1. Controller and contact details
The personal data controller is ATN Defense EOOD, a single-member limited liability company, Unified Identification Code (UIC) 207788288, with its registered office and management address at: 5 Mitropolit Natanail Street, 3rd floor, Tsentralen District, Plovdiv 4002, Bulgaria, hereinafter referred to as “ATN Defense”, the “Company” or “we”.
For questions and requests concerning your personal data: office@atndefense.com; telephone: +359 876 508 310; correspondence address: 5 Mitropolit Natanail Street, 3rd floor, Tsentralen District, Plovdiv 4002, Bulgaria.
This policy describes the processing of personal data of website visitors, customers and prospective customers, end users, suppliers, partners and their representatives, as well as job applicants. Information on processing in connection with employment relationships is also provided through separate notices.
2. Principles and applicable rules
We process personal data lawfully, fairly and transparently, for specific purposes and only to the extent necessary. We keep the data accurate, limit retention periods and implement appropriate security measures.
We comply with Regulation (EU) 2016/679, the Bulgarian Personal Data Protection Act and other applicable legislation. Where a transaction is subject to controls, we also fulfil our obligations under the Bulgarian Act on Export Control of Defence-Related Products and Dual-Use Items and Technologies, its implementing regulations, Regulation (EU) 2021/821 and applicable sanctions and customs regimes.
3. Data and sources
Depending on our relationship with you, we process names, addresses, telephone numbers and email addresses; job titles, authority to act on behalf of others and powers of attorney; contractual, payment, delivery and warranty data; correspondence, enquiries and complaints. We collect identity document details only where there is a specific legal basis and a need to do so.
For controlled transactions, we may process data concerning the participants and their representatives, the end user, end use and destination, data contained in authorisations, declarations and certificates, and the results of sanctions and trade restriction checks. For recruitment, we process the information provided concerning education, qualifications and professional experience.
When the website is used, an IP address, device and browser information, technical logs and cookie information may be processed. The specific data depend on the functions used and your choices.
We obtain data directly from you, from your employer, principal or representative, from partners, public registers, official sanctions lists, competent authorities and compliance screening service providers, and through our website and information systems. Where data have not been obtained from you, we provide the information required by Article 14 of Regulation (EU) 2016/679 within the applicable time limits, unless a statutory exception applies.
We do not request special categories of personal data unless they are necessary and a legal basis under Article 9 of Regulation (EU) 2016/679 exists.
4. Purposes and legal bases
We use the following legal bases according to the specific purpose and our relationship with the individual:
| Purpose | Legal basis |
|---|---|
| Quotations, orders, contracts, deliveries, payments and warranty services. | Taking steps at your request prior to entering into a contract and performing a contract to which you are a party — Article 6(1)(b) of Regulation (EU) 2016/679. For representatives of legal entities — legitimate interests in business communications and relationship management, point (f). Where a statutory warranty or another specific legal obligation applies — point (c). |
| Accounting and tax reporting, customs and export controls, mandatory checks, registers and provision of information to authorities. | Compliance with applicable legal obligations — Article 6(1)(c) of Regulation (EU) 2016/679. Additional checks to prevent fraud and diversion of products — legitimate interests, point (f), following an assessment of necessity and individuals’ rights. |
| Handling enquiries and complaints, website and system security, prevention of misuse and defence of legal claims. | Legitimate interests — Article 6(1)(f) of Regulation (EU) 2016/679; performance of a contract or compliance with a legal obligation, where applicable. |
| Recruitment. | Pre-contractual steps at the applicant’s request — Article 6(1)(b) of Regulation (EU) 2016/679; applicable legal obligations — point (c). Retention for future recruitment beyond the statutory period — consent, point (a). |
| Marketing communications and non-essential analytics or advertising technologies. | Consent — Article 6(1)(a) of Regulation (EU) 2016/679, where required. Another basis for direct marketing is used only where the applicable rules for the relevant channel permit it. |
Where we rely on legitimate interests, we assess whether they are overridden by your interests, rights and freedoms. Consent is voluntary and may be withdrawn at any time, without affecting the lawfulness of prior processing.
5. Required and voluntary data
We specify which data are required by law, for entering into or performing a contract, and which are provided voluntarily. If the necessary data concerning the transaction, participants, end user or end use are missing, we may be unable or not legally permitted to accept an order, make a delivery or proceed with the transaction. Refusing marketing consent does not prevent a purchase or the provision of services.
6. Recipients of the data
We disclose data only where there is a legal basis and to the extent necessary to competent export control, customs, tax, sanctions and other government authorities; courts; banks, payment institutions and insurers; carriers and logistics operators; hosting, IT, cloud and communications service providers; compliance screening providers; lawyers, accountants and auditors. Data may also be disclosed to participants in an international transaction or affiliated companies where this is necessary and lawful.
Where a provider processes data on our behalf, the relationship is governed in accordance with Article 28 of Regulation (EU) 2016/679. Recipients that independently determine the purposes and means of processing act as separate controllers.
7. International transfers
Where data need to be transferred outside the European Economic Area, we comply with Chapter V of Regulation (EU) 2016/679. We use an applicable European Commission adequacy decision or appropriate safeguards, such as standard contractual clauses, accompanied, where necessary, by an assessment of the transfer and supplementary measures. The derogations under Article 49 of Regulation (EU) 2016/679 apply only where their specific conditions are met.
You may request information about a particular transfer and a copy of the applicable safeguards at office@atndefense.com, subject to the protection of confidential information and the rights of others.
8. Retention periods
We retain data according to the purpose, the applicable statutory periods and the need to defend legal claims:
- Documents and information concerning transactions covered by the retention obligation under export legislation — for at least 10 years. This period does not automatically apply to all visitor or customer data.
- Accounting and tax documents — for the statutory periods applicable to the relevant category; contractual and warranty documents — for the performance of the relationship and the applicable limitation periods.
- Enquiries and business correspondence — until the matter is concluded and for the period necessary to follow up on the relationship or defend claims; technical logs — for the period necessary for security and incident investigations.
- Data of unsuccessful job applicants — for up to 6 months after the recruitment process has been finally concluded, unless consent has been given for a specified longer period. Data of appointed individuals are processed under the rules governing the employment relationship.
- Marketing data processed on the basis of consent — until consent is withdrawn or the purpose no longer applies. Minimal data needed to demonstrate consent or respect an objection may be retained on a separate legal basis.
Once the basis for retention no longer applies, we erase, destroy or anonymise the data. In the event of an ongoing dispute, inspection or proceedings, we retain only the relevant data for the necessary period.
9. Your rights and requests
Subject to the conditions of Regulation (EU) 2016/679, you have the right to information and access, rectification, erasure, restriction of processing and data portability where applicable. You may withdraw your consent and object to processing based on legitimate interests on grounds relating to your particular situation.
You have the right to object at any time to processing for direct marketing, including related profiling. In that event, we cease processing for those purposes.
You may exercise your rights via office@atndefense.com or the correspondence address in Section 1. Where we have reasonable doubts concerning your identity, we may request only the additional data necessary to verify it.
We respond without undue delay, within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months; we inform you of the extension and the reasons for it within the initial one-month period. As a rule, requests are free of charge; a fee or refusal is permissible only in the circumstances provided for by Regulation (EU) 2016/679.
Erasure and other rights apply subject to their statutory conditions. For example, certain data cannot be erased while a retention obligation exists or where they are necessary for the establishment, exercise or defence of legal claims.
You may lodge a complaint with the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Boulevard, Sofia 1592, Bulgaria; www.cpdp.bg; kzld@cpdp.bg, or with the competent supervisory authority in the place of your habitual residence, place of work or place of the alleged infringement.
10. Automated decisions and security
We do not make decisions that produce legal effects concerning you or similarly significantly affect you solely on the basis of automated processing. Where sanctions screening tools are used, the final assessment concerning refusal, further screening or termination of a transaction is carried out by an authorised person.
We implement technical and organisational measures appropriate to the risk, including restricted access, protection of information systems, confidentiality and incident response procedures. In the event of a personal data breach, we notify the supervisory authority and affected individuals where required by law and within the prescribed time limits.
11. Cookies and website functions
The website may use cookies and similar technologies. Strictly necessary technologies are used to provide the service you have requested or to carry out electronic communications. Analytics, advertising and other non-essential technologies are activated following prior consent where required. Consent may be refused or withdrawn through the website’s cookie settings.
Information on the provider, purpose, duration and management of your choices is provided for the specific cookies used. Browser settings also allow cookies to be restricted or deleted, but this may affect certain functions.
If registration, comments or file uploads are enabled, we process the data necessary for the relevant function. When publishing content publicly, do not include unnecessary personal data or data concerning other individuals. Images may contain metadata, including location information.
Embedded content and external services may result in data being processed by third parties in accordance with their policies. Where consent is necessary, non-essential technologies associated with such content should be loaded after you have made your choice.
12. Updates
We update this policy when our activities, data processing or applicable rules change. The current version and its last updated date are published on the website. Where there is a material change, we provide an additional notice when necessary.
6. Protection of Website Forms (Google reCAPTCHA)
To protect our website and its visitors against spam and automated abuse, the Contact Us, Application and Request a Brochure forms and the Login window use Google reCAPTCHA, a service provided by Google.
When one of these forms is shown, your browser loads reCAPTCHA directly from Google, and Google receives:
- your IP address;
- hardware and software information about your browser and device (such as device and application data);
- cookies that Google may read or set for this check.
When you submit the form, our server sends Google the result of the check together with your IP address and receives only the answer whether the check was passed. We do not store this answer or any other reCAPTCHA data. Google processes the data under its own Privacy Policy (policies.google.com/privacy) and Terms of Service (policies.google.com/terms) and may process it outside the European Economic Area (EEA), including in the United States, under the safeguards described in Section 4.
We use reCAPTCHA on the basis of our legitimate interest in keeping our website secure and free of spam (Article 6(1)(f) GDPR). reCAPTCHA is loaded only on pages and windows that contain one of these forms. If you do not want Google to receive this data, please contact us by phone or at the address given in Section 5 instead of using the online forms.