PRIVACY POLICY

Website Privacy Notice

This website is administered by Trenkwalder EOOD, having its registered address at 79 Hristo Botev Blvd., Sofia, Bulgaria (“we”, “us”, “our”, or the “Company”).

This Privacy Notice explains how we, in our capacity as a data controller, process your personal data in connection with your use of this website.

If you have applied for a job with us or are employed by us as an agency worker, the Privacy Notice for Candidates and Agency Workers shall also apply.

1. What Personal Data We Process

When you visit this website, we may collect the following information:

• the date and time of your visit to the website;

• your IP address;

• your browser type and version;

• the website (URL) visited before accessing this website;

• certain cookies and similar technologies (see Sections 2 and 3 below); and

• information that you voluntarily provide through the website.

You are not legally obliged to provide the personal data we request through this website. However, if you choose not to provide certain information, some functions or features of the website may not be available to you.

2. Cookies

This website uses cookies and similar technologies.

A cookie is a small file that may be stored on your device when you access a website. Cookies are generally used to provide additional website functionality, improve user experience, and ensure the proper functioning of online services.

Cookies cannot access, read, or modify other data stored on your device.

Most cookies are session cookies and are automatically deleted once you leave the website. Other cookies are persistent cookies and remain stored on your device until deleted by you or until their retention period expires.

You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of this website.

3. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google LLC, for the purpose of analysing website usage and improving website functionality, performance, and content.

Google Analytics uses cookies and similar technologies to collect information regarding how visitors interact with the website.

Analytics cookies are used only on the basis of your consent pursuant to Article 6(1)(a) of the General Data Protection Regulation (“GDPR”). You may withdraw your consent at any time through the cookie settings available on this website.

Where applicable, IP addresses are processed using IP anonymisation features.

Information collected through Google Analytics may be processed on servers located outside the European Economic Area (“EEA”), subject to appropriate safeguards for the protection of personal data.

3.1 Google reCAPTCHA

This website uses Google reCAPTCHA, a service provided by Google LLC, for the purpose of protecting the website against abuse, automated attacks, spam, and malicious activity.

When using reCAPTCHA, certain technical information may be processed, including:

• IP address;

• browser information;

• device information;

• date and time of access; and

• limited information regarding interaction with the website.

The processing of such data is based on our legitimate interest pursuant to Article 6(1)(f) GDPR, namely maintaining the security, integrity, and reliability of this website.

Google LLC processes data in connection with the provision of Google Analytics and Google reCAPTCHA services. Google’s role in relation to data processing (whether as an independent controller or processor) depends on the specific service, configuration, and applicable contractual arrangements.

Personal data may be transferred to the United States. Google LLC participates in the EU–US Data Privacy Framework, which provides an adequate level of protection for personal data.

4. Purposes of Processing

We process personal data for the following purposes:

• providing, operating, and improving the website;

• statistical and analytical purposes;

• preventing attacks, abuse, and unauthorised access;

• processing job applications, where applicable.

5. Legal Basis for Processing

Depending on the specific purpose of processing, we process personal data on one or more of the following legal bases:

• Article 6(1)(a) GDPR – where processing is based on your consent (for example, analytics cookies);

• Article 6(1)(f) GDPR – where processing is necessary for the purposes of our legitimate interests, including maintaining the security, functionality, and protection of the website; and

• Article 6(1)(b) GDPR – where processing is necessary in connection with a job application or steps taken prior to entering into a contract.

6. Disclosure of Personal Data

Where necessary for the purposes described above, we may disclose personal data to:

• IT service providers;

• companies within our corporate group, where consent has been obtained; and

• other service providers or recipients where required by law or necessary for the provision of website-related services.

Personal data may be processed outside the European Union or the European Economic Area subject to appropriate safeguards, including adequacy decisions or Standard Contractual Clauses approved by the European Commission.

7. Retention Periods

Data related to the use of this website, including technical logs and security-related records, is generally retained for up to three months unless a longer retention period is required for the establishment, exercise, or defence of legal claims, the investigation of incidents or misuse, or compliance with legal obligations.

If you apply for a position with us or are employed by us, the retention periods set out in the applicable Candidate and Agency Worker Privacy Notice shall apply.

8. Your Rights

In accordance with applicable data protection legislation and subject to legal conditions and limitations, you have the right to:

• obtain confirmation as to whether we process your personal data and request access to such data;

• request correction or completion of inaccurate or incomplete personal data;

• request deletion of personal data where legally applicable;

• request restriction of processing in certain circumstances;

• object to processing carried out on the basis of legitimate interests;

• withdraw consent at any time where processing is based on consent;

• request data portability, where applicable;

• obtain information about recipients of your personal data; and

• lodge a complaint with the competent supervisory authority.

In Bulgaria, the competent supervisory authority is the Commission for Personal Data Protection.

Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. Contact Details

If you have any questions, requests, or concerns regarding the processing of your personal data, please contact us:

Trenkwalder EOOD
79 Hristo Botev Blvd.
Sofia, Bulgaria
infobulgaria@trenkwalder.com

Last updated: 29 May 2026

PRIVACY NOTICE FOR CANDIDATES AND AGENCY WORKERS

This Privacy Notice explains how Trenkwalder EOOD, having its registered address at 79 Hristo Botev Blvd., Sofia, Bulgaria (“we”, “us”, “our”, the “Company”, or the “Employer”) processes your personal data in connection with your job application and/or employment relationship with us as an agency worker.

This Notice also explains your rights in relation to your personal data and how you may contact us regarding the exercise of those rights.

1. Purposes for Which We Process Personal Data

During the Recruitment and Application Process

In order to initiate and carry out the recruitment process, we may process the categories of personal data described in Appendix 1 for the following purposes:

• recruiting and selecting agency workers;

• maintaining communication with prospective agency workers through various channels, including the Company’s website, social media platforms, recruitment events, fairs, and other communication channels;

• administering and managing recruitment and application procedures;

• supporting prospective client companies in carrying out appropriate due diligence regarding candidates or agency workers to be assigned to them;

• assessing skills, qualifications, and professional suitability in order to identify the best match between candidates and client companies; and

• retaining candidate information for potential future employment opportunities where legally permitted or consent has been obtained, where required.

During the Employment Relationship

During your employment with us as an agency worker, we may process the categories of personal data described in Appendix 1 and Appendix 2 for the following purposes:

• human resources administration and workforce management;

• payroll administration, compensation, benefits administration, tax and social security compliance, and fulfilment of statutory reporting, disclosure, recordkeeping, and legal obligations;

• administration and management of agency worker assignments and communication with client companies and competent authorities;

• providing information to prospective client companies for due diligence and staffing purposes;

• compensation and benefits planning;

• remuneration management and employee benefit programmes;

• education, training, onboarding, and professional development;

• working time monitoring, attendance management, and scheduling;

• mobility and assignment management;

• performance assessment and performance management;

• workforce planning and evaluation of employee suitability for specific roles or assignments;

• budgeting, forecasting, and operational planning;

• skills management, career planning, and professional development; and

• objective-setting and personnel administration.

We collect personal data directly from you during the recruitment process and employment relationship, as well as from other lawful sources where relevant to our business operations and legal obligations.

The provision of personal data is voluntary. However, failure to provide certain information may delay, restrict, or prevent recruitment procedures, assignment opportunities, HR administration, internal or external communication, or the performance of legal and contractual obligations.

2. AI-Assisted Processing of Applications

In order to improve recruitment processes, we may use systems supported by artificial intelligence (“AI”).

AI systems are used solely to support the preliminary assessment of applications based on objective criteria, such as experience, qualifications, competencies, and skills.

Final decisions regarding candidates are not made solely through automated means. All assessments are subject to human review and final evaluation by authorised personnel.

No solely automated decision-making within the meaning of Article 22 GDPR is carried out.

Processing in this context may be based on:

• Article 6(1)(b) GDPR – where processing is necessary to take steps at your request prior to entering into a contract or in connection with recruitment;

• Article 6(1)(f) GDPR – where processing is necessary for the purposes of our legitimate interests in maintaining efficient recruitment procedures; and

• Article 6(1)(a) GDPR – where consent is required or otherwise obtained.

3. Categories of Processed Data and Legal Basis for Processing

We process the categories of personal data listed in Appendix 1 and Appendix 2 on one or more of the following legal bases:

• Article 6(1)(f) GDPR – where processing is necessary for the purposes of our legitimate interests, including conducting efficient recruitment processes, identifying suitable employment opportunities, managing human resources, and maintaining internal and external communications;

• Article 6(1)(c) GDPR – where processing is necessary for compliance with legal obligations applicable to us; and

• Article 9(2)(b) GDPR – where special categories of personal data are processed as necessary for carrying out obligations and exercising rights in the field of employment, labour law, social security, or social protection law.

Where required, we may separately request your consent for specific processing activities.

Personal data may also be shared with companies within our corporate group where your consent has been obtained and where legally required.

4. Disclosure of Personal Data

Where necessary for the purposes described above, we may disclose personal data to the following categories of recipients:

• IT service providers and technology vendors used by the Company;

• companies within our corporate group, where consent has been obtained where required;

• client companies to which agency workers are assigned or proposed for assignment;

• public authorities and regulators where disclosure is required by applicable law;

• labour, tax, commercial, or regulatory authorities;

• social security institutions and pension providers;

• insurance providers in connection with group or individual insurance arrangements;

• financial institutions and banks involved in payment processing;

• trade unions designated by employees, where requested;

• legal advisers, auditors, courts, enforcement bodies, or parties involved in legal proceedings; and

• other recipients where disclosure is necessary for legal compliance or the establishment, exercise, or defence of legal claims.

Some recipients listed above may be located outside the European Economic Area (“EEA”) or may process personal data outside the EEA.

Where personal data is transferred outside the EEA, we ensure that an adequate level of protection is maintained through appropriate safeguards, including adequacy decisions issued by the European Commission, Standard Contractual Clauses (“SCCs”), or other lawful transfer mechanisms under the GDPR.

Further information regarding applicable safeguards may be provided upon request.

5. Retention Periods

Your personal data will be retained only for as long as necessary to fulfil the purposes described in this Privacy Notice and to comply with applicable legal obligations.

In any event, we may retain personal data for the duration of statutory retention periods, legal limitation periods, or where necessary for the establishment, exercise, or defence of legal claims.

6. Your Rights

Subject to applicable legal conditions and restrictions, you have the right to:

• obtain confirmation as to whether your personal data is processed and request access to such data;

• request rectification, completion, or deletion of inaccurate or unlawfully processed personal data;

• request restriction of processing in certain circumstances;

• object to processing based on legitimate interests;

• withdraw consent at any time, where processing is based on consent;

• request data portability, where applicable;

• obtain information regarding recipients of personal data; and

• lodge a complaint with the competent supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

7. Contact Details

If you have questions, requests, or concerns regarding the processing of your personal data, please contact:

Trenkwalder EOOD
79 Hristo Botev Blvd.
Sofia, Bulgaria
infobulgaria@trenkwalder.com

Last updated: 29 May 2026

APPENDIX 1 – CANDIDATE DATA

General Data

We may process the following categories of personal data relating to candidates:

• full name and title;

• salutation;

• gender;

• address;

• telephone number, fax number, email address, and other contact details required for communication through modern communication technologies;

• date of birth;

• nationality/citizenship;

• photograph;

• marital status and number of children;

• military service, training service, or civil service (including start and end dates);

• preferred language;

• social media profiles;

• social media activities, where relevant to the recruitment process and permitted by law;

• information relating to work restrictions or limitations (for example, inability to lift heavy objects);

• work permit status;

• application documents (including CV/résumé, certificates, diplomas, references, licences, and similar documentation);

• information provided during interviews or recruitment discussions; and

• notes relating to meetings or interviews (for example, interview impressions or recruitment notes).

Education, Skills, and Qualifications

We may process the following categories of data relating to education, qualifications, and professional suitability:

• educational background, including degree, field of study, specialisation, and related qualifications;

• knowledge, competencies, and skills, including language skills;

• licences, permits, or professional authorisations required for certain activities;

• information relating to previous employment, occupations, and professional experience; and

• special qualifications or certifications (for example, trade licences or specialised training).

Employment Interests and Job Preferences

We may process personal data relating to employment preferences, including:

• professional interests and preferred areas of work;

• preferred type of employment relationship;

• expected salary or remuneration expectations;

• willingness to work overtime;

• mobility-related information;

• willingness to travel;

• information relating to the current employer (including company name and contact details, where relevant);

• current job title or position;

• career level; and

• information relating to prospective client companies or work placements.

Recruitment Process Data

We may process personal data generated or collected during the recruitment process, including:

• recruitment channels and selection measures;

• indicators relating to receipt of electronic communications concerning vacancies or employment opportunities;

• identification information provided during recruitment, where legally required;

• access credentials (such as username, role/function, and password where applicable);

• candidate status within the recruitment process;

• employee referral information;

• reasons for referral by employees or referrers;

• recruitment process information (including interview dates and recruitment stages);

• notice period relating to current employment;

• reasons for unsuccessful applications or unmet recruitment criteria;

• indicators of active job seeking;

• information relating to job postings (including date, location, description, position, level, remuneration, and related information);

• participation in recruitment events, fairs, or networking activities through which initial contact was established; and

• any additional information voluntarily provided by the candidate.

APPENDIX 2 – DATA COLLECTED DURING THE EMPLOYMENT RELATIONSHIP

General Data

During the employment relationship, we may process the following categories of personal data:

• employee identification number;

• previous names;

• place of birth;

• marital status;

• information relating to children and other family members in connection with benefits or services provided within the employment relationship (including name, date of birth, and social security number, where applicable);

• banking and payment information;

• cost centre information; and

• religion or religious affiliation, where declared by the employee and required for attendance management, legal obligations, or employment-related administration.

Employment Relationship Data

We may process personal data relating to the employment relationship, including:

• employment contract date;

• years of previous employment;

• termination date;

• notice period;

• type or reason for termination;

• legal requirements relating to employment;

• work permit information;

• employment category or employee classification (for example, worker/blue-collar employee, office employee/white-collar employee, specialist employee, trainee, or unskilled worker);

• security clearance level or access rights;

• validity period of identity documents;

• information required to comply with legal obligations concerning apprenticeships, traineeships, and vocational education, including apprenticeship agreements and related education records;

• periods of night work, hazardous work, or other legally regulated working conditions;

• performance target agreements and objectives;

• performance evaluations, competencies, and employee potential assessments;

• organisational assignment within the company, including start and end dates;

• type of work performed for client companies;

• project allocation and assignment information;

• organisational ranking or grading, where applicable;

• work location;

• expected or actual duration of employment;

• name and address of the client company;

• working hours and overtime performed for client companies;

• information necessary to comply with legal obligations relating to temporary agency employment;

• working time records (including secondary employment, overtime, flexible working time, shift work, night work, and part-time work);

• leave and absence management records;

• sick leave information, including occupational accidents and occupational diseases (including start date, end date, and duration);

• time of occurrence of workplace accidents;

• information relating to rehabilitation or medical treatment facilities where legally required;

• information necessary to comply with legal obligations relating to maternity protection, paternity leave, or parental leave;

• information relating to other absences caused by incapacity for work or leave arrangements;

• compensation or salary continuation information during employee absence;

• information required to comply with legal obligations concerning occupational health and safety, epidemic prevention, and employee wellbeing;

• degree of disability or reduced work capacity, where declared by the employee and legally relevant;

• notes from personnel meetings; and

• information voluntarily provided in connection with leave, absences, or employment administration.

Compensation and Payroll Data

We may process personal data relating to payroll, compensation, and benefits, including:

• salary classification or remuneration basis under applicable laws, collective bargaining agreements, employment agreements, or internal policies;

• gross and net remuneration data (including payroll statements);

• payroll deductions;

• non-cash employee benefits;

• reimbursement of expenses (for example transport or travel expenses);

• social security benefits connected to employment;

• information required to comply with legal obligations concerning salary limitations or deductions;

• trade union membership contribution information, where declared by the employee;

• employer-paid insurance contributions or employee benefits;

• advance payments and loan administration;

• wage garnishment information;

• payroll documentation;

• tax relief status for sole earners or single parents, where applicable;

• tax authority information;

• pension fund information (including contribution periods, contribution amounts, and mandatory insurance periods); and

• information relating to company vehicle use (including driving licence information, invoices, damages, and insurance records).

Training and Development Data

We may process information relating to educational and training activities carried out by the company or a client company, including online training and professional development measures.

Social Security and Statutory Reporting Data

We may process personal data relating to social security, statutory notifications, and legal reporting obligations, including:

• social security number;

• social security institution information;

• sick leave verification data;

• social security records;

• legally required notifications to social security authorities, including:

  • employee classification;

  • secondary employment information;

  • apprenticeship-related information, where applicable;

  • information relating to the type of work performed (for example night work, start and end periods);

  • remuneration type (monthly, hourly, or otherwise);

  • legally required information concerning illnesses, occupational accidents, and occupational diseases;

  • additional remuneration and insurance-related data required by law;

  • additional information that must be reported to social security authorities;

  • legally required sickness compensation information;

  • sick leave records;

  • reasons for absence from work and employment status (active/inactive), where applicable;

  • maternity and paternity leave information;

  • legally required information concerning employee termination benefits or compensation.