Privacy and Personal Data Protection Policy

1. Who is the data controller?

Horizons Bulgaria Ltd (Хорайзънс България ЕООД), registered with the Bulgarian Registry Agency under UIC 175011353 and VAT No. BG175011353, is the controller of personal data processed for the activities described in this Policy.

2. When does this Policy apply?

This Policy applies when you:

• visit or interact with horizons.bg and its language versions;
• apply for a job, submit a CV or communicate with our recruitment consultants;
• represent an employer or request recruitment, Employer of Record, HR, salary, consulting or related services;
• use free or paid tools within The Ultimum HR, including CV, job description, job advertisement, salary benchmark, chat and related document tools;
• make a payment, request an invoice, download a document or use a private sharing link;
• contact us by form, email, telephone, chat, social network or another communication channel.

Where a specific tool requires additional information, a short privacy notice may be displayed at the point of collection. That notice supplements this Policy.

3. Personal data, purposes, legal bases and retention

We process only data reasonably necessary for the relevant purpose. The exact information depends on your relationship with Horizons Bulgaria and the service you select.

Required and optional data: mandatory fields are marked in the relevant form. If data necessary for a contract, payment, invoice or requested service is not provided, we may be unable to complete that request. Optional profile information can be left blank.

4. The Ultimum HR, AI-assisted tools and digital documents

Uploaded and generated content

Depending on the tool, you may provide a CV, job title, job description, professional history, education, skills, photograph, company information, logo, document text, salary criteria or chat content. We process that content to perform the function you requested, create an editable result, prepare a preview, complete a paid document and provide download or sharing access.

OpenAI API

Enabled functions may use the OpenAI API for tasks such as CV extraction, translation, drafting, text improvement and technology-assisted research. The instructions and content necessary for the requested operation may be sent to OpenAI. We do not publish our API key and do not use the consumer ChatGPT account of the visitor.

AI-generated or AI-assisted results may contain inaccuracies or unsuitable wording. They must be reviewed by a person before being used. Horizons Bulgaria does not use The Ultimum HR to make solely automated final decisions that produce legal or similarly significant effects, such as a final hiring or rejection decision.

Salary benchmark reports

Salary benchmark reports are Horizons Bulgaria research assisted by technology and current public sources. Results, tax assumptions, estimated net pay and employer cost remain indicative and should be confirmed by a qualified local payroll, tax or legal adviser before a binding decision is made.

Private links and browser storage

Where a tool offers a private sharing link, the link remains active only for the period stated in that tool, normally up to 30 days, and must be kept confidential by the user. Some unfinished drafts and remembered billing details may be stored locally in your browser on the device you use. You can remove them through the tool, browser storage controls or by clearing site data.

Windows video application

Where Ultimum Video Refresh is offered, camera processing is intended to take place on the user’s device. The application requires camera permission and may install or use a virtual-camera component. Separate application notices, licence terms and system requirements apply to the Windows installer.

5. Payments, VAT validation and service providers

6. Who may receive personal data?

Where necessary and supported by a legal basis, data may be disclosed to:

• employer clients, where a candidate is considered for a suitable opportunity and disclosure is appropriate for the recruitment process;
• candidates and authorised client representatives involved in the relevant recruitment or HR service;
• IT, cloud, hosting, email, security, payment, accounting and professional advisers acting as processors or independent controllers under applicable terms;
• OpenAI for the enabled AI-assisted operation requested by the user;
• Revolut for payment processing and payment-related compliance;
• competent authorities, courts, regulators and the Employment Agency where disclosure is required or permitted by law;
• a prospective purchaser or successor in a legitimate corporate transaction, subject to appropriate confidentiality and legal safeguards.

Horizons Bulgaria does not sell personal data.

7. International transfers

Some technology providers may process data outside Bulgaria or the European Economic Area. Where the receiving country is not recognised as providing an adequate level of protection, we use an applicable transfer mechanism, such as the European Commission’s Standard Contractual Clauses, together with additional safeguards where required.

Information about a relevant transfer mechanism can be requested at privacy@horizons.bg, subject to the protection of confidential and security information.

8. Retention and deletion

We do not keep personal data indefinitely. The applicable period is determined by:

• the duration of the requested service, recruitment project or client relationship;
• the validity period communicated for a private link or digital result;
• whether the person has validly agreed to future recruitment contact;
• statutory accounting, tax, employment-intermediation and record-keeping obligations;
• security needs and applicable limitation periods for legal claims;
• a valid request for deletion, withdrawal of consent or objection.

At the end of the relevant period, data is deleted, securely destroyed or irreversibly anonymised unless a further legal basis requires its retention.

9. Security

We use organisational and technical measures appropriate to the nature and risk of the processing, including access controls, role-based administration, confidentiality obligations, secure connections, protected API credentials, backups, logging, software maintenance and incident-management procedures.

No internet or storage system can be guaranteed to be completely secure. Please use private sharing links carefully, do not place confidential data in unnecessary free-text fields and notify us promptly if you suspect unauthorised access.

10. Your data protection rights

Subject to the conditions and exceptions in applicable law, you may request:

To exercise a right, email privacy@horizons.bg. We may request proportionate information to verify identity and protect data from unauthorised disclosure. We normally respond within one month, subject to lawful extensions for complex or multiple requests.

11. Questions and complaints

Questions, requests and complaints concerning Horizons Bulgaria’s processing should be sent to:

• Email: privacy@horizons.bg
• Post: Horizons Bulgaria Ltd, 63 Tsanko Tserkovski Str., 1421 Sofia, Bulgaria
• Telephone: +359 879 364 417

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, or with another competent supervisory authority where applicable.

12. Children’s data

Our recruitment and HR services are generally intended for adults and persons legally able to seek employment or use the relevant business service. We do not knowingly invite children to purchase The Ultimum HR products. Where a specific recruitment activity lawfully involves a minor, appropriate information, legal basis and parental or guardian involvement will be arranged where required.

13. Changes to this Policy

We may update this Policy to reflect changes in services, technology, providers or law. The current version and update date will be published on this page. Where a change materially affects an existing processing activity, we will provide additional notice when required.