Privacy Policy
Last updated:
Who processes your data
USS X Academy is a training centre for practical instruction in photovoltaic and wind systems and in electrical engineering. For questions about this policy, write to us at [email protected].
Still to be completed
Still to be completed: the legal entity acting as data controller, its unified identification code (EIK, "ЕИК"), registered seat and correspondence address, as well as a contact person for data protection matters, should one be appointed.
What data we collect
We collect only the data that you provide to us yourself, plus minimal technical records for security purposes.
- Account: email address, name and password. The password is stored only as an Argon2id hash - never in plain text - and it cannot be recovered, only changed.
- Training request: name, email, telephone and a free-text comment. When you sign up for a training course for two people, we also record the name, email and telephone of the second participant - make sure that they agree to your providing them to us.
- Career assistance: name, email, telephone, town, education, professional experience, skills, languages, certificates, a comment and the curriculum vitae (CV) file attached by you.
- Technical records: hashed IP address, request identifier and the time of the action. The full IP address is not stored.
We do not collect data concerning health, ethnic origin, political opinions or other special categories of personal data, and we ask you not to state such data in the free-text fields.
Why we process the data
- To process your training request and to contact you regarding confirmation, group and date.
- To maintain your account and your access to the learning materials and the online classroom.
- To forward your curriculum vitae to the employers you have selected yourself - only with your explicit consent.
- For the security of the platform: detecting abuse and maintaining traceability of actions with administrative effect.
- To comply with obligations imposed on us by law.
Still to be completed
Still to be completed: the lawful basis under Article 6 of the GDPR for each of the purposes above (consent, performance of a contract, legitimate interest or legal obligation).
Consent and document version
When you submit a request without a registered account, you give explicit consent to the processing of your personal data. We record which version of this document you accepted and when. If the text is changed later, your record remains linked to the version you actually saw - it is not overwritten.
Forwarding your curriculum vitae to employers
Career assistance operates only with your explicit consent and only in the direction you have chosen. The text you confirm reads: "I agree that the data and CV provided by me be sent to the selected employers for the purpose of applying for a job."
- You choose the categories of recipients: the electricity distribution companies (ERP, "ЕРП"), solar and photovoltaic companies, or both.
- We send your application; the hiring decision belongs entirely to the employer.
- The academy does not promise and does not guarantee employment, an interview or a reply.
- There is no public access to career applications - they are read only by academy staff who process them.
Still to be completed
Still to be completed: the list of recipient companies by name and the conditions under which the data is transferred to each of them.
Files and storage
Attached documents, including curricula vitae, are stored in our own storage and are not publicly accessible. Access to them is granted through links with a short validity period, which expire shortly after they are issued. The public images on the site are delivered through Cloudinary.
Security records
Actions with administrative effect and events related to security are written to a log that is only appended to - the records in it are neither modified nor deleted by the application. The log contains a hashed IP address, not the address itself.
Providers that process data on our behalf
The platform is hosted with Railway, and the public images are delivered through Cloudinary. We also send service emails in connection with your requests.
Where you have given consent to analytics and advertising cookies, data about the visit is also processed by Google Ireland Limited (Google Analytics 4 and Google Ads) and by Meta Platforms Ireland Limited (Facebook Pixel) - for the purpose of measuring audience numbers and the effectiveness of our advertising campaigns. Without such consent those tools are not loaded and receive no data about you.
Still to be completed
Still to be completed: the full list of the processors of personal data, the email service provider, the countries of storage and the data processing agreements concluded.
Retention periods
Still to be completed
Still to be determined and completed: the retention periods for training requests, career applications and curricula vitae, accounts without activity, and the records in the security log.
Your rights
As a data subject under the GDPR, you have the right to request:
- access to the data we hold about you;
- rectification of inaccurate or incomplete data;
- erasure of the data where there is no ground for us to keep it;
- restriction of processing;
- portability of the data you have provided to us;
- objection to processing based on legitimate interest;
- withdrawal of a consent already given, at any time - the withdrawal does not affect the lawfulness of the processing carried out before it.
To exercise any of these rights, write to [email protected]. If you believe that your rights have been infringed, you may lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни, КЗЛД).
Changes to this document
When a change is made, we publish the new version at this address and update the date above. Consents given under a previous version remain recorded against that version.