of receipt of the request regarding the reasons for not taking action, as well as regarding the possibility of filing a complaint to the Commission for Personal Data Protection.

In specific cases, Yettel may request additional information to verify the identity of individuals.

In case Yettel has reasonable concerns about the identity of the individual that has filed a request under this section, Yettel may request the provision of additional information necessary to confirm the identity of the individual.

The actions taken by Yettel in connection with and due to requests for exercising rights will be completely free of charge to the individuals unless their claims are clearly ungrounded or excessive.

The actions that Yettel takes for and in the exercise of user rights are completely free of charge. Where a person’s request is clearly unfounded or excessive (e.g. because of its repetitive nature), Yettel may, at its sole discretion: (a) refuse to comply with the request; or (b) request payment of a reasonable fee, determined on the basis of the administrative costs necessary to provide the requested information or to take the requested action.

Users have the right to receive information from Yettel whether personal data relating to them are processed. If so, users have the right to access the relevant data.

Users have the right to request Yettel to delete personal data relating to them in the following cases:
•the personal data are no longer needed for the purposes for which they were collected or processed;
•the user has withdrawn their consent on the basis of which the processing of personal data takes place and there is no other legal basis for the processing of the personal data;
•the user has objected to the processing of personal data which is based on Yettel’s legitimate interest unless there are other legitimate grounds for processing which take precedence over the interests, rights and freedoms of the user, or the processing of data is necessary for the establishment, exercise or the defense of legal claims;
•the user has objected to the processing of personal data for the purposes of direct marketing and there are no other legitimate grounds for the processing of the data;
•the personal data relating to the respective user were processed unlawfully;
•the personal data must be deleted by Yettel in order to comply with a legal obligation arising from the law of the Republic of Bulgaria or the law of the European Union.

Users may request Yettel to restrict the processing of personal data relating to them in the following cases:
•the accuracy of personal data is challenged by the user for a period allowing Yettel to verify the accuracy of the personal data;
•the processing is unlawful, but the user does not want the personal data to be deleted, but instead requires restriction on their use;
•Yettel does not need the personal data for processing purposes any longer but the user requires them in order to establish, exercise or defend legal claims;
•the user has objected to the processing of personal data based on Yettel’s legitimate interest pending verification whether Yettel’s legitimate grounds have priority over Yettel’s interests.

Users have the right to receive from Yettel the personal data they provided in a structured, widely used and machine-readable format and to transfer those data to another administrator without hindrance by Yettel, insofar as:
•Yettel processes those data for the purpose of entering into or executing a contract with the user or on the basis of the user’s consent; and
•the processing of the relevant data is carried out by automated means.
Users have the right to ask Yettel to transfer their personal data directly to another administrator when technically feasible.

Users have the right, at any time and on grounds relating to their particular situation, to object to the processing of personal data relating to them when Yettel processes their data in order to protect their legitimate interests.

Users have the right to file complaints or alerts to the Commission for Personal Data Protection (CPDP) in case they believe that Yettel violates personal data protection legislation. Instructions for filing complaints are published on the CPDP website: https://www.cpdp.bg

Users may also file complaints with other supervisory authorities on the territory of the European Union as provided for in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.