1. Who is responsible for your data
The data controller is Orange Education OOD (Ориндж Едюкейшън ООД), company number (EIK) 200480277, registered at Zapad district, bl. 81, Kyustendil, Bulgaria (“Orange”, “we”). The company operates the Orange Work and Travel brand and the orange.bg website.
For any question about your personal data, write to [email protected] or call 0700 15 665.
2. What data we process and why
When you browse the site
The site has no registration, accounts or forms. To show you a page, the server receives technical data — IP address, browser and device type, the requested address and the time of the request. It is kept briefly in server logs at our hosting provider and is used only for security and troubleshooting. The legal basis is our legitimate interest in running a reliable site (Art. 6(1)(f) GDPR).
When you contact us
If you write or call — by email, phone or social media — we process the data you give us: your name, contact details and the content of your enquiry. We use it to reply and to advise you about the program. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in answering enquiries.
When you enrol in the program
Enrolment happens by contract in one of our offices, not through the site. The data needed for your Work and Travel participation — documents, university, visa and employer details — is processed under that contract. You receive separate, detailed information when you sign it.
Visit analytics — only with your consent
If you accept analytics cookies, we use Google Analytics 4 to understand which pages are read and where visitors come from. It collects: pages visited and actions on them, approximate location (city), device and browser type, referring site, and a pseudonymous identifier from a cookie. Google Analytics 4 does not store your full IP address. We do not collect your name, email or other data that identifies you personally.
The legal basis is your consent (Art. 6(1)(a)). Until you give it, Google Analytics is not loaded at all. You can withdraw it at any time in the — as easily as you gave it.
Advertising with Google Ads — only with your consent
If you accept cookies, we also use the Google Ads tag. It tells us whether our Google ads lead to visits to the site, and lets us show our ads on Google and its advertising network to people who have been here before (remarketing). For this, Google sets advertising cookies and receives a pseudonymous identifier, the pages visited, your IP address and device data. It links them to its own profile of you, if you have one, under its own rules. We do not receive data that identifies you personally — we see aggregated statistics only.
The legal basis is your consent (Art. 6(1)(a)). Until you give it, the Google Ads tag is not loaded. If you withdraw it, we stop loading the tag and delete the advertising cookie on our domain. The ads Google shows you can also be managed in My Ad Center.
Street View from Google Maps — with consent or on click
The office maps on the Contacts page are plain images hosted by us (data © OpenStreetMap) — nothing is sent to a third party. Only the Street View panoramas on employer pages come from Google Maps. Until you accept cookies, a button stands in their place and nothing is sent to Google. If you accept, panoramas load on their own. If you decline, each one loads only when you press its button — that applies to that panorama alone and does not change your choice. When a panorama loads, Google receives your IP address and may set its own cookies. The legal basis is your consent (Art. 6(1)(a)).
4. Who receives the data
We do not sell personal data. Only providers that serve us and act on our instructions have access:
DigitalOcean (hosting) and Google Ireland Limited (Google Analytics, Google Ads and Google Maps — only if you consented). We
disclose data to public authorities only when the law requires it.
Google and DigitalOcean are US companies and may process data in the United States. The transfer
relies on the EU–U.S. Data Privacy Framework and the European Commission's standard contractual
clauses.
5. How long we keep data
- Server logs — up to 30 days.
- Google Analytics data — up to 2 months, then deleted automatically.
- Google Ads data — remarketing lists keep a visitor for up to 540 days; the rest is set by Google.
- Enquiry correspondence — up to 1 year after the last contact, unless it leads to a contract.
- Program contract data — for the periods required by tax and accounting law.
6. Your rights
At any time you can ask for: access to your data and a copy of it; correction of inaccurate data;
erasure; restriction of processing; portability; to object to processing based on legitimate
interest; and to withdraw consent, without affecting processing before the withdrawal.
Write to [email protected] — we reply within one month. If you believe we
process your data unlawfully, you may complain to the Bulgarian Commission for Personal Data
Protection: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, [email protected],
www.cpdp.bg.
7. Changes to this policy
If we change how we process data, we will update this page and the date at the top. For a material
change affecting cookies — such as a new purpose — we will ask for your consent again.