Privacy Policy

I. INTRODUCTION 

In its business activity, DLS Petroleum Ltd and its Bulgarian branch (DLS-Global Import Export Ltd in United Kingdom) take into consideration that it is important for natural persons to understand the process of collection, storing, sharing and use of any information constituting personal data. 

As stated in the source document: 

“it is important for natural persons to understand the process of collection, storing, sharing and use of any information constituting personal data.” 

DLS Petroleum Ltd, in its capacity as Controller within the meaning of the UK Data Protection Act 2018, UK GDPR, EU GDPR (for the Bulgarian branch), and the Bulgarian Personal Data Protection Act, is committed to ensuring compliance with national and EU legislation with respect to the processing of personal data and the protection of the rights and freedoms of individuals. 

Depending on the situation, the Company may also act as a Processor, as described in the original text. 

One of the main objectives of DLS Petroleum Ltd is the development and furthering of good practices in the area of personal data protection. 

This Policy provides information on the principles and rules related to the processing of personal data, the rights of data subjects, the ways in which personal data are processed, and the means for data protection by the Company. 

II. PRINCIPLES RELATED TO DATA PROCESSING AND PROTECTION 

DLS Petroleum Ltd processes personal data in line with the principles laid down in Article 5 of the GDPR, including: 

1. Lawfulness, Fairness, Transparency 

Personal data shall be processed lawfully, fairly and in a transparent manner. 

The original document states: 

“Personal data shall be processed lawfully, fairly and in a transparent manner.” 

Legal grounds include: 

• Compliance with legal obligations 
• Performance of a contract or pre-contractual steps 
• Consent 
• Protection of vital interests 
• Public interest 
• Legitimate interest of the Company 

2. Purpose Limitation 

Personal data are collected only for specified, explicit and legitimate purposes. 

3. Data Minimisation 

Only data strictly necessary for the purpose are collected. 

4. Accuracy 

Data must be accurate and kept up to date. 

5. Storage Limitation 

Data shall be kept no longer than necessary. 

6. Integrity and Confidentiality 

The Company applies appropriate technical and organisational measures to ensure confidentiality, integrity and availability of personal data. 

III. CATEGORIES OF PERSONAL DATA PROCESSED 

1. Standard Personal Data 

• Identification data 
• Contact details 
• Business correspondence 
• Contractual and financial information 
• CCTV recordings 
• Data generated through use of company devices 
• Vehicle location data (logistics, safety) 

2. Special Categories of Data 

Processed only when legally required (e.g., employee health data for workplace safety). 

The Company does not process sensitive data such as racial origin, political views, biometric data, etc. 

IV. CATEGORIES OF DATA SUBJECTS 

DLS Petroleum Ltd processes personal data of: 

• Employees 
• Job applicants 
• Contractors and suppliers 
• Customers and business partners 
• Truck drivers 
• Visitors 
• Participants in company events 
• Individuals whose data is provided by third parties 

V. PURPOSES OF PROCESSING 

Personal data are processed for: 

• Contract performance 
• HR and employment relations 
• Recruitment 
• Sales and distribution of petrol, chemical and heating products 
• Supply chain operations 
• Ensuring safe working conditions 
• Administrative, legal, accounting and tax compliance 
• Environmental and quality control 
• Protection of Company rights 

VI. LEGAL BASIS FOR PROCESSING 

Processing is based on: 

• Legal obligations 
• Contractual necessity 
• Legitimate interest 
• Consent (when no other basis applies) 

VII. RIGHTS OF DATA SUBJECTS 

Data subjects have the right to: 

• Access 
• Rectification 
• Erasure 
• Restriction 
• Objection 
• Data portability 
• Withdraw consent 
• Lodge a complaint 

The original text states: 

“The Controllers shall provide assistance in the exercise of the rights of the data subject…” 

VIII. CONSENT 

Consent is required only when no other legal basis applies. 

It must be freely given, specific, informed and unambiguous. 

IX. SECURITY OF PERSONAL DATA 

DLS Petroleum Ltd applies: 

• Password protection 
• Access control 
• Antivirus and firewall systems 
• Secure storage of documents 
• Employee confidentiality obligations 

In case of a data breach, the Company follows GDPR Articles 33 and 34. 

X. DATA DISCLOSURE AND TRANSFER 

Data may be shared with: 

• Internal organisational units 
• Suppliers, distributors, logistics partners 
• Banks, insurers, auditors 
• Government authorities 
• Customs and regulatory bodies 

Any disclosure must be justified and documented. 

XI. CONTROLLER–PROCESSOR RELATIONS 

Relations with processors are regulated by written contracts ensuring GDPR compliance. 

XII. RECORDS OF PROCESSING ACTIVITIES 

The Company maintains detailed records of: 

• Processing activities 
• Data categories 
• Legal bases 
• Recipients 
• Storage locations 
• Retention periods 

XIII. DATA PROTECTION IMPACT ASSESSMENT 

Conducted when processing is likely to result in high risk. 

XIV. DATA STORAGE AND DESTRUCTION 

Data are stored only as long as necessary and destroyed securely.