Privacy Policy
Effective from 27 October 2026
1. Scope
This policy describes how STM Life-04 Ltd processes personal data in three main cases:
- website visitors and people who send us an enquiry (Section A);
- employees of our clients who receive occupational health services from us, including the data in their health records (Section B);
- representatives and contact persons of our clients, business partners and suppliers (Section C).
Sections 3 to 8 apply to all cases. The data of our own staff is processed under separate internal rules, which they receive when they join.
2. Controller
Controller: STM Life-04 Ltd, company ID (EIK) 123673206, registered office and address: 125 Zaychar St., office 2, 1309 Sofia, Bulgaria. Email: office@life-04.com. Phone: +359 897 932 200.
Our role in occupational health services. We provide occupational health services under a contract with the employer. Where the contract names the employer as controller and us as processor, we process employees’ data on the employer’s behalf and on its instructions. Whatever our role under the contract, as an occupational health service we are bound directly by law to medical confidentiality, to the rules on keeping and storing health records, and to the limits on what information the employer may receive.
SECTION A. Website visitors and enquiries
A.1. What data we process
Data you enter in the form:
- company, phone and email (required);
- name, number of employees and the text of your message (optional).
Technical data: IP address, browser and device type, date and time of the visit. They are logged by the hosting provider.
Data in browser storage: the times of enquiries sent in the last hour. They stay on your device and are not sent to us.
Health data: we do not ask for it and it is not needed for an enquiry. Please do not include information about your health or anyone else’s in your message. If we receive such information anyway, we will not use it and will delete it without undue delay.
A.2. Purposes and legal bases
We use the data only for the purposes below. We do not use it for advertising and we do not sell it.
| Purpose | Legal basis (Regulation (EU) 2016/679) |
|---|---|
| Answering your enquiry, preparing an offer and negotiating a contract | If you enquire in your own name: steps taken at your request before entering into a contract (Art. 6(1)(b)). If you write on behalf of a company: our legitimate interest in replying to the representative of a prospective client (Art. 6(1)(f)). |
| Protecting the form and the website from spam, abuse and attacks | Our legitimate interest in keeping the website secure and working (Art. 6(1)(f)). |
| Establishing, exercising or defending legal claims | Our legitimate interest (Art. 6(1)(f)). |
A.3. Required data
Providing data through the form is voluntary. There is no legal or contractual obligation to provide it. Company, phone and email are needed so we can reply. Without them the form cannot be sent. You can also write to us at office@life-04.com or call +359 897 932 200.
A.4. Retention periods
| Data | Period |
|---|---|
| Enquiry not followed by a contract | Up to 12 months after the last contact. |
| Enquiry followed by a contract | The data moves to Section C and is kept for the periods set out there. |
| Technical data in hosting logs | According to the periods set by the hosting provider. |
| Data in browser storage | Used only for the last hour. You can delete it in your browser settings. |
A.5. Processors
To run the website we use the following processors. They process data only on our instructions and are bound by a contract under Art. 28 of the Regulation.
| Processor | Purpose | Data |
|---|---|---|
| Web3Forms | Delivers the enquiry to our mailbox | The form data |
| GitHub, Inc., USA | Website hosting | IP address in the server’s technical logs |
| The company’s email service provider | Storing enquiry emails | The form data and correspondence |
A.6. Cookies and browser storage
This website uses no advertising or analytics cookies. Fonts are loaded from our own server, not from third-party services. We only use storage that is strictly necessary for sending an enquiry and preventing abuse. No consent is required for it (Art. 4a(2) of the Bulgarian Electronic Communications Act).
| Item | Set by | Purpose | Duration |
|---|---|---|---|
| Number of enquiries sent (browser storage) | This website | Stops mass submissions from one device | Used only for the last hour |
You can delete these items at any time in your browser settings. Without them the form may not be sent.
SECTION B. Employees receiving occupational health services
B.1. Where we get the data
We do not collect this data through the website. We receive it from:
- your employer, when concluding and performing the occupational health service contract;
- you, when you visit our service on your own initiative or during training and consultations;
- the medical centres and doctors who carried out your pre-employment and periodic medical examinations;
- your employer’s previous occupational health service, when your health record is transferred to us officially.
B.2. What data we process
- Identification data: first name, middle name, surname, personal identification number (EGN), permanent address, place of birth.
- Employment data: employer, position (occupation), workplace, working conditions and risk factors, education, length of service and career history (previous employers, positions and duration).
- Data about your general practitioner: name, address and phone number.
- Health data: results of pre-employment and periodic medical examinations and tests, medical and family history, chronic and past illnesses, periods of temporary incapacity for work from copies of sick notes, registered occupational diseases, workplace accidents, job adaptation, permanent reduction in working capacity, expert decisions of the medical expert commissions (TELK and NELK), and decisions of the National Social Security Institute (NOI) recognising an accident as work-related.
- Data about visits to our service: date, reason and action taken.
B.3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Occupational health services under the Bulgarian Health and Safety at Work Act and Ordinance No. 3 of 25.01.2008: keeping health records, monitoring health, fitness-for-work decisions, assessing health risks | Legal obligation (Art. 6(1)(c)) and processing for the purposes of occupational medicine and the assessment of working capacity by persons bound by professional secrecy (Art. 9(2)(h) and 9(3)) |
| Analysing employees’ health and proposing improvements to working conditions | The same legal bases. The employer receives the analysis only in aggregated form, without data that could identify a specific person. |
| Providing data to competent authorities and courts | Legal obligation (Art. 6(1)(c)) and Art. 9(2)(f) or (h), as applicable |
We do not ask for your consent to this processing, because it is required by law. We do not use this data for marketing or any other purpose.
B.4. Who receives the data
- Your employer receives only what the law allows: a decision on whether you are fit to do the job, recommendations on working conditions and aggregated analyses. Your employer does not receive diagnoses or your medical information.
- Another occupational health service, when your employer changes provider, receives your health record through official channels.
- Public authorities and courts, when they request it in writing on a legal basis, for example the Labour Inspectorate, the Regional Health Inspectorate, NOI, TELK and NELK, courts, prosecutors and investigating authorities, and the Commission for Personal Data Protection.
We do not transfer data from health records outside the European Union.
B.5. Retention period
Employees’ health records are kept for 50 years. When the contract with the employer ends, the record is transferred to the new occupational health service through official channels or kept by us until the period ends. The data is then securely destroyed.
B.6. How we protect the data
- Health records are kept in specialised software for occupational health services and on paper.
- The computer with the database is not connected to a network, and access requires a personal password that is changed every quarter.
- Paper records are kept in a locked cabinet in a locked room in our office.
- Records are not taken out of the office, and copying the database to portable media is prohibited.
- Only the doctors and staff who work directly with the records have access. All are bound by medical confidentiality or a signed confidentiality declaration and receive data protection training.
B.7. Your rights regarding health data
You have the rights described in Section 5, with the following specifics:
- Access: you can obtain information about and a copy of the data in your health record.
- Correction: you can ask us to correct inaccurate data. Medical conclusions and test results are not changed, but we can add your note or a new document.
- Erasure and objection: while the legal retention period runs, we cannot delete the data or stop processing it, because the law requires us to keep it.
When we act as a processor under a contract with your employer, we will inform your employer of your request within 5 working days and help it reply to you.
SECTION C. Representatives of clients, business partners and suppliers
C.1. What data we process
Name, position, phone, email and signature of the managing director, authorised persons and contact persons, as well as the data in contracts, invoices and correspondence with them.
When preparing health and safety documents (for example orders, training programmes, and minutes of working conditions groups and committees), we also process the name and position of the health and safety officer, the members of the working conditions group or committee, and the employees named in the documents.
C.2. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Concluding and performing the contract, communicating with the client | Performance of a contract (Art. 6(1)(b)), and where the person acts on behalf of a company, our legitimate interest in working with its representative (Art. 6(1)(f)) |
| Preparing the health and safety documents the client has commissioned from us | The client’s and our legitimate interest in performing the contract and meeting legal requirements (Art. 6(1)(f)) |
| Accounting, invoicing and taxes | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Our legitimate interest (Art. 6(1)(f)). |
C.3. Recipients and retention periods
The data is available to management, the staff who work with the client and the company’s accountant. We may disclose it to banks for payments and to public authorities where the law requires it.
| Data | Period |
|---|---|
| Contracts and correspondence | For the term of the contract and 5 years after it ends (the general limitation period under Art. 110 of the Bulgarian Obligations and Contracts Act). |
| Accounting records | 10 years (Art. 12 of the Bulgarian Accountancy Act). |
| Health and safety documents prepared for the client | For the term of the contract with the client and until the end of the periods for which the law requires these documents to be kept. |
3. Transfers outside the European Economic Area
Data is transferred outside the EEA only to run the website (Section A.5), where a provider is in the USA or another country outside the EEA. We do so only with one of the following safeguards:
- an adequacy decision of the European Commission (Art. 45), including the EU–US Data Privacy Framework where the recipient is certified under it;
- standard contractual clauses adopted by the European Commission (Art. 46(2)(c)).
On request we will tell you which safeguard applies to each recipient and give you a copy of it. Health data is not transferred outside the European Union.
4. Automated decisions
We do not make decisions based solely on automated processing and we do not carry out profiling (Art. 22). Fitness-for-work decisions are made by a doctor.
5. Your rights
You have the right to request:
- access to your data and a copy of it (Art. 15);
- correction of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- portability of the data you gave us (Art. 20).
Right to object (Art. 21). You can object at any time to processing based on our legitimate interest. We will stop unless we have compelling legitimate grounds that override your interests, or the data is needed for a legal claim.
Some rights are limited where the law requires us to keep the data (see Section B.7).
How to exercise your rights. Write to office@life-04.com or by post to the address in Section 2. We reply free of charge within one month. For complex or numerous requests this can be extended by up to two months, and we will tell you if so (Art. 12(3)). We will ask you to confirm your identity before disclosing data, especially health data, so that we do not disclose it to someone else.
Complaints. If you believe your rights have been violated, you can complain to the Bulgarian Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, www.cpdp.bg. You can also seek a remedy in court (Art. 79).
6. Security
We apply technical and organisational measures suited to the type of data. The website runs only over a secure connection (HTTPS). Access to email and databases is limited to the staff who need it and is password-protected. The measures for health records are described in Section B.6. In the event of a personal data breach we act under Art. 33 and 34 of the Regulation and promptly inform the employer when we act as a processor on its behalf.
7. Changes
If this policy changes, we publish the new version on this page with a new effective date. For significant changes we will inform the people we are in active contact with.
8. Contact
STM Life-04 Ltd, 125 Zaychar St., office 2, 1309 Sofia, Bulgaria, office@life-04.com, +359 897 932 200.
← Back to the home page