Privacy Policy

Who Are We?

National Bureau of Bulgarian Motor Insurers, UIC: 130764706,, headquarters and registered office: Sofia 1000, Sredets District, 2 Graf Ignatiev Street, fl. 2, represented by Orlin Tsenkov Penev – Chairperson of the Board of Directors, tel.: 029267070, e-mail: ins@nbbaz.bg and is a personal data controller in accordance with the provisions of the Personal Data Protection Act.

How to contact us?

Address: Sofia 1000, Sredets District, 2 Graf Ignatiev Street, fl. 2, 029267070, email: ins@nbbaz.bg

How to contact our Personal Data Protection Officer?

Name and surname: Mincho Shekerov
Address: Sofia 1000, Sredets District, 2 Graf Ignatiev Street, fl. 2;
Tel.: 02 926 7078
E-mail: mincho.shekerov@nbbaz.bg

The National Bureau of Bulgarian Motor Insurers is the owner and controller of the following website: http://www.nbbaz.bg

The National Bureau of Bulgarian Motor Insurers respects the privacy of your personal data.

The protection of your personal information throughout the entire process of personal data processing, as well the security of all business data, are important for us. We process your personal data confidentially and in accordance with the provisions of the national and European legislation.

What is the Privacy Policy?

The purpose of this Privacy Policy is to provide you comprehensive information in a clear and accessible language about what actions are taken with the personal data which you provide to the National Bureau of Bulgarian Motor Insurers (the “NBBMI”) including:

What personal data about you do we collect?
What is the purpose of this data gathering?
How long do we store the provided personal data?
Who do we share your personal data with?
How do you notify you for a change to our Privacy Policy?
What types of cookies do we use to make your stay on website better?
What are your rights in regards to the provided personal data?

With this Privacy Policy the NBBMI declares that it applies all technical and organisational measures for protection of the personal data of natural persons which are prescribed by law or regulation on a national or European level.

What are personal data?

Any information or data which can identify natural person, directly or indirectly.

For example, your mobile phone number is a case of indirect identification. Direct identification happens when your provide unique identifier like personal citizen identification number, foreign citizen personal identification number, customer code, etc.

What personal data does the NBBMI collect?

In order to provide you effective access to our services, the NBBMI collects the following information about you:

Name, surname, phone number, email, city, address and all other data provided when filling contact forms on our website;
Data about the occurred insured event – date, time and location of the traffic accident; participants in the traffic accident – registration number, make/model, chassis number, years in which the motor vehicles were manufactured; driving licence data; full name of the vehicle driver in case the driver is not the owner of the damaged motor vehicle; full name of the responsible driver; description of the property damage caused to the motor vehicle; data from the Traffic Accident Report/Bilateral Report of Findings; description of non-material damage and all other data listed in documents from official institutions, like expert opinions in the course of pre-trial investigation, photo evidence of the damage caused, etc.
Data about the economic identity of the injured parties - bank account - for transferring compensation for suffered property or non-material damage, as well as presented documents justifying expenses like involves for repairs to the motor vehicle, invoices for purchased medicines, for paid surgical interventions, etc.;
Data about the health condition of the injured party (so called sensitive personal data) - all sorts of medical documents, including urgent care certificate, card for examination by a physician, X-Ray scans, Medical Advisory Commission/Territorial Expert Medical Commission/National Expert Medical Commission decision, sick leave notes and all other documents contained in the Case History (CS) of the person involved in a traffic accident.
Documents certifying kinship in the event of filing claims for payment of compensation by the heirs of a deceased individual - participant in a traffic accident - heirs certificate, marriage certificate, birth certificate, etc., as well as data about third parties when the claim is lodged by them, for example lawyers;
Data about the persons representing the insurance companies within the framework of the membership relations.

On what grounds does the NBBMI process your personal data?

The processing of personal data includes collecting, storing, destroying, transferring, rectifying, updating, deleting and all other actions involving your personal data.

The NBBMI processes personal data in order to fulfil legal obligations as well as, if necessary, to protect the life and health of the natural person to whom the data refer to.

The NBBMI collects your personal data in order to fulfil its contractual obligations for contracts concluded with you - on the grounds of said contracts.

The NBBMI also collects personal data after received express, clear, free and unequivocal consent from you in regards to the purposes of the processing.

The consent for processing your personal data is given upon visiting us on the following address: Sofia 1000, Sredets District, 2 Graf Ignatiev Street, fl. 2 or by sending an email to the following address ins@nbbaz.bg.

The consent which you give can be withdrawn at any time by visiting us on the following address: Sofia 1000, Sredets District, 2 Graf Ignatiev Street, fl. 2, as well as by sending an email to the following address ins@nbbaz.bg.

The NBBMI can also process personal data when it has legal interest except when the interests of the natural person to whom the data refer to prevail.

For what purposes do we collect your personal data?

The personal data received from you shall be used for fulfilling our obligations to you as well as for the purpose of us being able to help you execute your rights, including but not limited to:

For providing the necessary assistance in case of a claim received from you for payment of compensation as a result of occurrence of an insured event.
For assistance in the case of payment of compensation in the cases specified in the Internal Regulations of the Council of Bureaux;
For payment of compensation in the cases specified in the Internal Regulations of the Council of Bureaux;
For executing the functions of a Compensation Body pursuant to the Insurance Code, the By-laws of the NBBMI and the international regulations concerning the third party liability insurance and the Green Card Certificate.
For conducting assistance with all national insurance bureaus members of the Council of Bureaux, compensation bodies and institutions tasked with paying guarantee payments as well as with the Guarantee Fund in the cases specified in the Insurance Code.
For exercising regression rights in regards to responsible drivers, insurers, national insurance bureaus on the territory of another EU member state, Guarantee Fund and other cases specified in the Insurance Code and in the Internal Regulations of the Council of Bureaux;
In order to provide you access to our website, including being able to answer queries sent to us through the contact form on our website.

In addition to the above we have legal interest to collect your personal data since without them we cannot provide you the necessary assistance which you are interested in.

How do we process your personal data?

In order to provide the necessary assistance the NBBMI processes (collects) the personal data provided by you concerning the physical, economical, social and family identity in the following ways:

by you filling applications, forms and declarations provided to you by NBBMI employees. The forms are provided and filled in our building, should you send an application for assistance by the NBBMI.
by a visit to our website;
in the event of updating date per your request and filling an update form - printed or electronic;
in the process of exercising the powers of the NBBMI as defined by the national and European legislation;

How long do we store and process your data before destroying them?

Depending on the grounds for processing your personal data, the period of their storage is different.

Your personal data are stored by us for a period of 5 years after the contractual grounds are no longer valid if we have processed the personal data for the purpose of fulfilling contractual obligations towards you. After the end of this period and provided there are no legal grounds for extending the storage of your personal data, the information about you is destroyed. When processing your personal data on legal grounds and in the event of arisen excess, we process your personal data for 5 more years after the expiry of the statutory 5-year period. The records about you are permanently deleted from our system and the printed dossiers containing your personal data are destroyed.

Whom can we transfer the personal data provided by you?

The NBBMI shall not provide your personal data to third parties without your express consent unless this is required for fulfilling undertaken contractual obligations towards you and/or for exercising powers/fulfilling obligations pursuant to the national or European legislation.

To fulfil undertaken obligations under contractual and/or pre-contractual relations with you or to execute legal powers, the NBBMI may disclose your personal data to the following parties:

Insurance companies;
External service providers who work on determining the amount of compensation and calculating the damage or provide services in the capacity as insurance expert commission as defined in the Insurance Code.
All member states, national insurance bureaus, compensation bodies, institutions, etc., participating in the Green Card system, as well as third parties.
Insurers - members of the NBBMI, the Guarantee Fund, national government bodies and other institutions.

Are there other cases in which we can disclose your personal data?

Your personal data are also given to third parties in the following cases:

Upon request by the natural person who has provided the data. subject of the protection of personal data;
Upon request by the competent authorities in accordance with the legislation of the Republic of Bulgaria and the European Union.

As a member of the Council of Bureaux and in view of assisting the other member states and their national insurance bureaus, the NBBMI has legal grounds for transferring personal data of natural persons within and outside the EU/EEA.

In all cases listed above, the parties to which we disclose your personal data have declared that they have ensured an adequate level of protection of your personal data, including foreign companies and organisations, positioned within the EU/EEA. In regards to companies and organisations positioned outside the EU and the EEA, in each specific case the respective organisation/company guarantees that it ensures an adequate level of protection of personal data in compliance with the requirements of the European legislation.

What are your rights in regards to the provided personal data?

In compliance with the Bulgarian and European legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR), you can exercise the following rights:

The right of access to the personal data about you which the NBBMI processes and to receive a copy of them;
The right to demand rectification from the NBBMI if you find inaccuracies or necessity of updating your personal data by sending an email to ins@nbbaz.bg;
The right to demand blocking of your personal data or restriction of the personal data processing in the cases specified by law and the Regulation;
The right to demand erasure, i.e. deletion of your personal data from ....., if the conditions for that are fulfilled.
The right to object against the processing of your personal data for the purposes of direct marketing by using the unsubscribe link which we have included in each email sent to us containing advertising information about our products;
The right to object against your personal data being disclosed to third parties when there is no legal grounds for that disclosure, by sending an email to ins@nbbaz.bg;
The right to withdraw, whenever you want, the consent given by you for your personal data to be processed for the purposes to which you have consented, by sending an email to: ins@nbbaz.bg;
The right to send a request for portability of your personal data in a structured, machine-readable format which is commonly used;
The right to send a petition or application for protection of your rights to a Commission for Personal Data Protection, if the prerequisites for that are met.

You can exercise all powers at any time during the period in which your personal data are processed.

What does each of the above listed rights mean?

Right of access to personal data.

This right allows the data subject to receive information as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
f) the right to lodge a complaint with the Commission for Personal Data Protection;
g) where the personal data are not collected from the data subject, any available information as to their source;
h) the existence of automated decision-making, including profiling.

Right to rectification and erasure ("right to be forgotten")

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing;
c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or member state law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society services.

Right to object

The data subject shall have the right to object to the processing their personal data, including in cases when the personal data are processed for the execution of a task in the public interest or in the exercise of an official authority vested in the controller or for reasons related to the legitimate interests pursued by the controller or by a third party,

The right to object also applies in cases of processing of personal data for direct marketing purposes and profiling.

Right to portability

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, where:

a) the processing is based on consent pursuant or on a contractual obligation; and
b) the processing is carried out by automated means.

Right of petition or application to a Commission for Personal Data Protection

The data subject shall have the right to notify the Commission for Personal Data Protection. If your rights have been violated, you have the right to appeal the actions and documents of the controller administratively or in court. The case cannot be brought to court if there is unfinished proceeding in the Commission for Personal Data Protection for the same violation or a decision of the Commission for Personal Data Protection is being appealed and the there is no in force decision of the court in connection to that.

Are you obliged to provide your personal data to us?

In view of us providing you the necessary assistance and entering contractual relations, we collect and process your personal data. We also process them in order to fulfil legal obligations.

Should you decide to refuse to voluntarily disclose the required personal data, the NBBMI shall not be able to provide the assistance which you are looking for, and accordingly to conclude a contract/continue to fulfil an already concluded contract.

Changes to the Privacy Policies

You can find up to date Privacy Policies on our website: http://www.nbbaz.bg/

That way you will have an opportunity to exercise your rights, listed specifically above. In addition to that, we will take all possible measures to notify you in the event of changes regarding the personal data protection by placing notices in the NBBMI building and on our website.

This Privacy Policy has been adopted by the NBBMI and is in force from 25/05/2018.