Reports under the Law on Protection of Persons Reporting or Publicly Disclosing Information on Violations

INFORMATION ON THE CONDITIONS AND PROCEDURE FOR SUBMITTING REPORTS ON VIOLATIONS IN BULGARIAN PORTS INFRASTRUCTURE COMPANY

under the Law on Protection of Persons Reporting or Publicly Disclosing Information on Violations (LPPRPDIV)

  1. Persons to whom protection is provided under LPPRPDIV

You can submit a Violation Report through the internal reporting channel at Bulgarian Ports Infrastructure Company if you have learned about the violation in your capacity as:

  • an employee, staff member, or other person who performs paid work at Bulgarian Ports Infrastructure Company, regardless of the nature of the work, the method of payment, or the source of funding;
  • a person who performs work without an employment relationship at Bulgarian Ports Infrastructure Company;
  • a volunteer or intern at Bulgarian Ports Infrastructure Company;
  • a member of the Management Board of Bulgarian Ports Infrastructure Company;
  • a person who works for an individual or legal entity, its subcontractors or suppliers of Bulgarian Ports Infrastructure Company;
  • a job applicant at Bulgarian Ports Infrastructure Company who has participated in a competition or other form of selection for employment and received information about a violation in this capacity;
  • an employee or staff member of Bulgarian Ports Infrastructure Company when the information was obtained within the framework of an employment or service relationship that has been terminated at the time of submitting the report or public disclosure;
  • any other reporting person who submits a report on a violation that became known to them in a work-related context.

  1. Scope of violation reports under LPPRPDIV

Violation reports submitted under LPPRPDIV must relate to the following areas associated with the activities of Bulgarian Ports Infrastructure Company:

  • public procurement;
  • transport safety;
  • environmental protection;
  • public health;
  • consumer protection;
  • protection of privacy and personal data;
  • security of networks and information systems;
  • labor legislation.

  1. Procedure for submitting violation reports to Bulgarian Ports Infrastructure Company (internal channel)

Reports are submitted in writing (including by email) or verbally.

You can submit a report using the template Form for registering a report for submitting information on violations according to the Law on Protection of Persons Reporting or Publicly Disclosing Information on Violations https://www.cpdp.bg/?p=sub_rubric&aid=282, by completing only Parts I – V inclusive, affixing your handwritten signature, and submitting or mailing the completed form to: Sofia, 69 Shipchenski Prohod Blvd., State Enterprise “Port Infrastructure”, Internal Reporting Channel.

You can submit a report via email using the template Form for registering a report for submitting information on violations according to the Law on Protection of Persons Reporting or Publicly Disclosing Information on Violations https://www.cpdp.bg/?p=sub_rubric&aid=282, by completing only Parts I – V inclusive, signing with a qualified electronic signature (QES) and sending it to: signal@bgports.bg.

Within 7 days of receiving the report, an employee responsible for reviewing it will confirm receipt and provide you with information on registering the report and its unique identification number (generated from the website of the Commission for Personal Data Protection).

Any subsequent information or communication regarding the report is attached to this unique identification number.

You can submit the report verbally in person at the Headquarters of Bulgarian Ports Infrastructure Company at: Sofia, 69 Shipchenski Prohod Blvd.

Please note that:

  • No proceedings are initiated for registered anonymous reports or reports of violations committed more than two years ago;
  • Registered reports that do not fall within the scope of LPPRPDIV are not considered;
  • Registered reports containing obviously false or misleading statements are returned to the reporting person with instructions to correct the statements and information about the responsibility they bear for false accusation under Article 286 of the Criminal Code.

  1. How we process your personal data in connection with submitted violation reports under LPPRPDIV

Personal data controller: Bulgarian Ports Infrastructure Company with address: Sofia, 69 Shipchenski Prohod Blvd.

Purposes of processing personal data in submitted violation reports: Personal data is processed for the purposes of ensuring the protection of persons who submit reports or publicly disclose information about violations of Bulgarian legislation or European Union acts that became known to them during or in connection with the performance of their work duties or in another work context within the meaning of LPPRPDIV, as well as for fulfilling the relevant legal obligations.

Legal basis for processing personal data: Your personal data is processed on the basis of Art. 6, par. 1, point “c” of Regulation (EU) 2016/679 in connection with the obligations arising from the Law on Protection of Persons Reporting or Publicly Disclosing Information on Violations.

Recipients of personal data: Access to personal data in violation reports is granted to employees of Bulgarian Ports Infrastructure Company responsible for reviewing the reports. Disclosure of the identity of individuals and information in submitted violation reports is carried out only under the conditions of Art. 31 of LPPRPDIV:

  • with the explicit written consent of the reporting person, submitted in writing or electronically to an employee responsible for reviewing the report;
  • when it is a necessary and proportionate obligation imposed by Bulgarian legislation or European Union law in the context of investigations by national authorities or judicial proceedings, including to ensure the right of defense of the affected person. In these cases, the reporting person is notified of the need for disclosure with a written notification from an employee responsible for reviewing the report, which is justified. The reporting person is not notified when this jeopardizes the investigation or judicial proceedings.

Personal data retention period: The retention period for personal data is determined by the time required to conduct the investigation of the report, the time needed for further investigations, and the time for storing the report in accordance with Art. 18, para. 2, item 9 of LPPRPDIV.

Rights of data subjects: When processing your personal data, you have the rights under Regulation (EU) 2016/679, which you can exercise according to the procedure specified in the Privacy Policy http://www.bgports.bg/bg/page/78 .

Rights under LPPRPDIV:

  • to decide whether you want to sign the documented verbal report (Art. 15, para. 3 of LPPRPDIV);
  • to be informed of the receipt of the report within 7 days of receipt (Art. 16, item 1 of LPPRPDIV);
  • to receive information about the procedures for external reporting to the Commission for Personal Data Protection (CPDP), in its capacity as the central body for external reporting, and where appropriate, to the institutions, bodies, offices, and agencies of the European Union (Art. 16, item 5 of LPPRPDIV);
  • to be informed about the forwarding of your report to the CPDP when action is required on its part (Art. 16, item 11, point “d” of LPPRPDIV);
  • to be informed of the actions taken, the final results of the investigation of the report, along with the reasons (Art. 16, item 4 in connection with Art. 17, para. 1, item 4 of LPPRPDIV).
7