Privacy policy

Privacy policy and protection of personal data

This document has been prepared in accordance with the requirements of the General Data Protection Regulation (GDPR, Regulation 2016/679) and provides the clients of "ELANA Fund Management" AD with information on the processing of personal data.

1. Information about the Personal Data Administrator

1. "ELANA Fund Management" JSC operates as an asset management company based on Decision No. 120-UD dated 31.07.2002 and License No. 57-UD/07.07.2017, issued by the Financial Supervision Commission. The company's registered office and management address are: Sofia, Sredets district, Kuzman Shapkarev St. No. 4, registered in the Commercial Register of the Registration Agency, EIC: 130963811, and correspondence address is: Sofia 1797 , str. "Lachezar Stanchev" No. 5, Sopharma Business Towers, Tower B.

2. Contact information regarding the protection of personal data

"ELANA Fund Management" JSC
5 Lachezar Stanchev St., Sopharma Business Towers, Tower B, 12th floor, Sofia 1797 
e-mail: privacy@elana.net
Contact person: Georgi Malinov
Contact phone: 02/ 8100014

3. How and why do we process your personal data

We process your personal data in the context of the services we offer and in order to establish and fulfill contractual relations with customers, process and fulfill orders, fulfill legal obligations, protect our legal rights and interests.

We process personal data in compliance with the following general principles: lawfulness; fairness and transparency; relevance of the processing to the purposes; accuracy and timeliness; data minimization; storage limitation; accountability; integrity and confidentiality; consent of the users to the processing of the data, when the purpose of the processing requires it.

Processing of personal data based on legal requirements

We process your personal data in order to fulfill our obligations under the requirements of both national and European legislation. The following Bulgarian legal acts are applicable to our activity (the list is not exhaustive): Markets in Financial Instruments Act (MFIA), Measures Against Money Laundering (MMLA), Measures Against the Financing of Terrorism Act (MFTA), Tax and Social Insurance Procedure Code (TSIPC), Financial Supervision Commission Act (FSCA), Collective Investment Schemes and Other Undertakings for Collective Investment Act (CISOUCIA). A list of some of our obligations includes, for example: obligations related to customer identification, implementation of Know-Your-Client (KYC) policies, evaluation of the service offered (suitable and appropriate service), provision of information to regulatory authorities and third parties.

Processing of personal data for the performance of a contract or in the context of pre-contractual relations

We process your personal data in order to be able to lawfully provide you with our products and services, as well as to fulfill our contractual obligations with you. We may also process personal data in the pre-contractual phase. The processing of personal data in these cases is related to: establishing the identity of the client, providing statutory pre-negotiated information and a draft contract, determining the essential elements of the contract, executing contracts, preparing and sending notifications and reports upon the execution of the contract, processing of complaints, requests and applications, etc.

Processing of personal data in view of legitimate interest

We process your personal data and in view of our legitimate interest, analyzing the data to improve the services we offer, including for internal purposes such as audits, analyzes and surveys; in order to improve our business or to monitor and analyze trends and the use of the services offered from us; as well as for invitations to events, greeting addresses, cards, raffle campaigns and games organized by us. This processing is permissible when it does not affect the fundamental rights and freedoms of data subjects. Our legitimate interest includes, for example, the provision of additional information about products and services that you already use. We strive for informational materials to always be objective, correct, precise, clear, unambiguous and not misleading. We believe that in this way we enrich your financial culture and provide you with up-to-date market information, so that you can always make informed investment decisions. You are given the opportunity to object to receiving these materials at any time and we will always comply with your request. The channel for distribution of these informational materials is e-mail, the frequency and content of the materials are structured in view of the different types of investment services and products that the company offers.

Processing of personal data after your consent

In some cases, we process personal data after your explicit consent. Consent must be freely expressed, specific, informed and unambiguous, given by statement or clear affirmative action. Consent can be withdrawn at any time without affecting the established legal relationship.

Processing of anonymized data

We may process personal data when performing analyzes for statistical or regulatory purposes, in which cases the results are aggregated and the data is anonymous.

We do not process your personal data for the purposes of automated individual decision-making, including profiling.

What kinds of personal data do we collect

To fulfill the above-mentioned purposes, we process various categories of personal data, such as data related to: physical identity (names, social security number, address, telephone numbers, place of residence, passport data, citizenship, etc.); economic identity (property status, financial status, participation and/or ownership of shares or securities of companies, bank account, etc.); work activity (professional experience and knowledge with regard to the investment products and services offered by us, etc.).

In some cases, we may process your data regardless of the fact that you are not our customer in a personal capacity, e.g. if you are a beneficial owner or member of a management/supervisory body of our client. In these cases, your personal data is processed in compliance with the principles set out in this policy.

When you visit our website, information about your activity may be collected, for example, browser identifier, history of pages visited to establish preferences for a certain type of content, history of searches made on the page, tracking of visited sections of the site, downtime on the site, by using a technology known as "cookies", which can often be controlled through internet browsers. For detailed information about the cookies we use and the purposes for which we use them, see our Cookie Policy.

We collect information about your Internet browser or otherwise Internet Protocol (IP) settings and other relevant information that helps us identify your geographic location when providing our Services.

When and why do we share personal data

We do not disclose your personal data, but we may provide it to:

  • courts and other regulatory and competent authorities – in accordance with or as prescribed by the law. These are, for example, the Financial Supervision Commission, the Personal Data Protection Commission, the National Revenue Agency, the Consumer Protection Commission, etc.;
  • third parties in connection with the performance of our contractual obligations, for example "Bulgarian Stock Exchange " AD , "Central Depository" AD, "Bulgarian National Bank", counterparties - financial institutions;
  • providers of services necessary for the implementation of our activity, incl. legal advisors, accountants, auditors, technical specialists, information service providers, services related to customer service, analysis and research of customer interest, conducting customer surveys;
  • ELANA group companies, partners and financial service providers;
  • any person whom you may authorize, or who may be authorized under the terms of our contract.

We require any organization to which we disclose your information, or which may receive it on our behalf, to ensure its confidentiality and process it in accordance with the Personal Data Protection Act and the General Data Protection Regulation.

"ELANA Fund Management" JSC does not transfer personal data to a third country or to an international organization outside the European Union.

In addition to the above, we could also disclose your personal data to persons authorized by you to represent you in establishing and managing legal relations with us. In addition to your proxies, this could also be your broker (investment intermediary) or your credit institution.

How long do we store your personal data

The period for which we store your personal data depends on the statutory regulatory periods applicable to our activity. We retain personal data for at least five years after the termination of the legal relationship, or for a longer period provided for in accordance with applicable law, for example obligations under the Accounting Act to store and process accounting data (for 10 years). The term of data storage also depends on the fulfillment of obligations to provide information to the court, competent state authorities, etc. as required by terms of the current legislation. Personal data is not destroyed if it is necessary for pending judicial, administrative or complaint proceedings.

Your rights under the General Regulations

According to the General Regulation, you have the following rights in relation to the processing of your personal data:

Right to information:

You have the right to request:

  • information about whether data concerning you is processed, as well as details about the purposes of this processing, about the categories of data and about the recipients or categories of recipients to whom the data is disclosed;
  • a message in an understandable form containing the personal data that is being processed, as well as any available information about its source;
  • information about the logic of any automated processing of personal data concerning you, at least in the case of automated decisions.

Right to rectification:

In the event of incomplete or incorrect/erroneous data, you have the right, at any time, to request:

  • to delete, correct or block your personal data, the processing of which does not meet the requirements of the law;
  • to notify the third parties to whom his personal data has been disclosed of any deletion, correction or blocking, except in cases where this is impossible or involves excessive efforts.

Right to object:

At any time you have the right to:

  • objections to the processing of your personal data if there is a legal basis for this; when the objection is justified, the personal data of the individual concerned can no longer be processed;
  • objections to the processing of your personal data for direct marketing purposes.

Right to restriction of processing:

You can request the restriction of personal data being processed if:

  • you dispute the accuracy of the data, for the period in which we have to verify its accuracy; or
  • the processing of the data is without legal basis, but instead of deleting them, you want their limited processing; or
  • we no longer need this data (for the specified purpose), but you need it for the establishment, exercise or defense of legal claims; or
  • you have filed an objection to the processing of the data, pending verification of whether the controller's grounds are lawful.

You should keep in mind that the deletion of personal data or the restriction of processing is only possible after the expiration of the statutory periods for their storage.

Right to data portability:

You can ask us to provide the personal data you have entrusted to our care in an organized, orderly, structured, generally accepted electronic format if:

  • we process the data according to the contract and based on the declaration of consent which can be withdrawn or on a contractual obligation, and
  • processing is done automatically.

This right only affects personal data processed with your consent or for the performance of a contract, and the processing is carried out by automated means. When exercising this right, you may not receive all the information you have when exercising the right to information. The right of portability is limited to the extent that it is technically feasible, i.e. we may not be able to retrieve personal data that we have received and we are not responsible for its accuracy.

Right of appeal:

In case you believe that we are violating the applicable regulations, please contact us to clarify the matter at the indicated coordinates:

"ELANA Fund Management" JSC
5 Lachezar Stanchev St., Sopharma Business Towers, Tower B, 12th floor, Sofia 1
e-mail: privacy@elana.net
Contact person: Georgi Malinov
Contact phone: 02/ 8100014

You have the right to submit a complaint to the Commission for the Protection of Personal Data at the following coordinates:

e-mail: kzld@cpdp.bg
Website: www.cpdpc.bg
Address: "Prof. Tsvetan Lazarov" No. 2
Sofia 1592

Requests for access to information or for correction are submitted in person or by a person expressly authorized by you, through a notarized power of attorney. An application can also be submitted electronically, in accordance with the Electronic Document and Electronic Trust Services Act.

We provide feedback on your request within 14 days of its submission. If a longer period is objectively necessary - in order to collect all the requested data and this seriously complicates our activity, this period can be extended up to 30 days. With our decision, we grant or deny access and/or the information requested by the requester, but we always give reasons for our response.

Provision of personal data

The provision of your personal data is a legally established requirement according to the national and European legislation applicable to our activity. Refusal to provide personal data is grounds for us to refuse to provide or to be unable to continue to provide you with a product or service.

Policy relevance

In order to implement the most up-to-date protection measures and in order to comply with the current legislation, we may update this Personal Data Protection Policy. We invite you to regularly review the current version of this Privacy Policy to stay informed about how we protect the personal data we collect. The document will always be published on the company's website, in the specially designated section for this.