Introduction
NN Translations EOOD is committed to protecting the privacy and security of personal data relating to our clients, prospective clients, Specialist Network Members, business partners, website visitors and, where applicable, participants involved in Linguistic Validation and other patient-facing research activities.
This Privacy Policy explains how we collect, use, store, protect and disclose personal data when you interact with NN Translations EOOD, use our website or services, apply to join our specialist network, participate in relevant project activities, or communicate with us directly or through third-party platforms.
For the purposes of this Privacy Policy, “Specialist Network Members” may include freelance linguists, Linguistic Validation consultants, clinicians, clinical research professionals, reviewers and other independent specialists engaged or considered for project work. “Business Partners” may include specialist service providers, testing organisations, recruitment partners and other organisations with which we collaborate in delivering our services.
Who We Are
NN Translations EOOD is a specialist life sciences company supporting organisations across clinical research, COA/eCOA, pharmaceuticals, medical devices and IVDs.
Our services include COA Planning & Consulting, COA Licensing & Management Support, Linguistic Validation, eCOA Migration & Support, Medical & Regulatory Translation, IFU Content Optimisation & Regulatory Support, and Readability & Usability Testing.
We work with an international network of specialist linguists, Linguistic Validation consultants, clinicians, clinical research professionals, regulatory consultants and other qualified specialists and partner organisations according to project requirements.
For the purposes of applicable data protection legislation, NN Translations EOOD may act as a data controller or, in certain project contexts, as a data processor acting on behalf of a client or another controller. The applicable role depends on the circumstances and the processing activity concerned.
What Is Personal Data
Personal data means any information relating to an identified or identifiable natural person. A person may be identified directly or indirectly, including by reference to a name, identification number, contact information, location data, online identifier or other information relating to that person’s identity.
For Specialist Network Members and applicants, personal data may also include professional information such as CVs, qualifications, references, language combinations, areas of expertise, professional memberships, availability, rates and project-performance information.
Our Commitment to Your Privacy
We process personal data in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable Bulgarian data protection legislation.
We seek to collect and process only the personal data reasonably necessary for the relevant purpose and apply appropriate technical and organisational measures to protect it.
Information We Collect
The categories of personal data we collect depend on your relationship with NN Translations and the way in which you interact with us.
Identity and Professional Information
For clients, prospective clients, Specialist Network Members, applicants and business contacts, this may include name, title, job title, employer or organisation and other professional identification information.
For Specialist Network Members and applicants, this may also include CVs, academic and professional qualifications, certifications, references, language combinations, areas of specialisation, professional memberships, experience, availability, rates and project-performance information.
Contact Information
This may include business or billing address, email address, telephone number and other contact details provided to us.
Financial and Transaction Data
Where applicable, this may include bank-account or other payment information, invoices, payment records and information relating to services purchased from or provided to NN Translations.
Technical and Usage Data
When you use our website, we may collect technical information such as your IP address, browser type and version, device and operating-system information, time-zone information and information about how you interact with our website.
Marketing and Communications Data
This may include your preferences concerning communications, newsletters and marketing, together with records of relevant communications with us.
Project-Related Data
Where necessary for the performance of our services, we may process personal data contained in project materials supplied by clients or other authorised parties. Where NN Translations processes such data on behalf of a client or another controller, we process it in accordance with the applicable contractual arrangements and documented instructions.
Participants in Linguistic Validation and Patient-Facing Research
For certain Linguistic Validation and patient-facing research activities, including Cognitive Debriefing interviews, participants may be recruited through patient organisations, healthcare institutions, healthcare professionals or other authorised recruitment partners.
Where participant contact details are provided to NN Translations EOOD, the recruiting partner is responsible for ensuring that the appropriate legal basis for collecting and disclosing those details is in place, including obtaining informed consent where consent is relied upon as the applicable legal basis.
NN Translations EOOD does not request or retain copies of individual informed consent forms obtained through this recruitment process. The original informed consent documentation remains with the recruiting partner in accordance with its applicable legal, data protection and document-retention obligations.
For Cognitive Debriefing interviews conducted under this process, NN Translations EOOD receives only the minimum contact information necessary to organise and conduct the interviews, namely the participant’s first name, telephone number and email address, as applicable.
These contact details are used solely for arranging and conducting the relevant interviews and are handled confidentially in accordance with applicable data protection requirements.
Before participating in a Cognitive Debriefing interview, participants receive a Participant Information Sheet explaining the purpose of the project, the interview process, the conditions of participation and participant remuneration, where applicable.
Under this process, NN Translations EOOD does not collect further personally identifiable information during the Cognitive Debriefing interview, and deliverables provided to clients are anonymised and contain no personally identifiable information.
Special Categories of Personal Data
NN Translations does not intentionally request special-category personal data through its general website, enquiry, client-contact or Specialist Network registration processes unless such information is necessary for a specific lawful purpose.
Certain projects in the clinical research, Linguistic Validation or patient-facing research context may involve information relating to health or other special categories of personal data. Where such processing occurs, it will be handled in accordance with the applicable legal basis, contractual arrangements, data-protection requirements and the respective responsibilities of the parties involved.
How We Collect Personal Data
Direct Interactions
You may provide personal data when you:
- request information about or purchase our services;
- contact us regarding a prospective project or collaboration;
- apply to join our Specialist Network;
- provide professional information required for qualification, onboarding or project assignment;
- subscribe to our newsletter or other publications;
- request communications from us;
- provide feedback or respond to a survey; or
- otherwise communicate with us.
Automated Technologies
As you interact with our website, we may automatically collect certain Technical and Usage Data through cookies, server logs and similar technologies.
For more information, please refer to our Cookie Policy.
Third Parties and Public Sources
We may receive relevant personal data from:
- providers of IT, hosting, analytics, payment or other technical services;
- clients, prospective clients and business partners where necessary for project delivery;
- patient organisations, healthcare institutions, healthcare professionals or other authorised recruitment partners in accordance with the participant process described above;
- professional platforms and publicly accessible professional profiles, such as LinkedIn;
- industry directories or professional databases, where appropriate; and
- other authorised sources where there is a lawful basis for obtaining and processing the information.
How We Use Your Personal Data
We process personal data only where we have an appropriate legal basis.
To Perform a Contract or Take Steps Before Entering Into a Contract
- responding to enquiries and preparing quotations or proposals;
- processing and delivering agreed services;
- managing payments, fees and charges;
- registering and onboarding clients and Specialist Network Members;
- evaluating professional qualifications and suitability for assignments;
- assigning and coordinating project work;
- managing project communications and deliverables; and
- managing our contractual relationship with you.
To Comply With Legal Obligations
We may process personal data where necessary to comply with applicable legal, accounting, tax, regulatory or other statutory obligations.
For Our Legitimate Interests or Those of a Third Party
Where appropriate, we may process personal data for legitimate business interests, provided that those interests are not overridden by your rights and freedoms. This may include:
- administering and protecting our business, systems and website;
- maintaining appropriate business and project records;
- improving our services, workflows and client experience;
- managing business and professional relationships;
- assessing Specialist Network Member qualifications, availability and performance;
- maintaining appropriate quality-management and audit records;
- preventing fraud, misuse or security incidents; and
- conducting appropriate business-to-business communications and business development activities where permitted by applicable law.
With Your Consent
Where consent is the appropriate legal basis, we may process your personal data for purposes such as certain marketing communications or other activities for which your consent has been requested.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Marketing Communications
We may send you information about our services, resources, events or publications where we have an appropriate legal basis to do so.
Where consent is required, we will obtain it before sending the relevant marketing communication. Where applicable law permits business-to-business communications on another legal basis, we will provide an appropriate means of opting out.
You may unsubscribe from marketing communications at any time by using the unsubscribe mechanism provided in the communication or by contacting us.
Sharing Your Personal Data
We may share personal data where reasonably necessary with:
- IT, hosting, software and system-administration providers;
- professional advisers, including lawyers, accountants, auditors, insurers and banking providers;
- qualified Specialist Network Members and subcontractors where access is necessary for project delivery and subject to appropriate confidentiality and data-protection obligations;
- specialist business partners, testing organisations or other service providers involved in an agreed project, where appropriate;
- competent regulatory, governmental, judicial or other public authorities where disclosure is required by law;
- third parties involved in a potential sale, transfer, restructuring or merger of all or part of our business; and
- prospective or existing clients, where information concerning a Specialist Network Member’s qualifications or professional experience is required for project qualification or compliance and where disclosure is authorised and subject to appropriate confidentiality safeguards.
We require third parties processing personal data on our behalf to protect it appropriately and to process it only for authorised purposes.
International Data Transfers
Because NN Translations operates internationally and works with clients, specialists and service providers in multiple countries, certain personal data may, where necessary, be transferred outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we apply appropriate safeguards as required by applicable data protection legislation. Depending on the destination and circumstances, these may include:
- a European Commission adequacy decision;
- European Commission-approved Standard Contractual Clauses;
- the EU-U.S. Data Privacy Framework where applicable to an eligible participating organisation; or
- another lawful transfer mechanism recognised under applicable data protection legislation.
Where appropriate, additional safeguards may also be applied having regard to the nature of the data and the circumstances of the transfer.
Data Security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access.
Access to personal data is restricted to employees, contractors, Specialist Network Members and other authorised parties who have a legitimate need to access the information and who are subject to appropriate confidentiality obligations.
We maintain procedures for responding to suspected personal-data breaches and will notify affected individuals and/or the competent supervisory authority where required by applicable law.
Security Measures
Depending on the systems and processing activities concerned, our measures may include:
- appropriate access controls and user permissions;
- secure transmission and storage measures;
- data minimisation;
- confidentiality obligations;
- periodic review of security and data-protection procedures;
- staff training and awareness; and
- appropriate backup, business-continuity and incident-response procedures.
Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, contractual, quality-management, audit or reporting requirements.
When determining an appropriate retention period, we consider the nature, amount and sensitivity of the data, the purposes for which it is processed, applicable contractual requirements, potential risks arising from unauthorised use or disclosure, and applicable legal requirements.
Different retention periods may therefore apply to client records, project records, Specialist Network information, financial documentation, website information and participant contact information.
Where personal data is no longer required, it will be securely deleted, destroyed or anonymised, subject to applicable legal, contractual and quality-record retention requirements.
Cookies and Website Technologies
Our website may use cookies and similar technologies necessary for its operation and, where applicable, for analytics, functionality or marketing purposes.
Where required by applicable law, non-essential cookies will be used only after the appropriate consent has been obtained. Users can manage applicable cookie preferences through the cookie-consent mechanism available on our website.
Further information about the cookies and technologies used on our website is available in our Cookie Policy.
Your Legal Rights
Under applicable data protection legislation, and subject to the conditions and limitations provided by law, you may have the following rights:
- Right of access – to request information about the personal data we process about you and obtain a copy where applicable.
- Right to rectification – to request correction of inaccurate or incomplete personal data.
- Right to erasure – to request deletion of personal data in circumstances where the law provides this right.
- Right to object – to object to certain processing based on legitimate interests and to object at any time to processing for direct-marketing purposes.
- Right to restriction of processing – to request restriction of processing in circumstances provided by law.
- Right to data portability – where applicable, to receive personal data you have provided to us in a structured, commonly used and machine-readable format or request its transfer to another controller.
- Right to withdraw consent – where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
- Right to lodge a complaint – to lodge a complaint with the competent data protection supervisory authority if you believe that your personal data has been processed in violation of applicable data protection law.
For NN Translations EOOD as a Bulgarian organisation, the competent supervisory authority is the Commission for Personal Data Protection (CPDP), subject to the rules governing the competent supervisory authority in individual cases.
Glossary of Terms
Personal Data
Any information relating to an identified or identifiable natural person.
Processing
Any operation or set of operations performed on personal data, including collection, recording, organisation, storage, alteration, retrieval, consultation, use, disclosure, restriction, erasure or destruction.
Controller
The natural or legal person, public authority, agency or other body that determines the purposes and means of processing personal data.
Processor
A natural or legal person, public authority, agency or other body that processes personal data on behalf of a controller.
Special Categories of Personal Data
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, genetic data, biometric data processed for uniquely identifying a person, data concerning health, or data concerning a person’s sex life or sexual orientation, as defined by applicable data protection legislation.
Updates to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes to our business activities, website, data-processing practices or applicable legal and regulatory requirements.
Where appropriate, material changes will be communicated through our website or by other appropriate means.
The date of the latest revision will be displayed at the bottom of this Privacy Policy.
Contact Us and Exercising Your Rights
NN Translations EOOD
UIC: 203333535
If you have questions about this Privacy Policy, wish to exercise your data-protection rights or have a concern about how your personal data is processed, please contact us:
Email: info@nntranslations.com
Phone: +359 878 690 333
Address: 26A Smarch street, floor 4, app. 22, 1000 Sofia, Bulgaria
We will respond to requests in accordance with the timeframes and requirements established by applicable data protection legislation.
Last updated: 24.08.2026