HRMS Privacy Policy
- About this Policy
HRM Solutions EAD (“we” or “us” or “our”) respects the privacy of our users (“user” or “you”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Shredy, our platform for management of digital employment records (the “Platform”). The Platform is accessible through our web-siteshredy.bg (the “Website”) and our mobile application Shredy (the “Application”) available on Google Play and on the App Store.
This Privacy Policy is issued on the grounds of Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).
Please note that in many instances we only act as data processors and process your personal data at the request, instructions and on behalf of your employer. In certain cases, we also act as data controllers in our own right, which means that we determine the purpose and means of processing of your data. The capacity in which act for each type of data processing is described below.
Please read this Privacy Policy carefully. WHILE YOUR ACCEPTANCE OF THIS PRIVACY POLICY IS NOT REQUIRED, IF YOU DO NOT FEEL COMFORTABLE WITH OUR USING YOUR PERSONAL DATA AS DESCRIBED HEREIN, PLEASE DO NOT ACCESS THE WEBSITE AND THE APPLICATION.
We reserve the right to make changes to this Privacy Policy at any time and for any reason. Any material changes in the Privacy Policy will be communicated to you through the Platform. You are encouraged to periodically review this Privacy Policy to stay informed of updates. We may require you to confirm an update to this Privacy Policy was communicated to you for you to continue using the Application. - About us
We are HRM Solutions EAD, a company incorporated and existing under the laws of the Republic of Bulgaria, having its registered address at Block 8, Balsha Str., Ivan Vazov Residential District, Sofia 1408, Bulgaria, regis-tered with the Bulgarian Commercial Register under Uniform Identification Number 206096810.
If you need to reach us, you can do so at our registered address mentioned above or by email at me@shredy.bg, or phone at +359 88 55 22 432. - How we process your information?
We may collect information about you both through our Website and our Application. There are several types of information that we process:
a. personal data related with your employment with your employer;
b. information that we process based on Application’s permissions or access to your mobile device;
c. information related with your use of our Website or our Application.
We process the personal data listed in sub-paragraphs a. and b. as a data processor at the request, instructions and on behalf of your employer. The purposes and means of processing of such data are determined by your employer. We process the personal data listed in sub-paragraph c. as a data controller. Details for each processing are provided in Sections 3.2 – 3.4 below.
None of the processing of personal data we make is intended or used by either us or your employer for automated decision-making, including profiling.
3.2. Processing of employment-related data
As the Platform’s main functionality is to keep and manage employee’s digital employment records, we process
through the Platform a variety of employment-related personal data, such as your name, personal number, employer, position, salary, leaves, email address, and such other information and documents that may be part of your employment record. The purposes and legal basis of processing of such data are determined by your employer and, therefore, should be communicated to you by your employer. Employers normally need to process such data in order to perform their obligations under their employment contracts with employees, to meet statutory legal requirements of labour, social security and tax legislation, as well as because they may have legitimate interests to process certain categories of data. Some of the data can also be processed based on your consent.
The employment-related data that we process can be provided either by your employer (e.g. because they entered the data in the Platform or because they uploaded or sent you a document through the Platform), or yourself (e.g. because your entered the data in the Platform or uploaded or sent a document to your employer through the Platform).
All employment-related data stored in the Platform is encrypted. While we store and handle the data (as described below) we do not access the data unless we are requested to do so by your employer.
3.3. Mobile device access
We may request access or permission to certain features from your mobile device, including your mobile device’s camera, storage, and other features in order to enable some of the functionalities of the Application. For example, we may request access to the device’s camera in order to enable scanning of documents (which you may want to send to your employer or upload to your employment record in the Platform) and reading of QR codes.
We also need access to the device’s storage in order to read from files you upload to the Platform or store files you may want to download from the Application.
If you wish to change our access or permissions, you may do so in your device’s settings. However, this may
impair or disable some of the functionalities of the Application.
3.4. Processing of usage data
When you use our Application, we collect and process certain data that we use in order to improve it as a product. Such data may include the number of users and sessions, session duration, device operating system, operating system version, device model, Application version, approximate geographical location, your gender and age, information about which screen of the Application is being opened and how often it is being opened.
All such data is collected by Application is through the analytics solutions that we use (Google Analytics for Firebase). The data that is collected is anonymous and is not associated with a particular user. We cannot and will not try to associate any piece of such information with you or any other user of the Application.
Our public website (shredy.bg) can collect analytics data only if analytics cookies are permitted by the website visitor (you). Our private website (the one that you may access only through your employer’s subscription for the Platform) only uses strictly necessary cookies (cookies without which the Platform cannot function). - How we use your data?
The use of your personal data depends on the type of the data.
Your employment-related data (Section 3.2) and mobile device access data (Section 3.3) are solely used for our performance of our contract with your employer. In particular, we:
a. store your personal data in your digital employment record (unless storage is handled by your em-ployer as per our contract with your employer);
b. use your name, personal number, email and/or phone number to handle the exchange and delivery of employment-related documents and information between you and your employer, including by providing such data, documents and other relevant information to the qualified trust service pro-vider used to handle the signing of documents through qualified or advanced electronic signature and the delivery of documents through electronic registered delivery service;
c. can access your data if requested by your employer in order to handle any Platform troubleshooting or system administration requests;
We process your usage data (Section 3.4) to analyse the usage of the Application by various metric, e.g. active and daily users, Application version usage, geographic, gender and age distribution of active users, intensity of use, use of Application features, etc. Based on such analyses we can plan Platform and or Application changes/upgrades, receive passive feedback on the use of existing and newly introduced features, etc. - Disclosure of your information and data transfers
We share information we have collected about you in certain situations. Your information may be disclosed as follows:
5.1. In connection with the performance of our obligation towards your employer
We process your data as a service provider which provides services to your employer (the use of the Platform). In order to perform our contract with your employer we share personal data that may be processed through the platform with:
a. your employer;
b. the qualified trust service provider used to handle the signing of documents through qualified or advanced electronic signature and the delivery of documents through electronic registered delivery service;
c. any service provider that we may use for the purpose of providing the Platform as a service, includ-ing, but not limited to, any cloud service provider (for the purpose of storage or use of other cloud services we may use as part of the Platform), our parent company which provides customer and technical support for the Platform, etc.
Our sharing of your information as described above is agreed to with your employer and made in accordance with our contract with your employer. None of your employment-related data (Section 3.2) is transferred to any service provider outside the European Union or the European Economic Area.
5.2. In connection with our use of analytics tools
While we do not purposefully disclose any Application usage data (Section 3.4) to any third party, our use of third-party analytic tools, such as Google Analytics, means that certain Application usage information is shared with the analytics provider (Google). - Do you have to provide your data to us?
Employment-related data (Section 3.2) is provided to us by your employer based on your consent to be ad-dressee of electronic communication relating to facts and circumstance related with your employment. If you do not want to use the Platform or want to discontinue your employer’s providing other personal data through the Platform, you can withdraw that consent at any time. You can also opt to using paper documents for your submissions to your employer, without withdrawing your consent for the use of the Platform.
Your providing of mobile device access data (Section 3.3) is neither a statutory, nor a contractual obligation. However, if you choose not to provide the required access/permissions, you may not be able to use the full functionality of the Application.
Your providing of Application usage data (Section 3.4) is neither a statutory, nor a contractual obligation. How-ever, if and to the extend analytics data is collected, our analytics solutions are set up in such a way, so as to only collect anonymous usage information without the need of any interaction from you. - Storing and deletion of your personal data
The storage of employment-related information in the Platform is determined by your employer. We will delete any such information if and when requested to do so by your employer, or when we choose to do so if permitted by our contract with your employer.
Information collected or stored on your device based on permissions or access you have granted will be stored until you delete the Application or any files downloaded from the Application. QR code images or information are never stored.
We will store usage data collected through cookies or other analytics tools for up to 2 months. After that period such data will either be deleted or removed from your device. We could continue to process such data for sta-tistical and research purposes indefinitely. - Your rights while processing your personal data
As a data subject you have certain rights with regard to your personal data that we process. While Sections 8.1 – 8.8 contain comprehensive description of data subject rights, these rights that you have with regard to us, are limited to the personal data and the processing that we do as a data controller (your Platform usage data – Section 3.4). While you have the same data subject rights with regard to your other personal data that we pro-cess, you can exercise those rights through your employer (which is the controller of such personal data). We cannot and will not act on data subject requests unless we are authorized to do so by the data controller of the relevant data (your employer).
You can exercise any of your rights (that you have with regard to us) by submitting a written request to us, in person, through an explicitly authorized proxy, or through such communication which enables us to verify your identity (e.g. through the use of qualified electronic signature). You can address any request or other communi-cation to our addresses listed in Section 2 above.
8.1. Right to access to your personal data
You have the right to be informed by us whether we process personal data relating to you and if so, to be granted access to such data, as well as to be informed about:
a. the categories of personal data concerned;
b. the purposes of processing;
c. the recipients or categories of recipients to whom the personal data have been or will be disclosed, more specifically the data recipients in third countries or international organizations;
d. where possible, the period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e. the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of your personal data or to object to such processing;
f. the right to lodge a complaint with a supervisory body;
g. where the personal data is not collected from you, any available information for its source;
h. the existence of automated decision-making, including profiling, as well as meaningful information about the logic involved, as well as the significance and the envisaged consequences of such pro-cessing for the data subject.
We will provide free-of-charge copy of your personal data undergoing processing, as well as the information, specified in the foregoing paragraph, within one month of the date of filing of your request. For any further copies requested by you, we may charge a reasonable fee based on the administrative costs incurred for such additional copy.
8.2. Right to rectification
If you consider that your personal data processed by us is inaccurate, you have the right to request from us to rectify without undue delay such inaccurate data. If your data are incomplete, you have the right to have incom-plete personal data completed, taking into account the purposes of processing.
8.3. Right to withhold consent
If we process your personal data based on your consent, you can withdraw your consent at any time. Following such withdrawal, we will cease the relevant processing, whereby the withdrawal of your consent will not affect the lawfulness of processing based on such consent prior to its withdrawal. Notwithstanding the above, we can continue processing the personal data concerned if another legal basis (other than consent) for the processing of such data or any of the exceptions under Section 8.5.2 is in place.
8.4. Right to object to processing
You have the right to object to the processing of your personal data if such processing is based on public interest or our legitimate interests if you consider that in your specific case such processing is incompatible with the protection of your interests, rights and freedoms. In such cases, if we cannot demonstrate compelling legitimate grounds for processing which override your interests, rights and freedoms or for processing that is needed for establishment, exercise and defence of legal claims, we will cease processing such data.
8.5. Right to erasure of personal data
8.5.1. General rule. You have the right to request form us the erasure of your personal data without undue delay and we have the obligation to erase such personal data without undue delay where one of the following grounds applies:
a. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b. you withdraw your consent on which the processing is based and there is no other legal ground for the processing;
c. you object to the processing pursuant to Section 8.4 and we do not have any legitimate grounds for such processing, overriding your interests, rights and freedoms;
d. your personal data have been processed unlawfully;
e. the personal data have to be erased in order for us to comply with a legal obligation.
8.5.2. Exceptions from the rule. We are not obliged to erase your data and, respectively, your request for eras-ure of your data can be disregarded, if the relevant processing is necessary for:
a. exercising the right of freedom of expression and information;
b. our compliance with a legal obligation which requires processing or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
c. reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) of the GDPR;
d. archiving purposes in the public interest, scientific or historical research purposes or statistical pur-poses in accordance with Article 89(1) of the GDPR in so far as the erasure of data is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
e. the establishment, exercise or defence of legal claims.
8.6. Right to restriction of processing
You have the right to obtain from us restriction of any other processing of your personal data, other than the storing of the data, in the cases listed below:
a. when you contest the accuracy of your personal data – for a period enabling us to verify the accuracy of your personal data;
b. when the processing is unlawful but you oppose the erasure of the personal data and request the restriction of their use instead;
c. when we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
d. when you have objected to processing pursuant to Section 8.4 pending our verification whether our legitimate grounds for processing override your interests.
In any of the listed cases we can process the personal data concerned, other than their storage, only based on your consent or for the establishment, exercise, defence of legal claims or for the protection of the rights of another natural person or for reasons of important public interest for the Republic of Bulgaria or for the Euro-pean Union.
8.7. Right to data portability
You have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit such data to another controller without hin-drance from us, where:
a. we process your data based on your consent or when the processing of such data is needed for the performance of any obligation under a contract we may have with you; and
b. the processing is carried out by automated means.
In exercising your right to data portability, you have the right to have the personal data transmitted directly from us to another controller, where technically feasible.
8.8. Right to lodge a complaint with the supervisory body
If you find that our processing of your personal data is in breach of any of the provisions of the applicable legis-lation, including but not limited, the GDPR and the Personal Data Protection Act, you have the right lodge a complaint with the supervisory body of the Member State of the European Union as per your habitual residence, place of work or place of the alleged infringement. The competent supervisory body in the Republic of Bulgaria is the Commission for Personal Data Protection.