Privacy Policy | HR Academy

HR ACADEMY

Privacy Policy

How HR Academy and Astrea Recruitment EOOD process personal data

Version 1.0 | 1 September 2026 г.

Administrator

„Astrea Recruitment“ EOOD, 203088821

Language note: This English version mirrors the Bulgarian document. For services supplied in Bulgaria, the Bulgarian version prevails to the extent permitted by law.

1. Controller and scope

The controller is„Astrea Recruitment“ EOOD, 203088821, registered/contact address: Sofia 1303, 83 Odrin Street., floor 3. HR Academy is its training brand and is not a separate legal entity. Data Protection Officer: Silvia Djokich, [email protected]. Academy contact: [email protected].

This policy applies to website visitors, enquirers, applicants, participants, trainers and persons using certificate verification. It does not govern independent third-party websites.

2. Data we process

Contact data: name, email and, where needed, telephone.
Application data: programme/cohort, CV, motivation, professional information and optional LinkedIn URL.
Training records: enrolment, attendance, assignments, final project, feedback and internal notes.
Payment and accounting information: payment status, amounts, deadlines and external invoice/reference number. Astrea issues invoices.
Certificate data: name, programme, issue date, learning hours, skills, Credential ID and status.
Technical and security data: IP address, logs, device/browser and cookie choices.
Communications and evidence of consent or withdrawal.

3. Purposes and legal bases

We process enquiries and security records on the basis of legitimate interests; applications and training to take steps before and perform a contract; invoices and statutory records to comply with law; marketing and public display of a certificate holder’s name only on separate consent. Contract-required processing does not rely on consent.

4. Required and optional data

Required fields are necessary to consider an application or supply the course. Optional marketing consent and public certificate visibility do not affect admission, training or certificate validity. Do not submit special-category data unless genuinely necessary and agreed in advance.

5. Recipients and international transfers

Access is limited to authorised Astrea/HR Academy staff, relevant trainers, accountants, advisers and contracted hosting, email, cloud and support providers on a need-to-know basis. Authorities receive data where required by law. Transfers outside the EEA use an adequacy decision, EU Standard Contractual Clauses and supplementary safeguards where required.

6. Retention

Enquiries: up to 12 months after closure.
Rejected or withdrawn applications: 6 months after the decision, unless separate consent supports a longer period.
Participant/contract records: 5 years after course completion; accounting and invoice records for the statutory period, normally 10 years.
Certificate verification record: while valid and 5 years after revocation; public visibility may be withdrawn.
Marketing: until withdrawal; minimal proof of the choice may be retained up to 5 years.
Security logs: up to 12 months unless needed for an incident or claim.

7. Your rights

You may request access, rectification, erasure, restriction, portability and object to legitimate-interest processing. You may withdraw consent at any time without affecting prior lawful processing. We normally respond within one month and may verify identity. Contact [email protected]. You may complain to the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, [email protected], www.cpdp.bg.

8. Automated decisions, children and security

Admission decisions are not made solely by automated means. Courses are intended for adults and we do not knowingly collect children’s data. We use access controls, logging, backups, staff training and contractual safeguards appropriate to risk.

9. Cookies and changes

Non-essential technologies are not activated before a valid choice. See the Cookie Policy. Material changes are shown with a new version and effective date.

Legal framework

Regulation (EU) 2016/679 (GDPR), especially Articles 5, 6, 12–22, 28, 32 and 44–49.
Bulgarian Personal Data Protection Act.
Guidance of the CPDP and the European Data Protection Board.