Legal
Privacy
Policy.
Last updated: May 2026
1. Who We Are
Optimal Staff Recruitment is a licensed recruitment agency based at Atanas Manchev 2, Sungurlare, Bulgaria. We are licensed by the Employment Agency of the Republic of Bulgaria and a member of the World Employment Confederation Europe. We operate as the data controller for all personal data processed through optimalstaff.eu and our recruitment services.
For all data protection matters, contact us at info@optimalstaff.eu or +359 89 382 8483.
2. Scope — Who This Policy Covers
This policy applies to three groups of people whose data we process:
- Job seekers and candidates — people who apply for roles, use our CV Builder or contact us looking for work
- Employers and business contacts — companies and individuals who engage us to source workers
- Website visitors — anyone who browses optimalstaff.eu, subscribes to our newsletter or submits an enquiry
3. Data We Collect — by Category
Job seekers and candidates:
- Name, email address, phone number
- CV documents and professional history uploaded during application
- Work experience, qualifications, skills and certifications
- Nationality and right-to-work status where relevant to EU placements
- Any additional information you voluntarily provide
Employers and business contacts:
- Company name, contact name, job title
- Email address and phone number
- Vacancy details, working conditions and requirements submitted via contact form
Website visitors:
- Email address (newsletter subscribers only)
- Contact form submissions — name, email, phone, company name, message
- Anonymised usage data via cookies (pages visited, session duration, browser type)
4. How We Use Your Data
| Purpose | Data Used | Who It Applies To |
|---|---|---|
| Matching candidates to suitable EU job opportunities | Name, CV, skills, availability | Candidates |
| Presenting candidate profiles to relevant employers | Name, CV, professional history | Candidates |
| Responding to employer vacancy enquiries | Company name, contact details, vacancy info | Employers |
| Processing job applications submitted via the website | Name, email, phone, CV document | Candidates |
| Sending newsletters to opt-in subscribers | Email address only | Subscribers |
| Generating CV documents via the CV Builder tool | All data entered in the CV Builder form | Candidates |
| Improving website performance via anonymised analytics | Anonymised usage data | All visitors |
| Maintaining the admin panel session | Session cookie only | Admin users |
We do not use your data for advertising, profiling or automated decision-making. No AI tools are used in any stage of our recruitment process.
5. Legal Basis for Processing (GDPR Article 6)
| Processing Activity | Legal Basis |
|---|---|
| Recruitment services — matching candidates to roles | Performance of a contract / pre-contractual steps (Art. 6(1)(b)) |
| Responding to employer and candidate enquiries | Legitimate interests (Art. 6(1)(f)) |
| Newsletter communications | Consent (Art. 6(1)(a)) |
| CV Builder document generation | Performance of a contract / pre-contractual steps (Art. 6(1)(b)) |
| Compliance with Bulgarian and EU labour regulations | Legal obligation (Art. 6(1)(c)) |
| Anonymised website analytics | Legitimate interests (Art. 6(1)(f)) |
6. Who We Share Your Data With
Employers: Candidate profiles are shared with employers only when a relevant vacancy match exists and the candidate is aware of the introduction. We do not share CVs speculatively or without context.
Supabase: Our database provider stores submitted form data, job applications and newsletter subscriptions. Supabase operates within EU infrastructure and complies with GDPR. Data is not processed for any purpose beyond storage.
Regulatory and legal authorities: Where required by Bulgarian law or EU regulation, we may disclose data to authorities. We will always seek to notify you where legally permissible.
We do not sell, rent or share your data with third parties for marketing, advertising or any commercial purpose.
7. International Data Transfers
Optimal Staff operates across the EU and our data infrastructure (Supabase) is hosted within the European Economic Area. We do not transfer personal data outside the EEA. Where any third-party service operates internationally, we ensure appropriate safeguards are in place under GDPR Chapter V before any transfer occurs.
8. How Long We Keep Your Data
| Data Type | Retention Period |
|---|---|
| Contact form submissions | 12 months from submission date |
| Job applications (CV, personal details) | Duration of active recruitment relationship, then deleted within 6 months of last contact |
| Employer enquiry and contact records | 12 months from last communication |
| Newsletter subscriptions | Until you unsubscribe |
| CV Builder data | Session only — deleted at end of session unless you submit your CV directly to us |
| Admin panel session cookie | 24 hours |
| Language preference cookie | 30 days |
When retention periods expire, data is deleted or anonymised. You can request early deletion at any time — see Section 9.
9. Your Rights Under GDPR
As a data subject in the EU, you have the following rights:
- Access: Request a copy of the personal data we hold about you
- Rectification: Ask us to correct inaccurate or incomplete data
- Erasure: Request deletion of your data where there is no lawful reason to retain it
- Restriction: Ask us to pause processing while a dispute is resolved
- Portability: Receive your data in a structured, machine-readable format
- Objection: Object to processing based on legitimate interests
- Withdraw consent: Where processing is based on consent (e.g. newsletter), withdraw it at any time without affecting prior lawful processing
10. How to Exercise Your Rights
Send your request by email to info@optimalstaff.eu. Include your full name and the nature of your request. We will respond within 30 days. Where a request is complex or we receive multiple requests, we may extend this by a further 60 days — we will notify you if that is the case.
We may ask you to verify your identity before acting on a request. This is to protect against unauthorised access to your data.
11. Complaints
If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):
- Website: www.cpdp.bg
- Address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
We would prefer to resolve any concerns directly before a formal complaint is made. Please contact us first.
12. Security
All data is transmitted over encrypted HTTPS connections. Access to stored data is restricted to authorised personnel only. Our admin panel is protected by a session-based authentication system. We conduct periodic reviews of our data handling practices. No system is entirely risk-free — if you have concerns about a specific data security issue, contact us immediately at info@optimalstaff.eu.
13. Changes to This Policy
When we update this policy, the date at the top of the page changes. Material changes — those that affect how we use your data or your rights — will be communicated by email to active subscribers and candidates on file. Continued use of the website after any update constitutes acceptance of the revised policy.