How do we process personal data when working with suppliers

As one of the largest companies in Bulgaria, we realize that ethical attitude to our customers, employees and suppliers underlies our long-term success as a company. At Yettel we work towards the achievement of high standards of conduct in the business, good working conditions and internal rules for environmental protection. We expect the same approach from those we have business relations with, especially from our suppliers. We believe that with our actions and investments we contribute to the improvement of the quality of service, restriction of the unfair practices and protection of the principles of market economy.

Therefore, in the selection of suppliers we have to process personal data related to them (if they are individuals), their representatives and contact persons. We do that in order to make a research of the market for the products or services sought by Yettel, as well as to contact the potential suppliers and invite them to participate in a procedure for selection of a supplier or to negotiate with the directly.

If the invited suppliers decide to participate in the respective procedure or in negotiations with Yettel, we also process data relating to their employees in order to:
•decide whether the suppliers, incl. their subcontractors possess the qualifications, skills and expertise necessary for the proper delivery of the goods and/or services sought by Yettel and
•choose suppliers that meet Yettel’s requirements to the greatest extent possible, by evaluating of their offers (e.g. from a financial, technical or regulatory point of view)..

The conclusion of a valid and binding contract with a supplier is impossible without processing particular data thereof (if the supplier him/herself is an individual) or of his/her representative(s).

To be able to perform our obligations to the suppliers, respectively to be able to seek performance form them, it is necessary to process personal data for the suppliers (if they are individuals), for the representatives, the contact persons and the employees.

During the effective term of the contracts with suppliers it is possible, at the initiative of Yettel or the suppliers themselves to negotiate on their amendment or termination. In such cases, to be able to participate in such negotiations, including to enter into any additional agreements or terminate contracts, we have to process personal data for the suppliers (if individuals), for their representatives and/or contact persons.

Yettel's business operations are subject to control by various government and municipal authorities - Communications Regulation Commission (CRC), Consumer Protection Commission (CPC), Personal Data Protection Commission (PDPC), National Revenue Agency (NRA) and others. In the course of their control, the respective authorities have the power to conduct inspections, as well as to require Yettel to provide any documents and information that are in Yettel‘s possession. Documents and information requested in the course of such inspection may contain personal data of suppliers – individuals, their representatives, contact persons and/or employees.

The tax and accounting legislation in the Republic of Bulgaria requires Yettel to create and store, for a definite period of time, information, data and documents relevant to the tax and social security control.

In fulfillment of this obligation, the relevant information and documents, which also contain personal data of suppliers – individuals, their representatives and/or contact persons – are kept by Yettel for such time as stipulated in the relevant laws. Sometimes for a long time (for instance, the tax and social security documents should be kept for eleven years).

Sometimes, in order to exercise our rights or legal interests (for example to seek damages) we may have to process personal data of certain suppliers – individuals, their representatives and/or contact persons and/or employees in order to raise an out-of-court claim or bring a suit against:
•the suppliers or
•third parties from whom we have received and/or to whom we have disclosed personal data for the respective natural persons in accordance with this Policy.

Respectively, the suppliers, the abovementioned third parties and the natural persons themselves may raise an out-of-court claim or bring a suit against Yettel. In such cases we might have to process personal data in order to organize and hold our legal defence and thus to protect ourselves against illegal encroachments against our property and/or reputation.

The type and volume of the processed personal data depends on the nature of the raised out-of-court claims or initiated proceedings.