[ ] markers below are facts only you can confirm.
Search the file for class="pv-fill" to find them all. Delete this bar and the
.review CSS block before deploying.
Home / Privacy
Privacy · Candidate data · AI oversight
Plain answers about your data.
What we collect, why we are allowed to, how long we keep it, who ever sees it, and what our AI screening assistant does and does not decide. Written to be read, not scrolled past.
Privacy notice
Applies to everyone: candidates, clients, suppliers, and anyone who visits the site or writes to us.
Who we are.
Dreamwork Recruitment is a founder-led executive search and talent advisory practice based in Sofia, Bulgaria, working across the EU and the UAE.
For all personal data described on this page, the controller is [Legal entity name and form], entered in the Commercial Register of the Bulgarian Registry Agency under UIC [UIC], registered office [Registered address].
We are registered with the Bulgarian Employment Agency as an employment intermediary under certificate No. [Reg. no. and date].
There is no data protection officer. We are not required to appoint one, and the founder answers every request on this page personally.
How to reach us about data. Email kamen@dreamwork.bg, phone +359 89 995 6593, or write to the registered address above. Put "data request" in the subject line and we will treat it as one.
Who this covers, and when.
This notice applies when you:
- visit dreamwork.bg or any page on it
- apply for a dream job opportunity, send a CV, or set a job alert
- complete a screening conversation with Stella
- are approached by us as part of a search, including when you never applied for anything
- are named as a referee, or referred to us by someone else
- represent a client, prospective client, supplier or partner
- contact us by email, phone, WhatsApp, Viber, LinkedIn or a form on this site.
Where a particular form or tool needs to tell you something extra, a short notice appears at the point of collection. That notice adds to this one rather than replacing it.
We process personal data under Regulation (EU) 2016/679 (GDPR), the Bulgarian Personal Data Protection Act, the Bulgarian Employment Promotion Act and the Ordinance on employment mediation, and, for our AI screening, Regulation (EU) 2024/1689 (the EU AI Act).
What we process, why, and on what basis.
We collect what the work actually needs and nothing beyond it. What we hold depends entirely on how you came into contact with us.
| What we hold | Why | Legal basis | How long |
|---|---|---|---|
| Candidates who apply Name, contact details, CV, employment history, education, skills, languages, location and mobility, notice period, package expectations, interview and assessment notes, referee details you give us. |
Assessing you against a live brief, arranging interviews, giving feedback, presenting you to a client once you approve it, and running the mediation service. | Steps at your request before a contractArt. 6(1)(b)Legal obligation as a licensed intermediaryArt. 6(1)(c) | 12 months from last contact. Longer where the mediation record or a legal claim requires it. See §8. |
| Candidates we approach Name, current employer and role, career history, public professional profile, and the notes of our conversation. |
Identifying and approaching people who fit a search we are running, and keeping a record of who has asked not to be contacted again. | Our legitimate interest in providing search services, balanced against your rightsArt. 6(1)(f) | 12 months from the approach if you do not engage. Deleted sooner on request, always. |
| Stella screening The email address you leave, your answers on scope, seniority, location, availability, package and motivation, the full conversation transcript, and the scorecard produced from it. |
Running a structured first conversation, scoring against the actual brief, and routing you to a consultant with context already in hand. | Your consent, captured in the conversation before the first question and timestampedArt. 6(1)(a) | 12 months from the screening, then deleted automatically. Withdraw consent at any time and it goes immediately. |
| Job alerts Email address and the discipline you chose. |
Telling you when a matching dream job opportunity opens. | Your consentArt. 6(1)(a) | Until you unsubscribe, plus a suppression record so we do not email you again by mistake. |
| Client and prospect contacts Name, role, company, business contact details, the brief, correspondence, contract and billing details. |
Preparing proposals, running searches, managing the engagement, invoicing, and defending our position if a dispute arises. | Contract and pre-contractual stepsArt. 6(1)(b)Legitimate interest in business communicationArt. 6(1)(f) | The engagement plus the statutory accounting and limitation periods. See §8. |
| Meetings, calls and appointments Your name, email, phone number if you give it, the meeting time and any note you add when booking. Audio and video during a Google Meet call. |
Arranging and holding consultations with clients and interviews with candidates, using Google Calendar and Google Meet. | Steps at your requestArt. 6(1)(b)Legitimate interest in arranging and holding the meetingArt. 6(1)(f) | [Confirm: calendar entries kept 24 months, like other correspondence] |
| Enquiry forms and correspondence Whatever you put in the message, plus the metadata around it. |
Answering you. | Steps at your requestArt. 6(1)(b)Legitimate interest in respondingArt. 6(1)(f) | 24 months, or longer if it becomes part of an engagement or candidate record. |
| Website statistics A pseudonymous device identifier, the pages you view, approximate location and device type, collected by Google Analytics 4 only after you accept Statistics. |
Knowing which roles, services and whitepapers people read, so we can improve them. | Your consent, given in the cookie bannerArt. 6(1)(a) | [14 months, as set in Google Analytics]. Withdraw consent in Cookie settings at any time. |
| Site and security data IP address, browser and device, pages requested, timestamps, referring URL, error and security logs, and the result of the anti-spam check on our forms. That check runs on this site and sends nothing to a third party. |
Serving the site, keeping the forms usable, blocking automated abuse, and diagnosing faults. | Legitimate interest in operating and securing the siteArt. 6(1)(f) | Up to 12 months in server and security logs. |
| Accounting records Invoices, payment records, contracts and the identifying details on them. |
Meeting our tax and accounting obligations. | Legal obligationArt. 6(1)(c) | The period required by the Bulgarian Accountancy Act. |
What happens if you do not give us something
Required fields are marked on every form. Without the data a service needs, we cannot deliver that service. Without a CV or an equivalent record of your experience we cannot present you to a client. Without an email address Stella cannot return your scorecard. Everything not marked as required is genuinely optional, and leaving it blank costs you nothing.
Where your data comes from.
Most of it comes from you. The rest comes from four places, and you are entitled to know which.
- Public professional sources. Company websites, professional networks including LinkedIn, public registers, conference and speaker listings, and published market information. This is how executive search works: we map a market before we approach anyone in it.
- Job platforms. Where you applied through a third-party board, that platform passes us your application.
- Referrals. A colleague, a former manager or a contact recommends you. We will tell you who, if you ask.
- Referees you nominate. Only after you have given us their details and told them to expect us.
If we found you rather than the other way round. GDPR Article 14 says we owe you this notice within one month of collecting your data, or at our first contact with you, whichever comes first. In practice that means the first message we send you links here. At that point you can ask us what we hold, where we got it, and to delete all of it. We act on that immediately and add you to a suppression list so no future search surfaces you again.
What not to send us.
Please keep the following out of your CV and out of any form on this site, unless a specific role legally requires it and we have asked you for it in writing:
- Your EGN or personal identification number, ID card or passport number, or any scan of an identity document.
- Health information, disability status or medical certificates.
- Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership.
- Genetic or biometric data, or anything about your sex life or sexual orientation.
- Criminal convictions or offences.
- Bank details. We will never ask a candidate for them.
We do not seek this information and we have no use for it in a search. If it arrives unrequested we remove it from the record rather than store it. A photograph on a CV is your choice and carries no weight in any assessment we make.
Where a role genuinely requires something in this list, we will tell you why, ask separately, and rely on your explicit consent under Article 9(2)(a) or another applicable ground.
Who your data reaches.
We do not sell personal data. We have never bought a candidate list and we do not intend to.
- Client employers, and only for a specific role. Your profile does not go to a client until you have approved that presentation in writing, and we name the client to you before you decide.
- Service providers that run our infrastructure, listed by name in §19.
- Professional advisers such as our accountant and, if needed, a lawyer, under confidentiality.
- The Bulgarian Employment Agency and other competent authorities, where the law requires disclosure.
- Courts and regulators, where we are compelled or where we need to establish or defend a legal claim.
If the practice were ever sold or merged, personal data would transfer to the acquirer under confidentiality obligations, and we would tell you before it happened.
Sending data outside the EEA.
Your data is processed inside the European Economic Area by default. Two things take it outside, and both are deliberate.
UAE placements
We run searches for clients in the United Arab Emirates. If you approve a presentation to a UAE employer, your profile goes there. The UAE has no European Commission adequacy decision. That transfer relies on Article 49(1)(b), because it is necessary to perform the mediation you asked us to carry out, and it happens only with your specific written approval for that role.
Technology providers
Some of the providers in §19 are established in the United States or process data there. Those transfers are covered by the European Commission's Standard Contractual Clauses, together with the supplementary measures we assessed as necessary, and by the EU-US Data Privacy Framework where the provider is certified under it.
Ask us at kamen@dreamwork.bg and we will tell you which mechanism covers a specific provider.
How long we keep it.
Nothing is kept indefinitely. Where the law fixes a period we follow it. Where it does not, we set one and hold to it.
| Record | Period | Why this period |
|---|---|---|
| Candidate record, no mediation contract | 12 months from last contact | Long enough to be useful to you on the next role, short enough that a stale CV is not sitting in a database you have forgotten about. |
| Candidate record, extended by consent | Up to 36 months | Only if you ask us to keep you on file for longer. We ask before the 12 months expire rather than assuming. |
| Employment mediation contract and register entry | [5 years / confirm] | Fixed by the Ordinance on employment mediation. We cannot shorten it and a deletion request does not override it. |
| Stella transcripts and scorecards | 12 months | Long enough that we can explain or re-run any assessment you challenge. Deleted automatically after that. |
| Placement records | Duration of any guarantee period, plus the limitation period | Placement guarantees and fee disputes both run on the contract. |
| Accounting and tax records | As required by the Accountancy Act | Statutory. Not negotiable. |
| Marketing consent and job alerts | Until withdrawn | Plus a minimal suppression record, so an unsubscribe actually sticks. |
| Server and security logs | Up to 12 months | Security diagnostics and abuse investigation. |
When a period ends, the record is deleted or irreversibly anonymised. Electronic data is removed so it cannot be reconstructed. Paper, which we hold almost none of, is shredded.
How we protect it.
We are a small practice and our security posture is built for that: fewer systems, fewer people, fewer places your data can be.
- Encryption in transit across the whole site and in the systems we use.
- Access limited to the founder and, where an engagement requires it, a named associate under a written confidentiality undertaking.
- Multi-factor authentication on every account that touches candidate data.
- Credentials stored in a password manager, never in project folders, never in email.
- Written data processing agreements with the providers in §19.
- Deletion requests logged, so we can prove a deletion happened and when.
- Automated abuse protection on forms, so the CV inbox stays readable.
No system connected to the internet is perfectly secure, and anyone who claims otherwise is selling something. If you think an account or a document of yours has been exposed, tell us and we will act the same day.
If something goes wrong.
If a personal data breach occurs and it is likely to risk your rights and freedoms, we notify the Commission for Personal Data Protection without undue delay and within 72 hours of becoming aware of it. If the risk to you is high, we contact you directly and tell you what happened, what data was involved, what we have done, and what you should do.
We keep an internal record of every incident, including those we assess as not notifiable, and the reasoning behind that assessment.
Your rights.
Email kamen@dreamwork.bg. Quote your screening reference or just the email address you used. You do not need a form, a legal basis, or a reason.
Access
A copy of everything we hold on you, plus where it came from and who has seen it.
Rectification
Anything wrong corrected, anything missing completed.
Erasure
The record deleted. The deletion itself is logged.
Restriction
Processing frozen while a dispute about accuracy or legitimate interest is resolved.
Portability
What you gave us, in a structured machine-readable file.
Objection
To anything we do on legitimate interests. To direct marketing, unconditionally, and we stop.
Withdraw consent
At any time. It does not undo what was lawful before you withdrew.
Human review
Any AI-assisted assessment re-done by a person. See §16.
We answer within one month. It is usually the same week. For an unusually complex or repetitive request we may extend by two further months, and we will tell you why before the first month is up. We may ask for enough information to be sure it is you, and no more than that. Requests are free unless they are manifestly unfounded or excessive, which has not yet happened.
Where a statutory retention period applies to a record, we will tell you which one blocks a deletion rather than simply refusing.
Complaints.
Come to us first. If that does not resolve it, you have the right to complain to the Bulgarian supervisory authority, or to the one where you live or work.
Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria
+359 2 915 3580 · kzld@cpdp.bg · cpdp.bg
Under-18s.
Our services are for adults in the labour market. We do not knowingly collect data from anyone under 18 and no part of this site is directed at children. If you believe a minor has submitted data to us, tell us and we will delete it.
Changes to this notice.
We update this page when the service, the technology or the law changes. The version number and date at the top always reflect the current text. Where a change materially affects processing already under way, we contact affected people directly rather than relying on you noticing a new date.
Candidate notice
Everything above applies to you. This section is what changes when the person in the record is a candidate.
If you are a candidate.
Nothing moves without you
Your profile does not reach a client until you have approved that specific presentation in writing, and we name the client to you first. There is no scenario in which you find out afterwards that your CV was sent somewhere. We do not mass-mail CVs to a client list, and we do not post speculative adverts to harvest applications.
You hear back either way
Including when there is nothing suitable. Every declined candidate receives written feedback within 48 hours. That is a service commitment rather than a legal one, but it is why we hold assessment notes: so the feedback is specific instead of a template.
What we hold on you
Set out in full in §3. In summary: your contact details, your CV and what it contains, what you told us about scope, mobility, availability and expectations, our notes from conversations and assessments, the roles you were considered for, and the outcome.
Assessment notes are your data too
An access request reaches our internal notes about you, not only the CV you sent. Where a note contains information about a third party, we redact that part and disclose the rest rather than refusing the whole request.
Confidentiality of your search
If you are in a confidential process, we do not confirm to anyone, including your current employer, that you are talking to us. Approaches are discreet by default.
How to be forgotten
One email deletes you: kamen@dreamwork.bg. We remove the record, log the deletion, and add a suppression entry so a future market map does not surface you again. Where a signed mediation contract exists, the statutory record stays for its fixed period and we will tell you exactly which record and which period.
Submitting an application does not create a contract. It does not commit us to progressing you and it does not commit you to anything. It starts a conversation.
AI screening and human oversight
What Stella is, what she is not, and the decision she has no mechanism to make.
Stella, and the decision she cannot make.
Stella is our AI screening assistant. She runs the structured first conversation, asks the same competency-anchored questions of every candidate on a given dream job opportunity, and produces a scorecard with the evidence behind each dimension. She is a tool a consultant uses. She is not a gatekeeper.
A separate step, never on this website. Stella does not run on dreamwork.bg and nothing on this site screens you. Where we use her, it is as a distinct stage of a specific search: we tell you in advance, send you a separate invitation, and you choose whether to take part. Everything below applies only if you accept that invitation.
You are told before the first question
Stella identifies herself as AI before asking you anything, as Article 50 of the EU AI Act requires. You can decline and speak to a person instead, and it costs you nothing in the process.
She never rejects anyone
The system has no mechanism for an automated rejection. Advancing, holding, declining and presenting are all decisions made by a named consultant who reads the record. Because no decision producing legal or similarly significant effects is taken solely by automated means, Article 22 GDPR is not engaged. We built it this way deliberately, and we would rather be slower than delegate that call.
Your rights inside the conversation
- Type "speak to a person" at any point. The screening stops there and routes to a human.
- Ask for the reasoning behind any score you were given.
- Ask for the whole assessment to be re-done by a person, with no reference to the AI scorecard.
- Ask for the transcript and scorecard to be deleted. We do it and confirm.
What we log, and why
Every conversational turn, the model and prompt version that produced each score, and every human review. That log exists so any assessment can be explained and reproduced if you challenge it. Without it, "a human reviewed this" would be an assertion rather than a record.
Your data does not train anyone's model
Screening content is sent to our language model provider to generate the response you see and the scorecard the consultant reads. It is not used to train or fine-tune models, under the terms of our agreement with that provider. We do not use candidate data to train models of our own.
What Stella does not do
- No emotion recognition. No voice or facial analysis. No inference about your mood, confidence or personality.
- No biometric categorisation. Both practices are prohibited in employment contexts under Article 5 of the EU AI Act, and we would not want them regardless.
- No scoring on protected characteristics, and no proxies for them.
- No video or audio recording. Stella is a text conversation.
Where this sits under the EU AI Act. AI used to filter applications and evaluate candidates falls in Annex III(4). We treat Stella as a high-risk system for planning purposes and are building against those requirements. Following Regulation (EU) 2026/1744, the Digital Omnibus on AI, the high-risk obligations for Annex III systems apply from 2 December 2027. The Article 50 transparency duties applied from 2 August 2026 and were not deferred. We meet them now.
Site, clients and suppliers
The technology behind the page you are reading, and the data we hold on the business side.
Clients, prospects and suppliers.
If you represent a company that hires us, is considering it, or supplies us, we hold your business contact details, the correspondence between us, the brief and its constraints, and the contractual and billing record.
We use it to prepare and deliver the work, to invoice, to keep in touch about the engagement, and to protect our position if a dispute arises. The basis is contract, our legitimate interest in running a business relationship, and legal obligation for the accounting side.
Where we send you commercial information about our services, it is on the basis of your consent or, where the applicable electronic communications rules allow it for an existing business relationship, our legitimate interest. Either way, one reply saying stop is enough, and every email carries an unsubscribe link.
Search briefs are confidential. We do not name a client to a candidate until you have agreed to it, and confidential replacements and unnamed market entries are ordinary practice here.
Who processes data for us.
Every provider below acts under a written data processing agreement and processes only what the service requires.
| Provider | What it does | Data involved | Where |
|---|---|---|---|
| SuperHosting.BG [confirm entity] | Website hosting and delivery | Server and security logs, IP addresses | [EU / confirm] |
| Google Analytics 4 | Website statistics, only after you accept Statistics | Pseudonymous device identifier, pages viewed, approximate location. No form content. | [Confirm: Google Ireland Ltd, EU-US Data Privacy Framework] |
| Google Workspace Gmail, Drive, Sheets, Apps Script |
Email, form processing, CV file storage, candidate and pipeline records, transcripts | Everything in §3 that reaches a form, an email or a file | [Confirm data region] |
| Google Calendar | Booking consultations and interviews, invitations and reminders | Name, email, phone number if you give it, meeting time, any note you add | [Confirm data region] |
| Google Meet | Video consultations and interviews | Name, email, audio and video during the call. [Confirm: calls are not recorded or transcribed unless we ask first and you agree] | [Confirm data region] |
| Anthropic PBC | Language model behind Stella | Screening conversation content and the brief it is scored against | US, under Standard Contractual Clauses |
| [Accountant] | Bookkeeping and statutory filing | Invoice and contract data | Bulgaria |
How Google handles this data
Google Workspace, including Gmail, Drive, Sheets, Calendar and Meet, runs under our business agreement with Google. For these services Google acts as our processor under the Google Cloud Data Processing Addendum. It handles the data on our instructions and does not use it for advertising. [Confirm the addendum is accepted: Admin console, Account, Legal and compliance]
Google Analytics works differently. Google describes its own use of that data in How Google uses information from sites or apps that use our services.
If you join a Google Meet call or open a booking page while signed in to your own Google account, Google’s Privacy Policy also applies to that account.
Google may process data outside the EU. Where it does, it relies on the European Commission’s standard contractual clauses and on its certification under the EU-US Data Privacy Framework.
This list changes as the toolset changes. Ask at kamen@dreamwork.bg for the current version and the transfer mechanism covering any provider on it.
One more thing.
This notice is written in plain language on purpose. Legalese is easy to write and hard to hold anyone to. Everything above is a commitment we intend to keep, and if any part of it is unclear, ask and we will explain it rather than pointing at a clause.
It is general information about how we work, not legal advice. Dreamwork Recruitment remains responsible for compliance in every jurisdiction it operates in.