Privacy Policy

Last Updated 21 February 2022

KPMG is dedicated to protecting the confidentiality and privacy of information entrusted to us. We comply with the EU General Data Protection Regulation (GDPR) and the Bulgarian data protection law. Please read this Privacy Policy to learn about your rights, what information we collect, how we use and protect it.

KPMG IT Service OOD (KPMG IT Service), UIC 203572873, having registered seat and business address at: Republic of Bulgaria, 1404 Sofia, Triaditsa district, 45/А Bulgaria blv. (hereinafter referred to as “KPMG”), a Bulgarian limited liability company, a member firm of the KPMG global organization of independent member firms affiliated with KPMG International Limited, a private English company limited, duly represented by Kalin Georgiev Hadjidimov and Svetoslav Rumenov Spasov in their capacity as Managing Directors.

1. Who are we?

This Privacy Policy applies to KPMG IT Service as described above.

2. Who can you contact for privacy questions or concerns?

If you have questions or comments about this Privacy Policy or how we handle personal data, please direct your correspondence to: KPMG, 45/A Bulgaria Blvd., Sofia 1404, Bulgaria or email de-ppl-com@kpmg.com. We aim to respond within 30 days from the date we receive privacy-related communications. In any event, you always have the right to lodge a complaint with the Commission for Personal Data Protection to report concerns you may have about our data handling practices at

Postal address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592        

Telephone:      +359 (2) 91-53-518,

Email:              kzld@cpdp.bg

Internet:          www.cpdp.bg

The other EU member state regulator contacts may be found here

3. How do we collect personal data?

• Directly. We obtain personal data directly from individuals in a variety of ways, including obtaining personal data from individuals who provide us their business card, complete our online contact form, register for webinars, attend meetings or events we host, visit our offices, apply for open positions at our companies or provide reference for job applicants. We also obtain personal data directly when, for example, we perform our services under a contract. 
• Indirectly. We obtain personal data indirectly about individuals from a variety of sources, including recruitment services.  
  • Public sources – Personal data may be obtained from public registers (such as Commercial Register), news articles, sanctions lists, and Internet searches
  • Social and professional networking sites – If you have a social media profiles with provider facilitating professional communication, such as LinkedIn or on your current employer’s website, we may review it. We will not inspect any purely personal social media activities of yours.
  • Clients, suppliers, partners, sub-contractors – We may obtain personal data about representatives and contact persons of our clients, suppliers, partners, sub-contractors for the purposes of execution and performance of the relevant agreement.
  • Recruitment services – We may obtain personal data about candidates from an employment or temporary staffing agency, the individual who is referencing them for a position at KPMG IT Service and other parties including former employers and colleagues, and partner network agencies.

4. What categories of personal data do we collect?

We may obtain the following categories of personal data about individuals through direct interactions with us (i.e. if you choose to provide it — for example, to contact mailboxes or to register for certain event) or from information provided through clients, suppliers, partners, sub-contractors, and in other situations including those described in this Privacy Policy.

• Personal data. Here is a list of personal data we commonly collect to conduct our business activities.  
  • Contact details (e.g., name, company name, job title, work and mobile telephone numbers, work and personal email and postal address).
  • Professional details (e.g., job and career history, educational background and professional memberships, published articles). 
  • Personal data for the purposes of provision of our services (e.g., name, email, postal address).
  • Financial information (e.g. bank details).
  • CCTV at our sites may collect images of visitors. Our policy is to automatically overwrite CCTV footage within 30 days.
• Child data. Although we do not intentionally collect information from individuals under 14 years of age, we may occasionally receive details about children attending performances and other events we host with their parents or guardians. 

5. What lawful reasons do we have for processing personal data?

We may rely on the following lawful reasons when we collect and use personal data to operate our business and provide our products and services: 

• Contract – We may process personal data in order to perform our contractual obligations.
• Consent – We may rely on your freely given consent at the time you provided your personal data to us. 
• Legitimate interests – We may rely on legitimate interests based on our evaluation that the processing is fair, reasonable and balanced. These include:
  • Delivering services to our clients– To deliver the professional services our clients have engaged us to provide. 
    • Providing necessary information to a transferee, merger partner or seller and their advisers in connection with an actual or potential transfer or merger/acquisition of part or all of our business or assets, or any associated rights or interests
  • Offering information to individuals who visit our website or offering information about employment opportunities.
  • Customizing individual’s online experience and improve the performance usability and effectiveness of KPMG IT Service’s online presence. 
  • Meeting our corporate and social responsibility obligations.
  • Preventing criminal activity and to safeguard our IT systems. 
• Legal obligations and public interests – We may process personal data in order to meet regulatory obligations or mandates. 

6. Why do we need personal data?

We aspire to be transparent when we collect and use personal data and tell you why we need it, which typically includes:

• Providing our services exclusively to the KPMG member firms.
• Sending invitations and providing access to guests attending our events and webinars or our sponsored events.
• Personalizing online landing pages and communications we think would be of interest based on interactions with us and KPMG member firms.
• Administering, maintaining and ensuring the security of our information systems, applications and websites. 
• Authenticating registered users to certain areas of our sites.
• Seeking qualified candidates, and forwarding candidate career inquiries to our people team, which may be governed by different privacy terms and policies. 
• Processing online requests, including responding to communications from individuals or requests for proposals and quotations.
• Travel arrangement assistance.

7. Do we share personal data with third parties?

We may occasionally share personal data with certain recipients to help us deliver efficient and quality services. These recipients are contractually bound to safeguard the data we entrust to them. We may engage with several or all of the following categories of recipients:

• KPMG member firms, where necessary for administrative purposes or normal quality performance review and to provide professional services to our clients (e.g., when providing services involving advice from KPMG member firms in different territories).
• Parties that support us as we provide our services (e.g., providers of telecommunication systems, mailroom support, IT system support, archiving services, document production services and cloud-based software services). 
• Our professional advisers, including lawyers, tax advisors and auditors.
• A potential buyer, transferee, merger partner or seller and their advisers in connection with an actual or potential transfer or merger/acquisition of part or all of our business or assets, or any associated rights or interests. 
• Payment services providers.
• Courts, law enforcement or other government and regulatory agencies and bodies (e.g., NRA) or to other third parties as required by, and in accordance with, applicable law or regulation.
• Recruitment services providers.

8. Do we transfer your personal data outside the European Economic Area?

We store personal data on servers located in the European Economic Area (EEA). We may transfer personal data to KPMG International, KPMG member firms, and reputable third party organizations situated inside or outside the EEA when we have a business reason to engage these organizations. Each organization is required to safeguard personal data by means of contracts we have in place with those organizations outside the EEA, containing standard data protection clauses which are in a form approved by the European Commission.

9. Do we use cookies and other similar technologies (pixels, web beacons, etc.)?

Our websites uses cookies. Where cookies are used, a statement will be sent to your browser explaining the use of cookies. To learn more, please refer to our cookie policy.

Your data protection rights are highlighted here. To submit a data request please follow this link.

10. What are your data protection rights? 

• Access – You can ask us to verify whether we are processing personal data about you, and if so, to provide more specific information.
• Correction – You can ask us to correct our records if you believe they contain incorrect or incomplete information about you. 
• Erasure – You can ask us to erase (delete) your personal data after you withdraw your consent to processing or when we no longer need it for the purpose it was originally collected.
• Processing restrictions – You can ask us to temporarily restrict our processing of your personal data if you contest the accuracy of your personal data, prefer to restrict its use rather than having us erase it, or need us to preserve it for you to establish, exercise, or defend a legal claim. A temporary restriction may apply while verifying whether we
  have overriding legitimate grounds to process it. You can ask us to inform you before we lift that temporary processing restriction.
• Data portability – In some circumstances, where you have provided personal data to us, you can ask us to transmit that personal data (in a structured, commonly used, and machine-readable format) directly to another company if is technically feasible.
• Automated Individual Decision-making – In general, you may not be subject to a decision based solely on automated processing, including profiling, unless in specific cases stated in the law. Even in such cases, you can ask us to review any decisions made about you which we made solely based on automated processing, including profiling, that produced legal effects concerning you or similarly significantly affected you.
• Right to Object – You can object to our use of your personal data, when processing is performed on legitimate interest ground.
• Right to Withdraw Consent – You can withdraw your consent that you have previously given to one or more specified purposes to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. It may mean we are not able to provide certain products or services to you and we will advise you if this is the case. You may withdraw your consent at any time by contacting us at de-ppl-com@kpmg.com.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information or to exercise any of your other rights. This helps us to ensure that personal data is not disclosed to any person who has no right to receive it. No fee is required to make a request unless your request is clearly unfounded or excessive. Depending on the circumstances, we may be unable to comply with your request based on other lawful grounds.

11. What about personal data security?

We have put appropriate technical and organisational security policies and procedures in place to protect personal data from loss, misuse, alteration or destruction. We aim to ensure that access to your personal data is limited only to those who need to access it. Those individuals who have access to the data are required to maintain the confidentiality of such information. We may apply pseudonymisation, de-identification and anonymisation techniques in efforts to further protect personal data.

Please be aware that the transmission of data via the Internet is not completely secure. Whilst we do our best to try to protect the security of your personal data, we cannot ensure or guarantee the security of your data transmitted to our site; any transmission is at your own risk.

12. How long do we retain personal data?

We retain personal data to provide our services, receive services or goods from our suppliers and sub-contractors, stay in contact with you and to comply with applicable laws, regulations and obligations that we are subject to. We also make reasonable efforts to retain personal information only for so long i) as the information is necessary to comply with an individual’s request, ii) as necessary to comply with legal, regulatory, internal business or policy requirements, or iii) until that person asks that the information be deleted. The period for which data is retained will depend on the specific nature and circumstances under which the information was collected. We will dispose of personal data in a secure manner when we no longer need it.

13. Do we link to other websites?

Our websites may contain links to other sites, including sites maintained by other KPMG member firms that are not governed by this Privacy Policy. Please review the destination websites’ privacy policies before submitting personal data on those sites. Whilst we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content, security, or privacy practices employed by other sites.

14. Do we change this privacy policy?

We regularly review this Privacy Policy and will post any updates to it on this webpage. When we make changes to this Privacy Policy, we will revise the “updated” date at the top of this page. This Privacy Policy was last updated 1 November 2019.

Any changes to the processing of personal data as described in this Privacy Policy affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.

Information about Job Applicants

By submitting your CV and the supporting documentation thereto under this advertisement for a job at KPMG IT Service, you give us – KPMG IT Service your consent to process your personal data in the course of the current recruitment campaign. KPMG IT Service processes your personal data in the course of the current recruitment campaign for the following purposes:

• Assessment of your suitability for the disclosed position and whether your skills, motivation, education and experience suffice with the requirements set by KPMG IT Service;
• Receiving evidence for the qualities and qualifications, necessary for occupying the respective position;
• Establishing contact with you for setting up an interview;
• Extending a job offer if you are selected for employment

When you apply for a job at KPMG IT Service, we process the following categories of personal data:

• Identification data, such as your name, citizenship;
• Contact details, including email and phone number;
• Information about your education, skills and professional experience, including references from previous employers or colleagues of your which you presented;
• Information, gathered in the course of our interviews, such as interviewer’s notes; test results, etc.;
• Other information included in your application, which you deemed relevant and voluntarily provided within your CV or during interviews.

If you have a social media profiles with provider facilitating professional communication, such as LinkedIn or on your current employer’s website, we may review it. We will not inspect any purely personal social media activities of yours.

If you are a selected candidate for employment, KPMG IT Service will require additional personal details, as is necessary for the conclusion of an employment contract and you becoming a KPMG person.

The personal data you provided shall be processed for the purposes of the current recruitment campaign and will be deleted not later than 1 (one) month as of its completion, unless you are a selected applicant. If in the course of the current recruitment campaign you provided original or notarized copies of documents, these documents will be returned to you within the term stated above.

Any internally required documentation concerning you, which was created by KPMG IT Service in the course of the current recruitment campaign on the basis of the information and documents you provided, may be stored by KPMG IT Service for a period of 3 years as of the completion of the campaign in order to defend the legal rights and interests of KPMG IT Service in the course of any administrative or court proceedings as per applicable legislation in force.

KPMG IT Service, upon your request, may keep your personal data and use the in the course of subsequent recruitment campaigns to inform you of available positions and include you application in the selection process. Under this scenario, we will stored your personal data for a period of another 2 years as of the end of the current campaign. After that your personal data will be permanently deleted.

Granting your consent is necessary to complete the recruitment process of KPMG IT Service. You may refuse to grant your consent, but in this case KPMG IT Service will not be able to include your application in the recruitment procedures.

You may withdraw your consent at any time by sending us an email at de-ppl-com@kpmg.com or by post at: 1766, Mladost 4 r.a., Business park Sofia, building 15A, floor 3.

The withdrawal of consent does not affect the lawfulness of the processing completed prior to receiving the withdrawal.

Furthermore, the General Data Protection Regulation guarantees you a certain set of rights that you may exercise in relation to your personal data processed by us. In summary, you have the following data protection rights: to access, rectify, update or request deletion of your personal information or the restriction of their processing, as well as the right of data portability. You are also entitled to lodge a complaint with the Bulgarian Commission for Personal Data Protection. Please refer to the “What are your data protection rights?” section for further details.