JCI Bulgaria Privacy Notice

Keeping your data protected

Effective Date: 4 September 2026
Last updated: 4 September 2026

Who is responsible for your personal data?

The controller of the personal data described in this Privacy Notice is:

JCI Bulgaria
26 Momina Sulza Str.
Aksakovo, Bulgaria

Email: contact@jci.bg
Website: www.jci.bg

Junior Chamber International Bulgaria (JCI Bulgaria) operates through local organisations. For the purposes of this Privacy Notice, references to JCI Bulgaria include its local organisations and authorised national and local officers where they process personal data on behalf of JCI Bulgaria.

This Privacy Notice applies to the JCI Bulgaria public website, including jci.bg, and to the JCI Bulgaria Members Platform, including members.jci.bg, as well as to membership applications and related membership administration.

JCI Bulgaria is committed to protecting your personal data and processing it lawfully, fairly and transparently.

Legal basis for processing personal data

JCI Bulgaria processes personal data in accordance with Article 6 of the General Data Protection Regulation (GDPR).

Depending on the particular processing activity, we may rely on one or more of the following legal bases:

Article 6(1)(b) GDPR – processing necessary to take steps at your request before entering into a membership relationship, or to administer an existing membership relationship;
Article 6(1)(c) GDPR – processing necessary to comply with a legal obligation;
Article 6(1)(f) GDPR – processing necessary for the legitimate interests of JCI Bulgaria, including administration of the organisation, communication with members and applicants, operation and security of our websites and Members Platform, fraud prevention, service improvement and maintenance of appropriate organisational records;
Article 6(1)(a) GDPR – your consent, where consent is specifically requested for an optional activity or communication.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Acknowledging that you have read this Privacy Notice does not, by itself, constitute consent where another legal basis applies.

What personal data do we collect?

The personal data we process depends on how you interact with JCI Bulgaria.

Website visitors

When you access our websites, certain technical information may be processed automatically, including:

browser type and version;
operating system and device information;
date and time of access;
pages visited;
referring pages or websites;
technical, performance and security information;
IP address or other network identifiers where technically necessary;
session or similar technical identifiers required for website or platform functionality.

Where possible, technical information may be minimised, anonymised or aggregated.

Technical data is not used by JCI Bulgaria for behavioural advertising.

Contact forms and enquiries

If you contact JCI Bulgaria, we may process information such as:

name;
email address;
organisation, where relevant;
the content of your message;
other information that you voluntarily provide.

We use this information to respond to your enquiry and manage our communication with you.

Membership applications

When you apply for membership in JCI Bulgaria, we process the information you provide in the membership application.

Depending on the application form and recruitment process, this may include:

name;
email address;
telephone number, where requested;
city or place of residence;
preferred or relevant JCI Local Organisation;
profession, occupation, studies or professional background;
interests, skills and experience;
motivation for joining JCI;
answers to membership application questions;
application status and recruitment history;
dates and administrative information relating to your application;
communication between you and the JCI team responsible for recruitment.

This information is used to review and manage your application, communicate with you and organise the appropriate next steps in the membership process.

Access to membership applications is limited to authorised JCI Bulgaria officers or members involved in the relevant recruitment and membership administration process.

Applicant Space and Member Space

When you create an account or receive access to the JCI Bulgaria Members Platform, we may process information necessary to provide and administer your account, including:

user identifier;
email address;
account and authentication information;
account status;
Local Organisation;
membership type;
membership status;
official membership dates;
application and membership history;
profile information;
platform preferences;
notification status and notification history;
activity, project, programme or position applications submitted through the platform;
administrative information necessary to provide access to relevant platform functionality.

Authentication credentials are handled through our authentication provider. JCI Bulgaria does not have access to your password in plain text.

Registration of existing JCI Bulgaria members

Existing JCI Bulgaria members may register for access to the JCI Bulgaria Members Platform without submitting a new membership application.

When an existing member registers, JCI Bulgaria may process information necessary to verify the person’s existing membership and create or activate their Member Space account. This may include:

name;
email address;
Local Organisation;
existing membership type and status;
official membership dates;
account and authentication information;
other information necessary to match the registration with JCI Bulgaria’s existing membership records.

This information is processed for the purpose of providing access to the Members Platform, maintaining accurate membership records and administering the member’s existing relationship with JCI Bulgaria.

Registration for the Members Platform does not constitute a new application for JCI membership.

Member profiles and community directory

Members may create or update a profile within the Members Platform.

Depending on the information voluntarily provided, a profile may include:

name;
profile photo;
Local Organisation;
membership information;
profession or professional background;
skills;
interests;
experience;
JCI roles and positions;
other information that the member chooses to add.

Certain profile information may be visible to other authenticated members through the JCI Bulgaria member directory.

Where the platform provides visibility settings, such as whether your identity is displayed in an “online now” list, these settings allow you to control the relevant visibility option.

Discover JCI and My JCI Journey

Discover JCI and My JCI Journey are optional personal exploration and development tools.

Discover JCI may use answers provided by you to suggest JCI opportunities, experiences or development paths that may be relevant to your interests.

My JCI Journey may allow you to create or receive a suggested development journey based on information that you provide and, where you choose to do so, information from your Discover JCI result.

These tools are separate from the membership application process.

Information created through Discover JCI or My JCI Journey is intended to remain personal to the user and is not automatically shared with the JCI recruitment team or used to make a membership decision, unless you explicitly choose to share relevant information.

If you complete Discover JCI before creating an account, some information may remain stored locally in your browser so that you can continue the experience later.

JCI Bulgaria does not use Discover JCI or My JCI Journey to make membership decisions based solely on automated processing.

Activities, opportunities and applications

Members may use the Members Platform to:

view activities and events;
explore projects and programmes;
view open positions or other opportunities;
submit applications or expressions of interest;
track application status.

Where you apply for an opportunity, the information you submit may be made available to authorised JCI officers or organisers responsible for managing that particular opportunity.

Notifications and membership communications

The Members Platform may send or display notifications relating to:

activities;
projects and programmes;
positions and opportunities;
membership administration;
membership status changes;
application status;
platform functionality;
other relevant JCI Bulgaria information.

We may also send transactional emails where necessary, including:

email address confirmation;
account activation;
membership application approval;
membership status changes;
password reset;
other important account or membership communications.

These operational communications are separate from optional marketing or promotional communications.

Purpose of processing

JCI Bulgaria processes personal data for purposes including:

operating and securing our websites and Members Platform;
responding to enquiries;
receiving and managing membership applications;
administering membership;
creating and maintaining Applicant and Member Spaces;
maintaining appropriate membership records;
enabling member profiles and community connections;
providing Discover JCI and My JCI Journey;
managing activities, projects, programmes and positions;
processing applications for opportunities;
sending relevant account, application and membership notifications;
providing technical support;
preventing misuse, fraud or unauthorised access;
improving the functionality and usability of our websites and platform;
complying with applicable legal obligations.

JCI Bulgaria does not sell personal data.

Cookies and browser storage

Our websites and Members Platform may use strictly necessary cookies or similar browser technologies where required for secure and functional operation.

The Members Platform may also use browser storage, including local storage, for purposes such as:

maintaining authentication and session information;
preserving a Discover JCI result in the browser;
remembering functional preferences;
maintaining temporary platform state.

These technologies are not used by JCI Bulgaria for behavioural advertising.

We may also use privacy-focused web analytics and performance tools to understand how our websites and platform are used and to identify technical or usability issues.

JCI Bulgaria uses Cloudflare Web Analytics for aggregate website analytics and performance monitoring.

JCI Bulgaria may also use its own platform analytics to understand aggregate page usage, interactions and platform performance. Such analytics are used for operational and service-improvement purposes and not for behavioural advertising.

How and where we store and process data

JCI Bulgaria uses appropriate technical and organisational measures to protect personal data.

Depending on the service involved, personal data may be processed through service providers supporting:

website and application hosting;
database services;
user authentication;
file storage;
transactional email delivery;
website and platform security;
analytics;
collaboration and document storage.

Current service providers may include Supabase, Cloudflare, Resend and Google.

Supabase

The JCI Bulgaria Members Platform uses Supabase for services including database functionality, authentication and related platform infrastructure.

The primary location of project data depends on the region selected for the JCI Bulgaria Supabase project. Certain supporting services or subprocessors may involve processing in other locations.

Google Workspace and Google Drive

JCI Bulgaria may use Google Workspace and Google Drive for organisational administration and secure document storage.

This may include information submitted through:

contact forms;
membership applications;
recruitment processes;
membership administration;
other organisational activities.

Membership application information may therefore also be stored in a secured Google Drive folder accessible only to authorised persons.

Google accounts and organisational storage are protected using appropriate account-security measures, including multi-factor authentication where applicable.

Resend

JCI Bulgaria uses Resend for transactional email delivery, including account, application and membership-related communications.

Email-related data may include recipient email addresses, message content and technical delivery information.

Resend may process and store data outside the European Economic Area. Where required, appropriate safeguards for international data transfers are used.

Cloudflare

Cloudflare may be used for website analytics, performance and security-related services.

Depending on the particular Cloudflare service used, information may be processed through Cloudflare’s global infrastructure.

International transfers

Some of the service providers used by JCI Bulgaria may process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA and the destination does not benefit from an applicable adequacy decision, JCI Bulgaria relies on appropriate safeguards where required, such as:

Standard Contractual Clauses approved by the European Commission;
recognised adequacy mechanisms;
the EU–US Data Privacy Framework where applicable;
other safeguards permitted under the GDPR.

JCI international platforms

Full Members may be invited to create an account on platforms operated by Junior Chamber International (JCI) at international level.

JCI Bulgaria does not normally create these accounts on behalf of members or directly submit members’ names, email addresses or account credentials for this purpose.

Members are generally asked to register themselves and provide the information required by the relevant JCI international platform.

Personal data submitted directly by a member to an international JCI platform is processed in accordance with the privacy information applicable to that platform.

How long do we keep your data?

JCI Bulgaria does not retain personal data longer than necessary for the purposes for which it was collected.

Different categories of information have different retention periods.

Website and technical data

Technical logs used for website functionality and security are generally retained only for a short period.

Information may be retained for longer where necessary to investigate a technical, security or abuse-related incident.

Contact enquiries

Information submitted through contact forms or direct enquiries may be retained for up to two years after the enquiry has been resolved, unless there is a legitimate reason or legal requirement to retain it for longer.

Membership applications

Information relating to an unsuccessful, withdrawn or incomplete membership application may be retained for up to 12 months after the recruitment process has ended or the application has been withdrawn.

This allows JCI Bulgaria to manage recruitment follow-up, respond to questions and maintain appropriate administrative records.

After this period, the information will be deleted or anonymised where appropriate, unless a longer retention period is required for:

compliance with a legal obligation;
establishment, exercise or defence of legal claims;
another justified organisational or legal reason.

Where an applicant becomes a member, relevant information from the application may become part of the person’s membership record and will be retained in accordance with the rules applicable to member information.

Member information

Information relating to active membership is retained for the duration of the membership relationship and for an appropriate period afterwards where necessary to:

administer membership history;
manage alumni status;
maintain organisational records;
resolve disputes;
establish, exercise or defend legal claims;
comply with legal obligations.

Alumni information

Where a former member becomes an Alumni member, relevant membership information may be retained for as long as necessary to administer the alumni relationship and maintain appropriate JCI organisational records.

Discover JCI and My JCI Journey

Information stored in a user account through Discover JCI or My JCI Journey may be retained while the account remains active or until the user deletes or resets the relevant information, subject to applicable account and membership-retention requirements.

Data stored only locally in the user’s browser may remain there until it is removed by the user, cleared by the browser or replaced by subsequent platform activity.

Security and authentication

JCI Bulgaria uses appropriate technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure or misuse.

These measures may include:

secure authentication;
restricted administrative access;
role-based permissions;
row-level database access controls;
encrypted communications;
access logging and monitoring;
secure service-provider infrastructure;
multi-factor authentication for administrative services where appropriate;
regular review of database, platform and security configuration.

No internet-based system can be guaranteed to be completely secure, but JCI Bulgaria takes reasonable steps to reduce and manage relevant risks.

Who may receive your personal data?

Depending on the purpose, personal data may be accessible to:

authorised JCI Bulgaria national officers;
authorised officers or members of the relevant Local Organisation;
persons responsible for recruitment or membership administration;
organisers or administrators responsible for an activity, project, programme or position to which you apply;
service providers processing data on behalf of JCI Bulgaria;
public authorities where disclosure is required by applicable law.

Access should be limited to what is necessary for the relevant role and purpose.

JCI Bulgaria does not sell or rent personal data to third parties.

What are your data protection rights?

Under the GDPR, you may have the following rights, subject to applicable conditions and exceptions:

Right to be informed – you have the right to receive information about how your personal data is collected and used.
Right of access – you may request access to personal data that JCI Bulgaria holds about you.
Right to rectification – you may request correction of inaccurate or incomplete personal data.
Right to erasure – you may request deletion of your personal data in certain circumstances.
Right to restriction of processing – you may request that processing be restricted in certain circumstances.
Right to object – you may object to certain processing based on legitimate interests.
Right to data portability – where applicable, you may request that personal data you provided be transferred to you or another organisation in a structured, commonly used and machine-readable format.
Right to withdraw consent – where processing is based on consent, you may withdraw that consent at any time.
Rights relating to automated decision-making – you have the right not to be subject to a decision based solely on automated processing, including profiling, where that decision produces legal effects or similarly significantly affects you, subject to the exceptions provided by law.

JCI Bulgaria does not use Discover JCI or My JCI Journey to make solely automated membership decisions with legal or similarly significant effects.

If you make a rights request, we will respond without undue delay and generally within one month of receiving the request, in accordance with the GDPR.

To exercise your rights, contact:

contact@jci.bg

Repeat or excessive requests

Where requests from a data subject are manifestly unfounded or excessive, particularly because of their repetitive character, JCI Bulgaria may, in accordance with Article 12(5) GDPR:

charge a reasonable fee reflecting the administrative cost of providing the information or taking the requested action; or
refuse to act on the request.

Privacy notices of other websites

JCI Bulgaria websites may contain links to third-party websites.

This Privacy Notice applies only to services operated by JCI Bulgaria.

If you follow a link to another organisation’s website or platform, you should review the privacy information applicable to that service separately.

Changes to this Privacy Notice

JCI Bulgaria keeps this Privacy Notice under regular review and may update it when our activities, services, technical systems or legal obligations change.

The current version will be published on this page.

Last updated: 4 September 2026

How to contact us

If you have questions about this Privacy Notice, the personal data JCI Bulgaria holds about you, or you would like to exercise a data-protection right, please contact:

JCI Bulgaria
Email: contact@jci.bg
Website: www.jci.bg

How to contact the supervisory authority

If you believe that JCI Bulgaria has not addressed your concern satisfactorily, you have the right to lodge a complaint with the competent supervisory authority:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia, Bulgaria

Tel: +359 2 915 3580
Email: kzld@cpdp.bg
Website: https://www.cpdp.bg