We at Dimitrov, Petrov & Co. Law Firm (Dimitrov, Petrov & Co./ Law Firm/we) are aware of our responsibility to you – our clients, partners and those who use our website and internet resources, to provide you not only with quality legal services, but also to protect your information in the course of our relationship.
With this Personal Data Protection Policy when using the website and the Internet resources of Dimitrov, Petrov & Co. Law Firm (the Policy), we would like to inform you about how we process and protect your personal data when you use the information services and resources available on our website http://www.dpc.bg/ (the Website) and on our corporate profiles in various social networks. Please read this Policy carefully to understand how we collect, store, and otherwise process your personal data in this context and what your rights in relation to this processing are. The Personal Data Protection Policy of Dimitrov, Petrov & Co. Law Firm available [here] is applicable with respect to the personal data we process in relation to the provision of our legal services and assistance, as well as regarding the relationships we have with our business partners.
With regards to the processing of personal data of persons who apply for a job with us, this Policy applies in addition to our Privacy Notice for Job Applicants and Participants in Recruitment Processes available on the Website.
This Policy also does not apply to the processing of personal data performed by various third parties to whose websites/platforms/applications, etc. you have been redirected from the Website. Such third parties should have their own privacy policies available on their websites/platforms/applications, etc., which we recommend that you read before using the respective service/resource.
I.
Who are we?
We are Dimitrov, Petrov& Co. Law Firm, with partners George Georgiev Dimitrov, Bogdan Kostadinov Petrov, Alexander Todorov Todorov, Hristo Ivanov Nihrizov, Zoya Nikolaeva Todorova, Boyana Asenova Milcheva, Desislava Emilova Krasteva-Doncehva, and Pencho Kanchev Stanchev, entered in the Unified Register of Law Firms at the Supreme Judicial Council, registered with a court decision under company file 6082/2005 in the company registry of Sofia City Court, BULSTAT 131433772, VAT number BG 131433772, having its seat and registered address in Sofia, 28 Todor Alexandrov Blvd., floors 6 and 7, Bulgaria, with e-mail address: gdpr@dpc.bg.
As a personal data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the Regulation/GDPR), we process your personal data in accordance with applicable law and the rules and principles set out in this Policy.
II. Persons whose data we process
In relation to the management and maintenance of our Website, the provision of information resources on it and on our corporate social media profiles, and the communication with anyone who comes into contact with us, we may process information about the following categories of individuals (Data Subjects/You):
III. Categories of personal data we process
1. Data related to correspondence or other type of interaction you have with us: When you contact us with inquiries, requests or other communication, incl. via the contact form on the Website, when you apply for a job with us using the special form on the Website, as well as when you interact with our corporate profile or page in various social networks or thorough another communication channel (mail, e-mail, telephone, etc.), we may process the following types of personal data relating to you:
a) Data related to correspondence/ communication with us via the Website contact form, by e-mail, telephone, at our contact address, etc.
When you contact us, we may process the following types of data relating to you: name and surname; telephone; e-mail address; postal address, city/town; occupation; institution/ organisation you represent/ you are employed at; information on the way you have found about us and our services; unstructured information you provide in your message/inquiry; information about third parties contained in the messages/inquiries/ requests you have sent us; information contained in subsequent correspondence/ communication between you and Dimitrov, Petrov and Co.; data related to the receipt of initial and subsequent correspondence with us, such as time log (date / time) and source (IP address) of the respective correspondence, channel through which the correspondence was made, etc.; additional information collected or created in relation to the processing, status and final outcome of the relevant correspondence.
When the communication addressed to or made with us via the Website contact form, by e-mail or telephone, contains data and information about you and/or third parties which data and information are provided to us in the context of an inquiry for legal services and assistance or other type of cooperation related to the professional activity of Dimitrov, Petrov and Co., we will process such data in accordance with the rules and principles set out in this Policy, as well as in our Personal Data Protection Policy of Dimitrov, Petrov & Co. Law Firm.
b) Data related to the submission of a job application
In the ‘Careers’ section, which is part of the Website resources, you have the opportunity to find out about the specific open positions at Dimitrov, Petrov and Co., as well as to apply for a certain position. When applying for an open position, we may process the following types of data relating to you: names; e-mail address; telephone; position applied for; unstructured information which you would like to provide us with in relation to your application; information and data contained in documents attached to your application (e.g., CV, cover letter, etc.); information related to the processing of your application and the outcome.
We will process this data in accordance with the rules and principles set out in our Privacy Notice for Job Applicants and Participants in Recruitment Processes, available on the Website. For more information on the purposes, legal grounds and terms applicable to the processing of this data, please refer to the said Notice.
c) Data related to any interaction on your part with our corporate profile or page in various social networks
In order to promote our activity and the services we provide, we may maintain corporate profiles/ pages in various social networks (such as Facebook, Twitter, LinkedIn, Xing, etc.). When you interact with our corporate profiles/ pages in such social networks (e.g., by liking, sharing or other forms of interaction with the content published by us – depending on the functionalities of the respective social network), we may receive information about you in accordance with your privacy settings in the respective social network, such as: names; username; information from your profile on the relevant social network (e.g., photo, gender, age or age range, language, country, list of friends, list of liked/ followed pages, etc.); other information you have given us access to and which the social network you use provides us with;information contained in and related to the initial and subsequent communication with us through the functionalities of the relevant social network.
The social networks referred to above are not maintained by us and the processing of personal data by them is not under our control. The persons maintaining the relevant social networks have different rules and procedures for the protection of your personal data, including the collection of information through tools such as cookies, therefore, we recommend that you carefully read their rules and policies.
d) Data related to receiving marketing messages, newsletters, etc. sent by us
When you subscribe to receive any type of communication/correspondence sent by us (e.g., marketing messages, newsletters, etc.), we will process the data provided by you in relation to this subscription. Such data may include: names; e-mail address; other data related to your occupation, profession or interests (if applicable); your preferences regarding the frequency of receiving the relevant communication and its content, etc. The specific types of data we may process in relation to sending such messages to you will always be clearly indicated in the relevant form through which you subscribe.
Newsletter subscription
Specifically, by filling in your email address in the relevant field in the "Subscribe to our newsletter" section of our Website, you grant your consent to us to send you our newsletter to this email address. In this case, along with your email address information, we also keep information proving the fact that you have subscribed (log files - IP address and time at which the subscription statement was made). You can unsubscribe/terminate this subscription at any time via the relevant links in the messages we will send you or by contacting us.
2. Data automatically collected or generated in relation to the use of the Website
Unless explicitly stated otherwise, access to the Website is free and no registration is required to use the information resources available on it. However, when you use the Website, certain information which is technologically necessary for its operation and which does not allow direct identification of the visitors, is automatically collected and processed. This information includes the following data: date and time of access to the Website; IP address from which the connection was made; server and system logs (to detect technical problems and/ or detect malicious activity); where applicable, logs for making legal statements (such as acknowledgement of having read a data protection policy, newsletter subscription, etc.).
3. “Cookies” and similar technologies
In relation to the management and maintenance of the Website, we may use cookies and other similar technologies, e.g., web beacons (beacons/ web bugs/ pixel tags/ clear GIF technologies) to ensure its reliable and efficient operation. You can find out more about the different types of cookies we use, as well as about your options for managing cookies by reading our Cookie Policy of Dimitrov, Petrov & Co. Law Firm (Cookie Policy) published on the Website and accessible from the footer of each of its web pages. The Cookie Policy constitutes an integral part of this Policy, unless expressly stated otherwise.
IV. Voluntary/mandatory nature of the provision of personal data
Where we ask you to provide us with your personal data, for example, through the contact form on the Website, we clearly indicate the mandatory or voluntary nature of the provision of personal data relating to you. Providing your data is entirely at your discretion, but your refusal to provide data marked as mandatory may result, as the case may be, in us not being able to contact you (e.g. if we do not have contact details to send a response to), to process and respond adequately to your inquiry, etc.
V. Purposes and legal grounds for processing personal data
Dimitrov, Petrov & Co. collects, stores and processes the information described in item III above for the purposes set out in this Policy and in our General Terms and Conditions for the Use of Dimitrov, Petrov & Co. Website. Depending on the legal basis for processing, these purposes may be:
(1) Purposes necessary for compliance with legal obligations of the Law Firm;
(2) Purposes related to steps taken by you before entering into a contract with you;
(3) Purposes related to the legitimate interests of the Law Firm or of third parties;
(4) Purposes for which you have given your consent.
1. The purposes for processing personal data by Dimitrov, Petrov and Co. related to compliance with legal obligations, include:
- Where applicable, carrying out activities to comply with legal obligations related to providing information to competent state and judicial authorities and to assisting inspections by competent authorities;
- Handling inquiries, requests, incl. for the exercise of rights, etc., which are addressed to us, incl. the preparation of responses thereto;
- Where applicable, documenting electronic statements addressed to the Law Firm and related to compliance with our legal obligations, such as acknowledgement of having read the privacy policies, cookie policy etc.
For the purposes listed above, we may process some or all of the personal data referred to in item III, 1, 2 and 3 of this Policy.
2. The purposes related to the steps you have taken before entering into a contract with you include:
- Initial review of inquiries for legal services and assistance and contacting you (in case you are acting as an individual) in relation to the opportunity to provide you with the services you need, as well as in relation to the manner of proceeding the communication under your inquiry. Where such an inquiry is made on behalf of an entity, the processing of the data included in or relating to that inquiry constitutes our legitimate interest, namely to provide our services, and in those cases we process that data on the basis of legitimate interest.
For the purposes listed above, we may process some or all of the personal data referred to in item III, 1 (a) and 2 of this Policy.
3. The purposes for processing personal data related to the legitimate interest of Dimitrov, Petrov and Co. to maintain and improve the quality of information services and resources provided on the Website, include:
- Administering, managing, analyzing the effectiveness and quality control of the information services and resources available on the Website;
- Ensuring the normal functioning and use of the Website and the services and resources available on it;
- Performing activities for maintenance and administration of the Website, including, but not limited to, prevention of cyber-attacks and other malicious activities;
For the purposes listed above, we may process some or all of the personal data referred to in items III, 2 and 3 of this Policy.
4. The purposes for processing personal data related to the legitimate interest of Dimitrov, Petrov and Co. to communicate with you, include:
- Providing an opportunity for correspondence/ communication with us (incl. the opportunity for online inquiries for legal services and assistance) through various channels;
- Providing an opportunity for interactions and communication with us through our corporate profiles/ pages in various social networks;
- Timely processing and providing a response to the initially received correspondence, as well as to the subsequent one;
- Ensuring internal accountability, organizing the work and distributing the correspondence to the relevant persons in charge in the Law Firm.
For the purposes listed above, we may process some or all of the personal data referred to in item III, 1 (a), (b) and (c) of this Policy.
5. The purposes for processing personal data related to the legitimate interest of Dimitrov, Petrov and Co. and/ or third parties for the exercise and protection of legal rights and interests, include:
- Exercise and protection of the legal rights and interests of Dimitrov, Petrov and Co., incl. establishment, exercise or defence of legal claims, including in legal proceedings (e.g., by filing and defending against filed complaints, signals, etc. to the competent state and judicial authorities);
- Assisting in the exercise and protection of the legal rights and interests of third parties (Law Firm’s employees or attorneys, visitors to the Website, processing personal data etc.), including in legal proceedings;
- Carrying out activities for administration and servicing of correspondence containing complaints, signals, etc.
For the purposes listed above, we may process some or all of the personal data referred to in item III, 1, 2 and 3 of this Policy.
6. The purposes for which personal data are processed on the basis of your consent include:
When we process your personal data on the basis of consent, the purposes for which we perform this processing are explicitly stated in the relevant forms by which you provide us with your consent for the respective processing (e.g., when subscribing to a newsletter, etc.). We will only process personal data which you have provided to us in the relevant consent form and only for the purposes specified in this form.
VI. Categories of recipients of personal data
When we transfer your personal data to other persons, we do it in strict compliance with the terms of this Policy and our internal rules and policies, as well as in compliance with the requirements of the applicable personal data protection legislation. The categories of recipients we may transfer your personal data to, include:
- Our subcontractors – personal data processors whom we have assigned the performance of certain activities and who act on our behalf by providing their services (such as technical support of the Website, colocation services for the server and network equipment, etc.). We disclose the data which we provide to our subcontractors only to the extent necessary for the performance of the work assigned, while our subcontractors are obliged under a contract concluded with us to process such data strictly in accordance with our instructions and only for the purposes specified in the relevant contract.
- Our business partners and service providers – other personal data controllers (e.g. companies providing telecommunication, transportation or courier services, etc.), as well as persons whose cooperation is necessary for the purposes of implementing and protecting the legitimate interests of the Law Firm or third parties (Website users, our employees and subcontractors or service providers, etc.) such as private and public bailiffs, notaries, etc. When dealing with such persons we require them to strictly comply with the applicable data protection laws and regulations.
- Competent state, municipal and judicial authorities, where necessary to comply with our legal obligation or to protect the rights or legitimate interests of Dimitrov, Petrov & Co. or third parties.
- In other case provided for by law.
VII. Transfer of personal data outside the European union (EU)/ European Economic Area (EEA)
When transferring data to third parties, incl. our business partners and service providers, it is possible that your personal data are transmitted to countries outside the EU/EEA which do not ensure the same level of protection as the one ensured by the applicable European legislation. In these cases, the transfer of data is based on a decision of the European Commission (EC) in accordance with applicable law regarding the adequate level of personal data protection or in the absence of such a decision, based on standard contractual clauses of the EU in accordance with the decisions of the EC. You can obtain a copy of these standard contractual clauses by making a request to Dimitrov, Petrov & Co. at the contact details specified in item I.
VIII. Storage period of personal data
We undertake to store your personal data only for as long as it is necessary to achieve the purposes of processing.
1. Storage of personal data for compliance with legal obligations
Personal data relating to and/or contained in documents/ information carriers for which there are storage periods prescribed by law, will be stored for the periods provided for in the applicable legislation, unless this Policy provides for a longer storage period for the relevant documents/ information carriers.
2. Storage of personal data contained in correspondence/ communication with us
In the absence of a storage period prescribed by law, the personal data contained in correspondence with us (including, but not limited to, inquiries, requests, complaints, applications, and signals (including free text) and any other communication with us), incl. information on the processing, status and final outcome of this correspondence, will be stored for a period of up to 5 (five) years from the completion of the respective correspondence and the related relations.
3. Storage of server and system logs and logs for actions performed on the Website
We store server and system logs typically for a period of up to 1 (one) year.
Logs for statements of intent made on the Website, such as such as acknowledgement of having read this Policy when using the contact form with us, are stored for a period of up to 5 (five) years after the completion of the relevant communication with us. Logs for activities carried out on the Website, such as giving consent, shall be stored for the periods specified in item 4 below.
4. Storage of personal data when processed on the basis of consent
When the processing of your personal data is based on consent which is not time-limited, we may continue to process your personal data for the purposes for which you gave given us this consent until you withdraw it or until the final achievement of the purposes for which we process them. You may withdraw your consent at any time. When the consent you have given us for the processing of your personal data is time-limited, we will process the relevant personal data only for the period for which you have given us such consent.
5. Storage of cookies
For detailed information on the storage periods of the various cookies and similar technologies we use, you can refer to our Cookie Policy, published on the Website and accessible from the footer of each of its web pages. If certain information and/or certain documents or information carriers are required by law or other regulation to be stored for a longer period than the ones specified in items 1-6 above, the longer period prescribed by law shall apply to the storing such information. In case of a legal dispute or proceedings requiring the retention of data, and/ or in the case of a request from a competent public authority, it is possible to retain the data for a period longer than the ones specified above until the final settlement of the dispute or conclusion of the proceedings before all instances and for a period of up to 5 (five) years after its conclusion. The periods specified above may be amended if other requirements for retention of information are prescribed by the applicable legislation.
IX. Your rights
As a Data subject within the meaning of the Regulation, you have the following rights, which you can exercise by making a written request to Dimitrov, Petrov and Co. at the contact details specified in item I of this Policy:
Right of information (Art.13 and Art. 14GDPR)
You shall have the right to obtain information regarding the processing of your personal data by the Law Firm. This Policy aims to inform you in detail about the processing of your personal data in relation to your use of the Website, as well as your communication with us.
Right of access
(Art. 15 GDPR)
You shall have the right to obtain confirmation as to whether your personal data are being processed by the Law Firm when using the Website, to obtain access to such data, as well as information regarding their processing and your rights in relation to this processing.
Right of rectification
(Art. 16 GDPR)
You shall have the right to request rectification or completion of your personal data, if the data are inaccurate or incomplete.
Right of erasure (Art. 17 GDPR)
If the grounds/conditions in the Regulation provided for this are available, you shall have the right to request erasure of your personal data.
Right of restriction of processing personal data
(Art. 18 GDPR)
The applicable legislation provides for a possibility to restrict the processing of your personal data, if the grounds provided for this in the Regulation are available.
Right of notification of third parties
(Art.19 GDPR)
Where applicable, you shall have the right to require the Law Firm to notify the third parties to whom your personal data have been disclosed, of any rectification, erasure or restriction of the processing of your personal data, unless this proves impossible or involves disproportionate effort on our part.
Right of data portability
(Art. 20 GDPR)
You shall have the right to receive the personal data, concerning you and provided by you, in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance on our part. The right of data portability is applied when the following two conditions are met simultaneously: the processing is based on consent or contract; and the processing is carried out by automated means.
Right to a complaint with a supervisory authority
(Art. 77 GDPR)
You shall have the right to lodge a complaint with a supervisory authority, if you consider that the processing of personal data relating to you infringes the applicable legislation on personal data protection. The Supervisory Authority in the Republic of Bulgaria is the Commission for Personal Data Protection, with address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria.
Right to object
You shall have the right at any time and on grounds relating to your particular situation to object to processing of your data processed on the basis of legitimate interest. In case such an objection is received, we shall consider your request and if it is reasonable, we will comply with it. If we believe there are compelling legal grounds for processing, or that it is necessary for the establishment, exercise, or defense legal claims, we will inform you of that.
We at Dimitrov, Petrov & Co. Law Firm (Dimitrov, Petrov & Co. Law Firm/we) are aware of our responsibility to you – our clients and partners (You) to provide you not only with quality legal services, but also to protect your information in the course of our partnership.
With this Personal Data Protection Policy of Dimitrov, Petrov & Co. Law Firm (the Policy), we would like to inform you about how we process and protect your personal data as part of our relationship and, more specifically, in connection with the provision of legal services and assistance, as well as in the context of the professional cooperation we have with our business partners. Please read this Policy carefully to understand how we collect, store, and otherwise process your personal data in this context and what your rights in relation to this processing are.
This Policy does not apply to the personal data of persons who use the information services and resources available on our website http://www.dpc.bg/ (the Website), or on our corporate profiles on various social networks. With regard to the processing of such personal data, our Personal Data Protection Policy when using the website and the Internet resources of Dimitrov, Petrov & Co. Law Firm, is applicable.
This Policy does not apply to the personal data of persons who apply for a job with us. With regard to the processing of such personal data, our Information Document on the Processing of Personal Data of Job Applicants and Participants in Recruitment Processes, available on the Website, is applicable.
Please read this Notice carefully. It contains important information about how we process the personal data of job applicants and participants in recruitment processes (You).
1. Who is the data controller of Your personal data?
The data controller of Your personal data is Dimitrov, Petrov & Co. Law Firm, registered with a court decision under company file 6082/2005 in the company registry of Sofia City Court, BULSTAT 131433772, having its seat and registered address in Sofia, 28 Todor Alexandrov Blvd., fl. 6 & 7, website: https://www.dpc.bg/, telephone: +359 2 4214201, e-mail address: info@dpc.bg, with partners George Georgiev Dimitrov, Bogdan Kostadinov Petrov, Alexander Todorov Todorov, Hristo Ivanov Nihrizov, Zoya Nikolaeva Todorova, Boyana Asenova Milcheva, Desislava Emilova Krusteva-Doncheva, and Pencho Kunchev Stanchev (we/ the Law Firm).
2. What type of personal data do we process during the recruitment process for оur staff and attorneys?
When applying for a position with us or for entering into a civil contract (e.g. a contract for full-time work with an attorney-at-law under Article 77 of the Bar Act (BA)) and You participate in our recruitment procedures, we may process certain information about You, namely:
(1) Data concerning You and Your contact details: full name; address (permanent, current and correspondence address); e-mail; phone number; information about the position You apply for;
(2) Data concerning Your education and qualifications: resume/CV; cover letter, information contained in documents certifying level of education completed; professional qualifications, professional certification, membership in organisations (including in the bar associations) and additional specialisations; information about the languages You have command of and Your level of fluency; information about Your skills and qualifications (computer skills, technical skills, additional qualifications, certificates and courses);
(3) Data concerning Your professional experience: previous work or other professional experience (including information on the name of a previous employer or other organisation with which You have been contracted (e.g. law firm, etc.), term of employment, place of employment, position held, recommendation letters, legal practice within the meaning of the BA, etc.); information on the nature and scope of work performed with previous employers/other organisation with which You have been contracted, as well as information on current employment and civil contract relations;
(4) Data that became known to us in the course of interviews and tests conducted during the recruitment process, incl. information on requested/proposed remuneration, information generated in the course of performed tests, interviews and any other forms of assessment of the presence of relevant knowledge, skills, competences, qualifications, etc.;
(5) Data from communications carried out with You in connection with Your application and participation in the recruitment process;
(6) Other information included in Your application at Your discretion, including information concerning recommendations; a photo; other data which You have included in Your application at Your own discretion, e.g. information about age; date of birth; information contained in CVs, cover letters, other supporting documentation for the application, etc.;
(7) Information collected and prepared by recruitment agencies, to which the Law Firm has assigned separate stages of or the overall recruitment process, such as considering and assessing applications, conducting interviews, etc. (including data from reports, recommendations, etc., prepared by such agencies);
(8) Information contained in other documents required for the conclusion of an employment or civil contract – e.g. a document certifying the level of education, specialty, qualification, professional certification, scientific title or scientific degree acquired, where such is required for the role or position for which the person applies.
If You are selected and appointed to a relevant position with us, the information and documents provided to us within the application and recruitment process could become part of Your file as an employee or contractor (e.g. attorney-at-law at a full-time work at the Law Firm). We will store these documents and information in accordance with the terms for storing data of employees and contractors under civil contract set by us. If You are selected for the relevant position for the purposes of concluding a contract with You (employment or civil contract), it may be necessary that You provide additional information and documents in accordance with the requirements of the applicable law and our internal rules and procedures. In these cases, we will bring to Your attention our Privacy policy for employees and contractors under civil contract of DPC.
Information not to be included in Your application:
In case You wish that we do not process the data specified in item (6) above, please do not include such data in Your application. In addition, we explicitly ask You not to include in Your application and send to us any copies of official identification documents – ID, passport, driving license, residence permit.
3. For what purposes and on what grounds do we process Your personal data?
We may process Your personal data for the following purposes and on the following grounds:
(1) Recruitment for a specific position: When You apply for a specific position with us, we process the personal data specified above in order to consider Your application and to assess to what extent Your qualifications and professional experience meet the requirements for that position. The data we process for this purpose include the data You have provided to us in Your application and the data generated during the recruitment process (e.g. data which became known to us during the interview conducted with You). When considering Your application and carrying out the recruitment, we may contact You through the contact details You have provided for the purpose of conducting interviews or clarifying other matters regarding Your application.
For this purpose, we process Your personal data on the basis of Art. 6, Para 1 (b) of Regulation 2016/679 (“GDPR”/ the “Regulation”) – taking the necessary steps before concluding an employment or civil contract with You, and pursuant to Art. 6, Para 1 (f) of GDPR – legitimate interest, where our legitimate interest is to evaluate the compatibility of Your application with the necessary requirements and to carry out recruitment to fill certain vacancies with us.
(2) Exercise and protection of our legitimate rights and interests or those of third parties such as recruitment agencies, employees, partners and attorneys at the Law Firm (including assistance in exercising and protection of legitimate rights and interests of such third parties): In case of complaints, reporting, etc. to the competent state and judicial authorities, we may process the personal data mentioned above to the extent necessary to exercise or protect our rights and interests or to assist our employees, partners, attorneys or contractors in the exercise and protection of their legal rights and interests.
In these cases, we may process Your Personal data on the basis of Art. 6, Para 1 (f) of GDPR – our legitimate interest in the exercise and defense of legal claims and, accordingly, the legitimate interest of our employees, partners, attorneys or contractors in the exercise and defense of legal claims.
(3) Compliance with the legal obligations: In certain cases and on the grounds of Art. 6, Para 1 (c) of the GDPR, we may process Your personal data in order also to comply with legal obligations that apply to us, such as the obligation to respond to Your request regarding the protection of Your personal data.
(4) Future recruitment: In case You provide Your prior and explicit consent, we may process Your personal data that were provided in spontaneous application (where no vacancy has been posted) or in application to a vacancy posted by us for the purposes of carrying out future recruitment process. This includes listing You in our database of applicants for future recruiting, assessment of Your suitability for a certain position (including a different one from the position You originally applied for, if any), considering Your application and contacting You in this connection.
In such cases, we will process Your personal data on the grounds of Art. 6, Para 1 (a) of GDPR – Your explicit consent. You have the right to withdraw Your consent at any time without detriment. Withdrawal or refusal to consent does not in any way affect Your participation in the recruitment for the particular position You are applying for.
4. Other sources of personal data
In some cases, personal data processed by us in connection with Your application are not collected or received directly from You, but from third parties such as Recruitment Agencies – e.g. when applying through such agencies, and from public sources, such as public registers (e.g. Bar registers), etc.
5. For what period do we store Your personal data?
We will process Your personal data as part of the recruitment process for the position for which Your application is submitted and will store it for a maximum of 6 (six) months after the process is completed. In the event that we have requested You to provide us with originals or notarized copies of documents certifying Your qualifications and professional experience required for the respective position, we will return those documents to You within 6 (six) months of the final completion of the recruitment procedure if You are not approved for appointment.
Where there is an explicit and voluntary written consent on Your part which allows Your data to be processed for a longer period (e.g., for You to be listed in our database of applicants for future recruitment and for participation in future recruitment procedures), we may store this data for up to 2 (two) years from the final completion of the recruitment procedure. If You withdraw Your consent, we will remove Your data from our database and will cease processing Your personal data for future recruitment.
In the event of a legal dispute or proceeding requiring the retention of personal data and/or in the case of a request from a competent public authority, it may be possible that we retain the data for a longer period until the final closure of the proceedings before all instances, as well as for a period of up to 5 (five) years from the date of final completion of that proceeding. Your personal data may also be processed for a longer period than the periods specified above, if this is necessary to achieve the purposes set out in this Notice, or if the legislation in place provides for the processing of the data for a longer period.
6. Who may have access to Your personal data?
Your personal data may be provided to:
• Service providers which process personal data on our behalf such as IT service providers, recruitment agencies, etc. These providers process Your personal data on the grounds of an agreement concluded with us, in strict compliance with our instructions and only to the extent necessary for the performance of the activities assigned to them;
• Postal service providers and telecommunications service providers for the purpose of contacting You;
• Providers of legal and notary services – in case of any need to defend our legitimate interests;
• Competent municipal, state and judicial authorities in accordance with the procedures provided for in the regulations;
• Upon explicit consent – other categories of recipients explicitly specified in the consent.
7. What are Your rights with regard to the processing of Your personal data?
With regard to the processing of Your Personal data by the Law Firm for the purposes specified in this Privacy Notice You have the following rights:
• Right of information: to obtain information regarding the processing of Your personal data on our part. The present notice has been prepared and made available to You with respect to this right.
• Right of access: to obtain confirmation whether personal data relating to You is being processed as well as to obtain access to these data, incl. to request a copy of the data;
• Right of rectification: to request rectification or completion of Your personal data in case the data are inaccurate or incomplete;
• Right of erasure: to request the erasure of Your personal data if there are the grounds for this provided for in the Regulation;
• Right of restriction of processing: to request restriction of processing of Your personal data within the limits provided for in the Regulation, if there are grounds for this;
• Notification of third parties to whom the personal data has been provided, of any rectification, erasure or restriction of processing of personal data unless this is impossible or requires a disproportionate effort on our part;
• Right of data portability (if applicable): to receive the personal data which You have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance if there are the grounds for this provided for in the Regulation;
• Right not to be subject to a decision based solely on automated processing (i.e. without human intervention), including profiling within the meaning of the Regulation. For avoidance of any doubt we do not process Your personal data in this manner.
• Right to withdraw consent for processing, at any time and without detriment, when the processing is based on consent;
• Right to lodge a complaint with a data protection supervising authority in case You consider that the processing of Your Personal data infringes the Regulation or any other applicable requirements for data protection. The data protection supervising authority in the Republic of Bulgaria is the Commission for Personal Data Protection, with its registered address: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, Website: https://www.cpdp.bg/.
• Right to object to processing of Your personal data, which is based on legitimate interest, pursuant to Art. 6 (1) (e) GDPR, as specified above. In the event of such an objection, we will consider Your request and, if it is reasonable, we will comply with it. If we believe that there are compelling legal grounds for processing, or that it is necessary to establish, exercise, or defend legal claims, we will inform You of that.
You may exercise Your rights by submitting a written request to us using the contact details specified above in this Notice in accordance with the requirements of the applicable law.
This Notice is effective as of 25 May 2018. It is last amended on 16 September 2021.
