Update: 12.06.2025
We take care to protect your personal data.
Who we are?
Toplofikacia Sofia EAD is a commercial company registered in the Commercial Register at the Registry Agency with UIC 831609046, with its headquarters and registered office: city of Sofia, 1680, No.23B Yastrebets Str. and is a personal data administrator, in accordance with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council as of 27.04.2016 on the protection of private entities with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) and the Personal Data Protection Act.
How to contact us?
Correspondence address: city of Sofia, 1680, No.23B Yastrebets Str.
Contact details for the personal data protection officer of Toplofikacia Sofia EAD: Galya Trencheva - Personal Data Protection Officer, e-mail address - - dpo@toplo.bg.
It is used only for questions regarding the processing of your personal data by Toplofikacia Sofia EAD in the capacity of administrator, as well as for exercising your rights under Articles 15 - 22 of the Regulation (EU) 2016/679, subject to the terms of the Electronic Document and Electronic Certification Services Act, the Electronic Government Act and the Electronic Identification Act.
Upon submitting an application pursuant to Articles 15 – 22 of the Regulation (EU) 2016/679 to the email address - dpo@toplo.bg , an automatic response is generated, which confirms receipt of the same and informs the data subject that the application will be considered if it meets the requirements of the Personal Data Protection Act and it has been sent in compliance with the Electronic Document and Electronic Certification Services Act, the Electronic Government Act and the Electronic Identification Act. Upon receipt of your application, which meets the legal requirements, you will receive additional information about the application registration number from the Data Protection Officer in your email. In this case, the date of receipt of the application by e-mail is considered the date of application, according to the working hours of Toplofikacia Sofia EADEAD.
Actions to consider the application on the merits shall be taken only if the submitted application meets the requirements of Art. 37b and Art. 37c of the Personal Data Protection Act.
For all other general questions regarding the activities of Toplofikacia Sofia EAD, PLEASE use the customer service e-mail address info@toplo.bg.
What is the Privacy Policy?
This privacy policy aims to provide you with comprehensive information in clear and accessible language about what actions are taken with the personal data you provide to Toplofikacia Sofia EAD, including:
- What personal data do we collect about you?
- What is the purpose of their collection?
- How long do we store the personal data provided?
- Who do we share your personal data with?
- What are your rights regarding the personal data provided?
- How do we notify you of a change to our Privacy Policy?
- What types of ‘cookies’ do we use to make your stay on our website better?
By this Privacy Policy Toplofikacia Sofia EAD declares that it implements all technical and organizational measures to protect the personal data of individuals/data subjects that are prescribed by law or other regulatory act at national and European level.
What is personal data?
Personal data means any information relating to an identified or identifiable private entity (‘data subject’); an identifiable private entity is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that private entity.
Toplofikacia Sofia EAD processes your data lawfully, in good faith and in a transparent manner. When data processing is not based on law or contractual relations, it is necessary that the data subject has previously given consent to the processing of its personal data for one or more specific purposes. Processing is lawful where it is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entry into a contract.
What personal data do Toplofikacia Sofia EAD collect about you?
In order to provide you with effective access to our products/services, Toplofikacia Sofia EAD collects the information about you as follows:
- Name, surname, telephone number, e-mail address, city, address, bank account details, subscriber number, etc. upon filling out the various forms posted on our website;
- Last four digits of the Personal Identification Number or UIC, Installation Number, Contract Account Number - upon registering in My Portal;
- Technical data that is automatically sent to us when you use our website and mobile application;
- IP address, information about the device from which you visit the site and mobile application;
- Cookies to identify your browser or device, etc.
On what grounds does Toplofikacia Sofia EAD process your personal data ?
The processing of personal data includes collection, storage, transmission, correction, updating, erasure, destruction and all other actions that are performed with your personal data.
Toplofikacia Sofia EAD collects your personal data in order to fulfill its contractual obligations under contracts concluded with you for the provision of services - on a contractual basis.
Toplofikacia Sofia EAD collects personal data after receiving your explicit, clear, free and unambiguous consent for the purposes of processing. For example, for marketing purposes and receiving promotional newsletters.
Personal data for each person is provided voluntarily by the individuals themselves and is collected by Toplofikacia Sofia EAD in fulfillment of a regulatory obligation, in connection with the conclusion of a contract and/or the fulfillment of obligations under a concluded contract in accordance with the provisions of the Energy Act, the Condominium Management Act, the Public Procurement Act, the Commerce Act, the Obligations and Contracts Act, the Value Added Tax Act, etc., as well as the conditions specified in the contract with the respective client through: paper - written documents (including powers of attorney, contracts, writ of attachments, bank information, etc.), by e-mail - provided in connection with the execution of the contract and/or by filling out a registration form.
Toplofikacia Sofia EAD also processes personal data in fulfillment of legal obligations, as well as if necessary in order to protect the life and health of the individual to whom the data relates.
Toplofikacia Sofia EAD may also process personal data if it has a legal (legitimate) interest, except when the interests of the individual to whom the data relate take precedence over these interests.
For what purposes do we collect your personal data?
The personal data received from you will be used to enable us to fulfill our obligations to you, as well as to help exercise your rights, including, but not limited to:
- To provide you with the services/products offered by Toplofikacia Sofia EAD;
- To provide you with access to our website, by showing you content that is relevant, personalized and limited to the criteria you set;
- To respond to your inquiries, opinions and recommendations;
- To send you information related to special campaigns and our new products and services.
In addition to the above, we have a legitimate interest in collecting your personal data because without it we cannot provide you with the service/product in which you are interested. Also for the fulfillment of legal obligations and the protection of legitimate interests, unless the interests of the individual are overridden by them.
How do we process your personal data?
In order to provide products and services, Toplofikacia Sofia EAD processes the personal data you provide regarding your physical, economic, social and family identity in the following ways:
- by filling out applications, forms and declarations provided to you by employees of Toplofikacia Sofia EAD. The forms are provided and completed in our offices in case you make a request for the provision of services;
- by visiting the web portal for using the services of our website;
- when updating data at your request and filling out an update form on paper or in an electronic environment.
How long do we store and process your data before destructing it?
Depending on the basis on which your personal data is processed, the period of storage of personal data varies.
Personal data are stored for a period of time until the legal basis for processing them ceases to exist, in accordance with Article 6 of the Regulation (EU) 2016/679. The storage periods are in accordance with Bulgarian legislation, as well as the Nomenclature of cases with storage periods in Toplofikacia Sofia EAD, which is maintained in accordance with the Law on the National Archival Fund. Information is not stored for longer than necessary.
In accordance with the principles set out in the Regulation (EU) 2016/679 and in particular in accordance with Article 5, paragraph 1, letter "d", personal data may be lawfully stored in a form which permits identification of the data subject for no longer than is necessary - a principle introducing ‘storage limitation’ of data.
To whom may we transfer your personal data provided?
Toplofikacia Sofia EAD undertakes not to provide your personal data without your explicit consent to third parties, except when necessary to fulfill contractual obligations to you.
To fulfill obligations under contractual and/or pre-contractual relationships with you, it is possible for Toplofikacia Sofia EAD to disclose your personal data to the following persons:
- Companies providing courier services;
- Share distribution companies;
- Companies collecting amounts;
- The company maintaining the call center.
Disclosure of your personal data is possible only in cases when the information is requested by government authorities or officials authorized by law to request and collect information containing personal data and in compliance with the regulatory procedure.
Toplofikacia Sofia EAD does not transfer your personal data to third countries (outside the European Union ) or international organizations.
Are there any other cases in which we may share your personal data?
Your personal data is also provided to third parties in the following cases:
- At the request of the individual who provided the data, a subject of personal data protection;
- At the request of competent authorities in accordance with the current legislation of the Republic of Bulgaria and the European Union.
In all of the above cases, the persons to whom we provide your personal data have declared that they provide an adequate level of protection for your personal data, including foreign companies positioned within the European Union and the European Economic Area.
What are your rights regarding the personal data provided?
According to Art. 15 - Art. 22 of the Regulation (EU) 2016/679 on the protection of personal data, you may exercise the following rights:
- The right to access the personal data that Toplofikacia Sofia EAD processes for you and to receive a copy of them;
- The right to request correction from Toplofikacia Sofia EAD, in case you find inaccuracies or need to update your personal data;
- Right to erasure (‘right to be forgotten’) of personal data that is processed unlawfully or on an expired legal basis (expired storage period, withdrawn consent, fulfilled initial purpose for which it was collected, etc.);
- Right to request restriction of the processing of personal data, in the cases specified by the Regulation and the law;
- Right to object at any time and on grounds relating to your particular situation, provided that there are no legal grounds for the processing, which have priority over your interests, rights and freedoms, or legal process;
- Right to portability of your personal data in a structured, machine-readable format that is commonly used;
- The right to file a complaint for the protection of your rights with the competent authority for the protection of personal data, namely - the Personal Data Protection Commission of the Republic of Bulgaria, if the prerequisites for this are met.
You can exercise all rights at any time regarding the processing of your personal data.
What does each of the above rights mean?
Right of personal data access.
This right gives you the opportunity to obtain confirmation as to whether your personal data are being processed, the purposes of the personal data processing, the recipients or categories of recipients to whom the data may be disclosed, in particular recipients in third countries or international organizations, as well as the right to request from Toplofikacia Sofia EAD correction or deletion of personal data or restriction of the processing of personal data .
The data shall not be provided when the private entity to whom it relates already has it or there is an explicit prohibition by law on its provision.
Right of rectification, erasure (right „to be forgotten“), restriction of processing.
The right at any time to request from Toplofikacia Sofia EAD to correct, delete or restrict your personal data processing, which processing does not meet the requirements of the Regulation or the Personal Data Protection Act (PDPA).
Right to object
As a data subject, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data. Toplofikacia Sofia EAD shall cease processing personal data unless it demonstrates compelling legitimate grounds for the processing which have priority over your interests, rights and freedoms as the data subject, or for the establishment, exercise or defence of legal claims. When personal data are processed for direct marketing purposes, you have the right to object at any time to its personal data processing concerning such marketing, which includes profiling to the extent that it is related to direct marketing. When you object to direct marketing purposes processing, your personal data processing for these purposes will cease.
Right to portability
When the personal data processing is carried out in an automated way, you have the right to receive your personal data in concern, which you have provided to the controller, in a structured, commonly used, machine-readable and interoperable format, and to transmit them to another controller.
This right should apply where the data subject has provided the personal data on the basis of its own consent or the processing is necessary for a contractual obligation. The right should not apply where the processing is based on a legal basis other than consent or contract. Due to its very nature, this right should not be exercised in relation to controllers processing data in the performance of their public obligations. Therefore, this right should not apply where the processing of personal data is necessary for compliance with a legal obligation to which the controller is subject, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller. The right of the data subject to transmit or receive its personal data relating, it does not give rise to an obligation for controllers to adopt or maintain technically compatible processing systems. Where more than one data subject is concerned in a given set of personal data, the right to receive the personal data should not affect the rights and freedoms of other data subjects in accordance with this Regulation.
You may exercise the rights under Articles 15-22 of the Regulation in person or through a person expressly authorized by you by submitting a written application. The application should contain:
1. name, address, unique civil number/personal identification No. or personal ID number for a foreigner or other similar identifier, or other identification data of the private entity determined by the administrator, in connection with the activity carried out by it;
2. description of the request;
3. preferred form for receiving information when exercising the rights under Articles 15 - 22 of the Regulation (EU) 2016/679;
4. signature, date of submission of the application and correspondence address.
The Personal Data Protection Act does not require notary public verification of the power of attorney for exercising the rights under Regulation (EU) 2016/679.
An application is submitted on paper to the Administrative Service Center of Toplofikacia Sofia EAD at the address: Sofia city, 1680, No.23B Yastrebets No. 23 B ( pdf format can be download here) or electronically (it is mandatory that the application be signed with a qualified electronic signature). A template for an application for a request to exercise rights is only recommended. The rights can also be exercised by the data subject through a written application in free text, which contains sufficient and accurate information, complying with the requirements set out in the Regulation (EU) 2016/679 and the Personal Data Protection Act.
To facilitate the exercise of your rights under Articles 15 - 22 of Regulation (EU) 2016/679, Toplofikacia Sofia EAD provides you with applications in paper format at each of our customer service centers.
Right to appeal to the Personal Data Protection Commission
In case of violation of your rights, you are entitle to notify the Personal Data Protection Commission within 6 (six) months of becoming aware of the violation, but no later than 2 (two) years from its completion. If your rights are violated, you have the right to appeal the actions and acts of the administrator through court or before the Supreme Administrative Court. The court cannot be referred if there is a pending proceeding before the Commission for the same violation or a decision of the Personal Data Protection Commission regarding the same violation with a court decision that has entered into force.
Contacts with the Commission – Sofia city, 1592,. 2 Prof. Tsvetan Lazarov Blvd., e-mail: : kzld@cpdp.bg, website: www.cpdp.bg.
Toplofikacia Sofia EAD carries out video surveillance for security purposes. The video recordings collected from video surveillance cameras, containing video images of the movement of employees and visitors around the approaches to the buildings of Toplofikacia Sofia EAD, in the common areas and in the security areas. Data is stored for a period of 2 (two) months, in accordance with the Private Security Activities Act. Certain employees have access to the data within the scope of their official duties. The collected data is provided to third parties only in cases where this is provided for by law, for example to public authorities, in view of their powers and competence. Toplofikacia Sofia EAD provides appropriate technical and organizational measures to protect your personal data.
The processing of personal data of visitors to Toplofikacia Sofia EAD is carried out by employees ensuring the access regime. The purpose of collecting personal data is to identify individuals visiting the building of Toplofikacia Sofia EAD and to control access. Certain employees have access to the data within the scope of their official duties. The collected data is provided to third parties only in cases where this is provided for by law, for example to public authorities, in view of their powers and competence. Toplofikacia Sofia EAD provides appropriate technical and organizational measures to protect your personal data.
Toplofikacia Sofia EAD records telephone calls (incoming and outgoing) with call centers and lines (telephone numbers) intended for customer service. The telephone calls recording and the audio recordings storage and processing (together with the personal data disclosed within the conversations) are carried out for the purposes of protecting the rights and legitimate interests of the company. Toplofikacia Sofia EAD records are stored for a certain period, after which the earliest data is automatically deleted in accordance with the system settings. If you do not want to record telephone conversations, please let us know.
Changes to Security Policies – (Privacy Notice)
For all changes made to this Privacy Policy, we declare that you will be notified by us through the company website and mobile application.
This Privacy Policy may be updated and supplemented without prior notice, in the event of an update of legislative regulations or a change in our personal data processing policy. The new update will be effective from the date of the last change indicated in the upper left part of the Privacy Policy. Using the website and mobile application after the update is posted means you agree to the changes made.
"Cookie" Policy
GENERAL PROVISIONS
‘Cookies’ are small text files that are saved on your computer when you visit a website. If you access this website at another time, your browser sends back the content of the ‘cookies’ and thus allows the re-identification of the terminal device. Reading cookies allows us to design our website optimally for you and makes it easier for you to use it. The mobile application uses technologies that are considered similar to ‘cookies’ and are treated according to the same privacy rules. These technologies support application functionality, security, and usage analysis. Users have the ability to manage their preferences and consents regarding data collection through the application or device settings.
DISABLING AND DELETING COOKIES
The browser allows you to delete all ‘cookies’ at any time.
In a mobile application, you can opt out or limit data collection through your device settings.
NECESSARY ‘COOKIES’
Certain ‘cookies’ are necessary so that we can securely provide our services through our website and mobile application. This category includes:
- "Cookies" that identify or authenticate our users;
- "Cookies" that temporarily store certain user data (e.g. content of an online form);
- "Cookies" that store certain user preferences (e.g. search settings or language settings);
- "Cookies" that store data to ensure smooth playback of video or audio content.
ANALYTICAL ‘COOKIES’
We use analytical ‘cookies’ to record user behaviour (e.g. clicks on ad banners and entered search queries) and to statistically evaluate these actions.
WEB SPACE ANALYSIS
We need statistical information about the use of our website and portal to make them more accessible, measure their reach and conduct market research. For this purpose, we use the web analytics tool Matomo. The user profiles created by it using performance cookies or through log file analysis do not contain any personal data.
You can object to the collection and processing of your data through the privacy settings on our site by turning off performance ‘cookies’.
If you do not want information about your use of the application to be collected for analytical purposes, you can restrict this through the settings of your mobile device.
THIRD PARTY ‘COOKIES’
The website and mobile application may contain links to other sites or embedded content from third parties (e.g. from Facebook, YouTube, etc.). When visiting these other sites or when opening pages that contain embedded content from third parties, it is likely that third-party ‘cookies’ will be placed on your end device.
Toplofikacia Sofia EAD has not control over the generation and management of "third-party cookies". For more information about the purpose of using third-party ‘cookies’ and their content, please search for and familiarize yourself with the privacy and ‘cookie’ policies adopted by the relevant third parties.
Most commonly available browsing programs (browsers) allow ‘cookies’ to be placed on the end device by default. If you prefer, you can change your browser settings so that existing ‘cookies’ are deleted or the placement of ‘cookies’ (including third-party cookies) is automatically blocked. Please note that if you choose to delete or block ‘cookies’, this may affect the accessibility or functionality of this website and mobile application.
More information about "cookies", including how to manage them, can be found on the following website:https://www.allaboutcookies.org/manage-cookies.
By visiting our website and mobile application, you agree to the use of ‘cookies’ in accordance with the terms of this Privacy and Personal Data Protection Policy.
The site is protected with Google reCaptcha. You can read their Privacy и Terms.