We at Dimitrov, Petrov & Co. Law Firm (Dimitrov, Petrov & Co./ Law Firm/we) are aware of our responsibility to you – our clients, partners and those who use our website and internet resources, to provide you not only with quality legal services, but also to protect your information in the course of our relationship.
With this Personal Data Protection Policy when using the website and the Internet resources of Dimitrov, Petrov & Co. Law Firm (the Policy), we would like to inform you about how we process and protect your personal data when you use the information services and resources available on our website http://www.dpc.bg/ (the Website) and on our corporate profiles in various social networks. Please read this Policy carefully to understand how we collect, store, and otherwise process your personal data in this context and what your rights in relation to this processing are. The Personal Data Protection Policy of Dimitrov, Petrov & Co. Law Firm available [here] is applicable with respect to the personal data we process in relation to the provision of our legal services and assistance, as well as regarding the relationships we have with our business partners.
With regards to the processing of personal data of persons who apply for a job with us, this Policy applies in addition to our Privacy Notice for Job Applicants and Participants in Recruitment Processes available on the Website.
This Policy also does not apply to the processing of personal data performed by various third parties to whose websites/platforms/applications, etc. you have been redirected from the Website. Such third parties should have their own privacy policies available on their websites/platforms/applications, etc., which we recommend that you read before using the respective service/resource.
I.
Who are we?
We are Dimitrov, Petrov& Co. Law Firm, with partners George Georgiev Dimitrov, Bogdan Kostadinov Petrov, Alexander Todorov Todorov, Hristo Ivanov Nihrizov, Zoya Nikolaeva Todorova, Boyana Asenova Milcheva, Desislava Emilova Krasteva-Doncehva, Pencho Kanchev Stanchev, and Martin Vassilev Zahariev, entered in the Unified Register of Law Firms at the Supreme Judicial Council, registered with a court decision under company file 6082/2005 in the company registry of Sofia City Court, BULSTAT 131433772, VAT number BG 131433772, having its seat and registered address in Sofia, 28 Todor Alexandrov Blvd., floors 6 and 7, Bulgaria, with e-mail address: gdpr@dpc.bg.
As a personal data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the Regulation/GDPR), we process your personal data in accordance with applicable law and the rules and principles set out in this Policy.
II. Persons whose data we process
In relation to the management and maintenance of our Website, the provision of information resources on it and on our corporate social media profiles, and the communication with anyone who comes into contact with us, we may process information about the following categories of individuals (Data Subjects/You):
III. Categories of personal data we process
1. Data related to correspondence or other type of interaction you have with us: When you contact us with inquiries, requests or other communication, incl. via the contact form on the Website, when you apply for a job with us using the special form on the Website, as well as when you interact with our corporate profile or page in various social networks or thorough another communication channel (mail, e-mail, telephone, etc.), we may process the following types of personal data relating to you:
a) Data related to correspondence/ communication with us via the Website contact form, by e-mail, telephone, at our contact address, etc.
When you contact us, we may process the following types of data relating to you: name and surname; telephone; e-mail address; postal address, city/town; occupation; institution/ organisation you represent/ you are employed at; information on the way you have found about us and our services; unstructured information you provide in your message/inquiry; information about third parties contained in the messages/inquiries/ requests you have sent us; information contained in subsequent correspondence/ communication between you and Dimitrov, Petrov and Co.; data related to the receipt of initial and subsequent correspondence with us, such as time log (date / time) and source (IP address) of the respective correspondence, channel through which the correspondence was made, etc.; additional information collected or created in relation to the processing, status and final outcome of the relevant correspondence.
When the communication addressed to or made with us via the Website contact form, by e-mail or telephone, contains data and information about you and/or third parties which data and information are provided to us in the context of an inquiry for legal services and assistance or other type of cooperation related to the professional activity of Dimitrov, Petrov and Co., we will process such data in accordance with the rules and principles set out in this Policy, as well as in our Personal Data Protection Policy of Dimitrov, Petrov & Co. Law Firm.
b) Data related to the submission of a job application
In the ‘Careers’ section, which is part of the Website resources, you have the opportunity to find out about the specific open positions at Dimitrov, Petrov and Co., as well as to apply for a certain position. When applying for an open position, we may process the following types of data relating to you: names; e-mail address; telephone; position applied for; unstructured information which you would like to provide us with in relation to your application; information and data contained in documents attached to your application (e.g., CV, cover letter, etc.); information related to the processing of your application and the outcome.
We will process this data in accordance with the rules and principles set out in our Privacy Notice for Job Applicants and Participants in Recruitment Processes, available on the Website. For more information on the purposes, legal grounds and terms applicable to the processing of this data, please refer to the said Notice.
c) Data related to any interaction on your part with our corporate profile or page in various social networks
In order to promote our activity and the services we provide, we may maintain corporate profiles/ pages in various social networks (such as Facebook, Twitter, LinkedIn, Xing, etc.). When you interact with our corporate profiles/ pages in such social networks (e.g., by liking, sharing or other forms of interaction with the content published by us – depending on the functionalities of the respective social network), we may receive information about you in accordance with your privacy settings in the respective social network, such as: names; username; information from your profile on the relevant social network (e.g., photo, gender, age or age range, language, country, list of friends, list of liked/ followed pages, etc.); other information you have given us access to and which the social network you use provides us with;information contained in and related to the initial and subsequent communication with us through the functionalities of the relevant social network.
The social networks referred to above are not maintained by us and the processing of personal data by them is not under our control. The persons maintaining the relevant social networks have different rules and procedures for the protection of your personal data, including the collection of information through tools such as cookies, therefore, we recommend that you carefully read their rules and policies.
d) Data related to receiving marketing messages, newsletters, etc. sent by us
When you subscribe to receive any type of communication/correspondence sent by us (e.g., marketing messages, newsletters, etc.), we will process the data provided by you in relation to this subscription. Such data may include: names; e-mail address; other data related to your occupation, profession or interests (if applicable); your preferences regarding the frequency of receiving the relevant communication and its content, etc. The specific types of data we may process in relation to sending such messages to you will always be clearly indicated in the relevant form through which you subscribe.
Newsletter subscription
Specifically, by filling in your email address in the relevant field in the "Subscribe to our newsletter" section of our Website, you grant your consent to us to send you our newsletter to this email address. In this case, along with your email address information, we also keep information proving the fact that you have subscribed (log files - IP address and time at which the subscription statement was made). You can unsubscribe/terminate this subscription at any time via the relevant links in the messages we will send you or by contacting us.
2. Data automatically collected or generated in relation to the use of the Website
Unless explicitly stated otherwise, access to the Website is free and no registration is required to use the information resources available on it. However, when you use the Website, certain information which is technologically necessary for its operation and which does not allow direct identification of the visitors, is automatically collected and processed. This information includes the following data: date and time of access to the Website; IP address from which the connection was made; server and system logs (to detect technical problems and/ or detect malicious activity); where applicable, logs for making legal statements (such as acknowledgement of having read a data protection policy, newsletter subscription, etc.).
3. “Cookies” and similar technologies
In relation to the management and maintenance of the Website, we may use cookies and other similar technologies, e.g., web beacons (beacons/ web bugs/ pixel tags/ clear GIF technologies) to ensure its reliable and efficient operation. You can find out more about the different types of cookies we use, as well as about your options for managing cookies by reading our Cookie Policy of Dimitrov, Petrov & Co. Law Firm (Cookie Policy) published on the Website and accessible from the footer of each of its web pages. The Cookie Policy constitutes an integral part of this Policy, unless expressly stated otherwise.
IV. Voluntary/mandatory nature of the provision of personal data
Where we ask you to provide us with your personal data, for example, through the contact form on the Website, we clearly indicate the mandatory or voluntary nature of the provision of personal data relating to you. Providing your data is entirely at your discretion, but your refusal to provide data marked as mandatory may result, as the case may be, in us not being able to contact you (e.g. if we do not have contact details to send a response to), to process and respond adequately to your inquiry, etc.
V. Purposes and legal grounds for processing personal data
Dimitrov, Petrov & Co. collects, stores and processes the information described in item III above for the purposes set out in this Policy and in our General Terms and Conditions for the Use of Dimitrov, Petrov & Co. Website. Depending on the legal basis for processing, these purposes may be:
(1) Purposes necessary for compliance with legal obligations of the Law Firm;
(2) Purposes related to steps taken by you before entering into a contract with you;
(3) Purposes related to the legitimate interests of the Law Firm or of third parties;
(4) Purposes for which you have given your consent.
1. The purposes for processing personal data by Dimitrov, Petrov and Co. related to compliance with legal obligations, include:
- Where applicable, carrying out activities to comply with legal obligations related to providing information to competent state and judicial authorities and to assisting inspections by competent authorities;
- Handling inquiries, requests, incl. for the exercise of rights, etc., which are addressed to us, incl. the preparation of responses thereto;
- Where applicable, documenting electronic statements addressed to the Law Firm and related to compliance with our legal obligations, such as acknowledgement of having read the privacy policies, cookie policy etc.
For the purposes listed above, we may process some or all of the personal data referred to in item III, 1, 2 and 3 of this Policy.
2. The purposes related to the steps you have taken before entering into a contract with you include:
- Initial review of inquiries for legal services and assistance and contacting you (in case you are acting as an individual) in relation to the opportunity to provide you with the services you need, as well as in relation to the manner of proceeding the communication under your inquiry. Where such an inquiry is made on behalf of an entity, the processing of the data included in or relating to that inquiry constitutes our legitimate interest, namely to provide our services, and in those cases we process that data on the basis of legitimate interest.
For the purposes listed above, we may process some or all of the personal data referred to in item III, 1 (a) and 2 of this Policy.
3. The purposes for processing personal data related to the legitimate interest of Dimitrov, Petrov and Co. to maintain and improve the quality of information services and resources provided on the Website, include:
- Administering, managing, analyzing the effectiveness and quality control of the information services and resources available on the Website;
- Ensuring the normal functioning and use of the Website and the services and resources available on it;
- Performing activities for maintenance and administration of the Website, including, but not limited to, prevention of cyber-attacks and other malicious activities;
For the purposes listed above, we may process some or all of the personal data referred to in items III, 2 and 3 of this Policy.
4. The purposes for processing personal data related to the legitimate interest of Dimitrov, Petrov and Co. to communicate with you, include:
- Providing an opportunity for correspondence/ communication with us (incl. the opportunity for online inquiries for legal services and assistance) through various channels;
- Providing an opportunity for interactions and communication with us through our corporate profiles/ pages in various social networks;
- Timely processing and providing a response to the initially received correspondence, as well as to the subsequent one;
- Ensuring internal accountability, organizing the work and distributing the correspondence to the relevant persons in charge in the Law Firm.
For the purposes listed above, we may process some or all of the personal data referred to in item III, 1 (a), (b) and (c) of this Policy.
5. The purposes for processing personal data related to the legitimate interest of Dimitrov, Petrov and Co. and/ or third parties for the exercise and protection of legal rights and interests, include:
- Exercise and protection of the legal rights and interests of Dimitrov, Petrov and Co., incl. establishment, exercise or defence of legal claims, including in legal proceedings (e.g., by filing and defending against filed complaints, signals, etc. to the competent state and judicial authorities);
- Assisting in the exercise and protection of the legal rights and interests of third parties (Law Firm’s employees or attorneys, visitors to the Website, processing personal data etc.), including in legal proceedings;
- Carrying out activities for administration and servicing of correspondence containing complaints, signals, etc.
For the purposes listed above, we may process some or all of the personal data referred to in item III, 1, 2 and 3 of this Policy.
6. The purposes for which personal data are processed on the basis of your consent include:
When we process your personal data on the basis of consent, the purposes for which we perform this processing are explicitly stated in the relevant forms by which you provide us with your consent for the respective processing (e.g., when subscribing to a newsletter, etc.). We will only process personal data which you have provided to us in the relevant consent form and only for the purposes specified in this form.
VI. Categories of recipients of personal data
When we transfer your personal data to other persons, we do it in strict compliance with the terms of this Policy and our internal rules and policies, as well as in compliance with the requirements of the applicable personal data protection legislation. The categories of recipients we may transfer your personal data to, include:
- Our subcontractors – personal data processors whom we have assigned the performance of certain activities and who act on our behalf by providing their services (such as technical support of the Website, colocation services for the server and network equipment, etc.). We disclose the data which we provide to our subcontractors only to the extent necessary for the performance of the work assigned, while our subcontractors are obliged under a contract concluded with us to process such data strictly in accordance with our instructions and only for the purposes specified in the relevant contract.
- Our business partners and service providers – other personal data controllers (e.g. companies providing telecommunication, transportation or courier services, etc.), as well as persons whose cooperation is necessary for the purposes of implementing and protecting the legitimate interests of the Law Firm or third parties (Website users, our employees and subcontractors or service providers, etc.) such as private and public bailiffs, notaries, etc. When dealing with such persons we require them to strictly comply with the applicable data protection laws and regulations.
- Competent state, municipal and judicial authorities, where necessary to comply with our legal obligation or to protect the rights or legitimate interests of Dimitrov, Petrov & Co. or third parties.
- In other case provided for by law.
VII. Transfer of personal data outside the European union (EU)/ European Economic Area (EEA)
When transferring data to third parties, incl. our business partners and service providers, it is possible that your personal data are transmitted to countries outside the EU/EEA which do not ensure the same level of protection as the one ensured by the applicable European legislation. In these cases, the transfer of data is based on a decision of the European Commission (EC) in accordance with applicable law regarding the adequate level of personal data protection or in the absence of such a decision, based on standard contractual clauses of the EU in accordance with the decisions of the EC. You can obtain a copy of these standard contractual clauses by making a request to Dimitrov, Petrov & Co. at the contact details specified in item I.
VIII. Storage period of personal data
We undertake to store your personal data only for as long as it is necessary to achieve the purposes of processing.
1. Storage of personal data for compliance with legal obligations
Personal data relating to and/or contained in documents/ information carriers for which there are storage periods prescribed by law, will be stored for the periods provided for in the applicable legislation, unless this Policy provides for a longer storage period for the relevant documents/ information carriers.
2. Storage of personal data contained in correspondence/ communication with us
In the absence of a storage period prescribed by law, the personal data contained in correspondence with us (including, but not limited to, inquiries, requests, complaints, applications, and signals (including free text) and any other communication with us), incl. information on the processing, status and final outcome of this correspondence, will be stored for a period of up to 5 (five) years from the completion of the respective correspondence and the related relations.
3. Storage of server and system logs and logs for actions performed on the Website
We store server and system logs typically for a period of up to 1 (one) year.
Logs for statements of intent made on the Website, such as such as acknowledgement of having read this Policy when using the contact form with us, are stored for a period of up to 5 (five) years after the completion of the relevant communication with us. Logs for activities carried out on the Website, such as giving consent, shall be stored for the periods specified in item 4 below.
4. Storage of personal data when processed on the basis of consent
When the processing of your personal data is based on consent which is not time-limited, we may continue to process your personal data for the purposes for which you gave given us this consent until you withdraw it or until the final achievement of the purposes for which we process them. You may withdraw your consent at any time. When the consent you have given us for the processing of your personal data is time-limited, we will process the relevant personal data only for the period for which you have given us such consent.
5. Storage of cookies
For detailed information on the storage periods of the various cookies and similar technologies we use, you can refer to our Cookie Policy, published on the Website and accessible from the footer of each of its web pages. If certain information and/or certain documents or information carriers are required by law or other regulation to be stored for a longer period than the ones specified in items 1-6 above, the longer period prescribed by law shall apply to the storing such information. In case of a legal dispute or proceedings requiring the retention of data, and/ or in the case of a request from a competent public authority, it is possible to retain the data for a period longer than the ones specified above until the final settlement of the dispute or conclusion of the proceedings before all instances and for a period of up to 5 (five) years after its conclusion. The periods specified above may be amended if other requirements for retention of information are prescribed by the applicable legislation.
IX. Your rights
As a Data subject within the meaning of the Regulation, you have the following rights, which you can exercise by making a written request to Dimitrov, Petrov and Co. at the contact details specified in item I of this Policy:
Right of information (Art.13 and Art. 14GDPR)
You shall have the right to obtain information regarding the processing of your personal data by the Law Firm. This Policy aims to inform you in detail about the processing of your personal data in relation to your use of the Website, as well as your communication with us.
Right of access
(Art. 15 GDPR)
You shall have the right to obtain confirmation as to whether your personal data are being processed by the Law Firm when using the Website, to obtain access to such data, as well as information regarding their processing and your rights in relation to this processing.
Right of rectification
(Art. 16 GDPR)
You shall have the right to request rectification or completion of your personal data, if the data are inaccurate or incomplete.
Right of erasure (Art. 17 GDPR)
If the grounds/conditions in the Regulation provided for this are available, you shall have the right to request erasure of your personal data.
Right of restriction of processing personal data
(Art. 18 GDPR)
The applicable legislation provides for a possibility to restrict the processing of your personal data, if the grounds provided for this in the Regulation are available.
Right of notification of third parties
(Art.19 GDPR)
Where applicable, you shall have the right to require the Law Firm to notify the third parties to whom your personal data have been disclosed, of any rectification, erasure or restriction of the processing of your personal data, unless this proves impossible or involves disproportionate effort on our part.
Right of data portability
(Art. 20 GDPR)
You shall have the right to receive the personal data, concerning you and provided by you, in a structured, commonly used, and machine-readable format and to transmit those data to another controller without hindrance on our part. The right of data portability is applied when the following two conditions are met simultaneously: the processing is based on consent or contract; and the processing is carried out by automated means.
Right to a complaint with a supervisory authority
(Art. 77 GDPR)
You shall have the right to lodge a complaint with a supervisory authority, if you consider that the processing of personal data relating to you infringes the applicable legislation on personal data protection. The Supervisory Authority in the Republic of Bulgaria is the Commission for Personal Data Protection, with address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria.
Right to object
You shall have the right at any time and on grounds relating to your particular situation to object to processing of your data processed on the basis of legitimate interest. In case such an objection is received, we shall consider your request and if it is reasonable, we will comply with it. If we believe there are compelling legal grounds for processing, or that it is necessary for the establishment, exercise, or defense legal claims, we will inform you of that.
We at Dimitrov, Petrov & Co. Law Firm (“the Law Firm”/"Dimitrov, Petrov & Co."/"We"/"Us"/"Our") are aware of our responsibility to our clients and partners ("You"/"Your"/"Yours") to not only provide You with quality services, but also to protect Your information in the course of Our work together.
With the present Personal Data Protection Policy (the "Policy"), We wish to inform You on the manner in which the Law Firm and the attorneys-at-law at full-time work at the Law Firm process and protect Your personal data within the framework of our joint relations and/or in the course of the provision of legal services and assistance by Us.
Please read the present Policy carefully to understand how We collect, store and otherwise process Your personal data and what Your rights and options are in relation to that processing.
1. Who are we?
We are Dimitrov, Petrov & Co. Law Firm, with partners George Georgiev Dimitrov, Bogdan Kostadinov Petrov, Alexander Todorov Todorov, Hristo Ivanov Nihrizov, Zoya Nikolaeva Todorova, Boyana Asenova Milcheva, Desislava Emilova Krusteva-Doncheva, Pencho Kanchev Stanchev, and Martin Vassilev Zahariev, registered in the Unified Register of Lawyers' Associations at the Supreme Judicial Council, registered by a court decision of the Sofia City Court under company case No. 6082/2005, UIC 131433772, having its seat and registered address in Sofia 1303, 28 Todor Alexandrov Blvd., fl. 7, info@dpc.bg. As a data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ("the Regulation"/"GDPR"), We process personal data when you visit Our Website, when providing legal services and assistance, or in connection with other occasions provided for in this Policy, in which You enter into legal/ factual relationships with Us, in accordance with the applicable legislation and the described below rules and principles.
2. Data subjects
In connection with providing legal services and assistance and maintaining contact with Our partners, Dimitrov, Petrov & Co. processes information regarding the following categories of individuals ("Data Subjects"):
(a) Persons to whom the Law Firm provides legal services and assistance ("Clients") - individuals;
(b) Clients’ Representatives - legal/contractual representatives of Clients - individuals, legal entities, branches, unincorporated companies, and other similar organizations, as well as contact persons of Clients;
(c) Prospective and former Clients - individuals and Representatives of prospective and former Clients - individuals, legal entities, unincorporated companies and other similar organizations;
(d) Persons with whom the Client is in, is planning to enter into, or had been in legal, factual and/or kinship relations, and any other persons about whom the Client has provided information to or information about whom the Law Firm receives or accesses in connection with the legal services and assistance provided by Us, including, but not limited to:
• Job applicants; employees and former employees; contractors and former contractors under civil contracts; employers and former employers; assignors and former assignors of the Client;
• Relatives; future, present and former spouses; heirs; persons under custody or guardianship of the Client;
• Co-contractors and former co-contractors; clients, potential and former clients; business partners, potential and former business partners; suppliers, potential and former suppliers; persons with legal claims against the Client; persons against whom the Client has legal claims and persons involved in proceedings (judicial, administrative, etc.) to which the Client is a party;
• Persons whose participation in judicial, administrative, executive, registry and other proceedings is necessary or required by law in order to protect the rights and legitimate interests of the Client - witnesses, experts, translators, interpreters, trustees in bankruptcy, liquidators, notaries, judges, prosecutors, investigating police officers, investigators, mediators, arbitrators, registry judges, state and private bailiffs, officials, clerks and other similar;
• Related to the categories of persons listed above;
• Any other persons whose processing of Personal Data would be necessary in order for Us to provide legal protection, advice or assistance to the Client.
(e) Persons with whom the Law Firm is in, plans to enter into, or had been in a legal and/or factual relations, other than Clients, including but not limited to:
• Business partners, potential and former business partners - individuals; representatives and contact persons of business partners - individuals, legal entities, branches, unincorporated companies and other similar organizations;
• Business contacts, including, but not limited to, participants in conferences, seminars, webinars, other similar events, organized by Us, or such involving Our experts, whose details are voluntarily provided to Us for the purpose of contacting and maintaining contact with such persons.
(f) Persons who have corresponded with Us, including but not limited to:
• Persons who have made enquiries, requests, signals, complaints or other correspondence addressed to Us;
• third parties whose information is contained in enquiries, requests, signals, complaints or other correspondence addressed to Us.
3. What categories of personal data do We process in the course of Our professional activities as a Law Firm?
In the context of providing Our professional services or otherwise in the course of Our professional activities, We may - as the case may be - process the following categories of personal data related to the Data Subjects:
• Identification data: names as per identification document, national identification numbers such as PIN/Foreigner’s personal number/BULSTAT (for self-employed persons), date of birth; address (permanent and current), place of birth, age, data from identification document, gender, citizenship; VAT number (for natural persons - registered under the VAT Act) and other similar; as well as any other information necessary for the identification of the Data Subjects, including information collected from publicly accessible sources such as public registers, Internet websites, other similar, for the purposes of screening potential Clients - in cases where this is a legal requirement (e.g. under the Bar Association Act and the Attorney-at-law Code of Ethics, under the Anti-Money Laundering Measures Act and other similar);
• Contact data: telephone numbers, including contact information in IM systems (Skype/Viber/WhatsApp ID, etc.); faxes; electronic mail addresses (emails); physical mailing addresses and other contact/correspondence data;
• Additional information for sole traders: name, UIC, seat and registered office;
• Additional information about Clients’ Representatives and Third Party Representatives with whom Our Client is in, plans to enter into, or had been in legal, factual and/or kinship relations, as well as any other persons about whom the Client has provided information to or information about whom the Law Firm receives or accesses in connection with the legal services and assistance provided by Us:
o information on whom the Representative represents with information on the Client represented;
o position/job title; place of employment; capacity (type of legal representative, proxy, employee, partner in an unincorporated company); changes in and history of changes in legal representation; powers of attorney; information on representative authority; information on withdrawal or expiration of authorization, contracts for companies under the Bulgarian Act on Obligations and Contracts, information on the owners of the Client (if the Client is a legal entity, branch or unincorporated company) - e.g. information on partners/shareholders, number and type of shares/stocks held and other similar;
• Contractual and financial information, which, depending on the specific situation, may relate both to the relationship between the Law Firm and the Client and to the Client's relations with third parties, including but not limited to:
o Contract and number and signing date of contract; information on and dates of amendment and termination of contract; invoice numbers and contents; information on incurrence, nature and amount of liabilities (including interest); payments made; information and history of remittance errors; information on deferred payments; paying-off of liabilities;
o information on the Client's or third parties' bank account; information on bank guarantees or sums of money paid in favour of the Law Firm, in favour of or on behalf of the Client (amount, reason, date of payment, etc.);
o information on expenses incurred (e.g. for translation and certification of documents; for postal and courier services used; for travel; for government, administrative, notary and enforcement fees, etc.);
o information on amounts transferred (client funds) to the Law Firm's Client Account (amount; currency; date of receipt of client funds; reason; conditions on management and disposal of client funds; interests; costs of maintaining the client account; actions taken with client funds);
• Correspondence with Us: information about submitted notices, complaints, applications, requests and signals (including in free text), feedback, opinions, comments regarding the legal services and assistance provided by Us and information about other correspondence with the Law Firm / Our employees and lawyers at full-time work at Us, including information about their processing and status and the final result of their processing;
• Other information and documents: any other information and documentation which the competent governmental authorities, the Client, persons related to the Client, or third parties with whom Our Client is in, is planning to enter into, or had been in legal, factual, and/or kinship relations provide to Us or that We obtain or access or are generated in the process of Our provided legal assistance to the Client (including information collected by Us as commissioned by the Client in connection with the legal services and assistance provided by Us). Depending on the specific case and the work commissioned by the Client, this information may contain personal data about individuals who are subject to a special regime under the Regulation: a "special category of data" within the meaning of Art. 9 par. 1 of the Regulation (information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation) and/or information concerning convictions and offences and related security measures within the meaning of Art. 10 of the Regulation (including information contained in criminal records; court decisions and other acts of competent authorities).
Where We require the provision of personal data directly from You (e.g. for the purposes of identifying You as a Client), We ask You to provide Us with all categories of personal data that We have requested, as otherwise We may be unable to fulfil our legal obligations to verify You as a Client, respectively to enter into a contract with You, provide You with Our legal services and assistance and/or protect Your rights and legitimate interests.
If You provide Us with information about persons other than You, You should undertake the necessary steps to ensure that the third parties understand how the information relating to them will be used and that they are properly informed of the possibility that You may disclose such information to Us which We may use in connection with the legal services and assistance provided by Us.
All data, documents and correspondence stored by the Law Firm in connection with the work conducted by the Law Firm and the attorneys-at-law at full-time work at the Law Firm, shall be subject to attorney-client privilege within the meaning of the Bar Association Act.
4. For what purposes do We process Your personal data?
4.1. Objectives necessary to fulfil legal obligations
The purposes for which We process personal data to comply with legal obligations include:
• Activities to check for and prevent conflicts of interest with respect to complying with the prohibition on representation and legal protection of persons with conflicting interests under the Bar Association Act and the Attorney-at-law Code of Ethics;
• Activities to check for and prevent money laundering under the Anti-Money Laundering Measures Act and activities to prevent terrorist financing under the Anti-Terrorist Financing Measures Act;
• Accounting and reporting activities for payments received under the Contract concluded with the Law Firm, in accordance with the legislation in force (tax and accounting legislation, etc.);
• Accounting and reporting activities for payments received from the Client to the Client’s Account within the meaning of Article 39 of the Bar Association Act in accordance with the applicable legislation (tax and accounting legislation, Bar Association Act, etc.);
• Other activities related to the fulfilment of legal obligations (tax, accounting, regulatory, etc.) of the Law Firm, related to the submission/reporting of information to the competent state and judicial authorities and assistance with inspections by competent authorities;
4.2. Purposes necessary for the performance of a contract or for taking steps to conclude a contract at the request of the Data Subject
The purposes for which We process personal data relating to and/or necessary for the performance of contracts or to take steps at the request of the Data Subject prior to entering into a contract with Us include:
• Establishing relations with new Clients - individuals, including processing inquiries for providing legal services and assistance from Dimitrov, Petrov & Co., drafting offers, еtc.;
• Conclusion and execution of contracts for the provision of legal services and assistance with Clients–individuals;
• Provision of legal protection and assistance to Clients-individuals on the basis of the contract with the Client, in particular through one or more of the following activities listed in Art. 24, Para 1, p. 1-3 of the Bar Association Act:
o providing oral and written advice and statements on matters of the law;
o preparation of any documents - requests, signals, applications, complaints and others related to the work assigned by the Client;
o representation of the Client and protection of their rights and legal interests before the judicial authorities, administrative bodies and institutions, as well as before natural and legal persons.
• Communicating with the Clients-individuals in relation to the conclusion, amendment and performance of contracts and in relation to the legal services and assistance provided by Us;
• Rescheduling/deferral of payments due from Clients-individuals;
• Processing and collection of payments due from Clients-individuals for services rendered;
• Refund of erroneously transferred amounts from Clients-individuals and other similar;
4.3. Purposes necessary for the legitimate interest of Dimitrov, Petrov & Co. and/or third parties
The purposes for processing personal data for the purposes of the legitimate interests of Dimitrov, Petrov & Co. or third parties include:
4.3.1. Legitimate interest - establishing and maintaining contractual relations with Clients who are not individuals (legal entities, unincorporated companies, other similar organizations), which include:
• Activities on establishing relations with new Clients (including processing enquiries, offers, etc.);
• Conclusion and performance of contracts for the provision of legal services and assistance with Clients who are not individuals, in particular through one or more of the activities listed in Art. 24, Para 1, p. 1-3 of the Bar Association Act;
• Communicating with Clients who are not individuals regarding the conclusion, amendment and performance of contracts and in connection with the legal services and assistance provided by Us;
• All other purposes and activities applicable to the Clients-individuals and described in section 4.2. of the present Policy are also applicable to the processing of data for the purpose of servicing Clients who are not individuals.
4.3.2. Legitimate Interest - (1.1.) the exercise and protection of the Law Firm's legitimate rights and interests; and (1.2.) assistance in the exercise and protection of the legitimate rights and interests of the Client or its affiliates; of employees of, or attorneys-at-law at a full-time work at the Law Firm; of persons processing personal data on behalf of the Law Firm and of the Law Firm's business partners:
• Establishing, exercising or defending legal claims of the above-mentioned persons referred to in items (1.1.) and (1.2.), including in court, including filing complaints, signals, etc. with the competent state and judicial authorities;
• Collection of claims owed to the Law Firm, including by assignment to third parties;
• Transfer (assignment) of claims due to the Law Firm to third parties;
• Activities related to the administration and processing of received complaints, signals, requests, etc.;
• Sending notarial invitations;
4.3.3. Legitimate interest - internal accountability:
• Managing and reporting on the work performed for the Client in order to determine the fee payable by the Client to the Law Firm;
• Maintain and update a database of potential, current and former Clients.
4.3.4. Legitimate interest - maintaining and improving the quality of services provided by Us:
• Analysing and improving Our services and communications;
• Monitoring compliance with our rules, policies and performance standards;
• Collecting information about Your preferences to personalize and improve the quality of Our communications with You.
4.3.5. Legitimate interest - marketing activities carried out in compliance with the obligation for attorney-client privilege during the performance of the legal profession:
• Disclosure of the Client's name and general information regarding the projects assigned to the Law Firm:
o on the Law Firm's Website
o in the Law Firm's marketing materials and presentations;
o of specialised legal directories and publications for the purpose of including the Law Firm and its attorneys-at-law at full-time work in professional rankings, ratings, listings, etc.
• Requiring a reference in relation to tasks assigned and completed;
4.4. Purposes for which your Consent is required
The purposes for which Your consent is required (e.g. to receive Communications such as legal news, publications, invitations to events and other similar communications from Us, etc.) are expressly stated in the relevant forms by which You have provided Your consent for the processing.
On the basis of consent, We only process personal data that You have provided to Us via the relevant consent form.
You may withdraw Your consent at any time by following the relevant electronic links at the end of each of Our communications or by writing to: info@dpc.bg.
4.5. Processing of personal data under a special regime
Where We process data under a special regime in respect to the legal services and assistance provided by Us, such processing is carried out both (i) on the basis of the contract entered into with the Client (for Clients-individuals) and/or (ii) on the basis of Our or the Client’s legitimate interest (for Clients who are not individuals) to provide quality legal services, such as to fulfil our contract with the Client, and to ensure the protection of the Client's rights and legitimate interests, and:
(iii) for a special category of data referred to in Article 9, Para 1 of the Regulation - to the extent necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) of the Regulation);
(iv) for data relating to convictions and offences under Article 10 of the Regulation - and to the extent necessary for the exercise of the legal profession by Our experts (in accordance with the Bar Association Act and the relevant procedural laws governing the procedure for the exercising legal defence by an attorney).
5. Who do We share Your personal data with?
5.1. We undertake not to disclose personal data and not to provide the information collected by Us to third parties, except in cases where:
• We share such information with Our partners and subcontractors (including processors acting on Our behalf) who help Us to achieve the above processing purposes, such as providers of certain services (e.g. IT service providers, translation agencies, etc.). These parties will assist Us on the basis of contractual relations with Us which provide for obligations of confidentiality and ensure adequate protection of the personal data We have provided to them.
• This is necessary to fulfil the Law Firm’s legal obligation to:
o Courts;
o Competent state and municipal authorities;
o the Supreme Bar Council and the respective Bar Associations in which the lawyers at full-time work at the Law Firm are registered.
• This is expressly provided for in our contract with the Client, in their specific assignment or in this Policy:
o Recipients of claims transferred by the Law Firm (assignees);
o Subcontractors or partners (e.g. engineers, technical specialists, etc.) in the provision of the Law Firm's services;
o Other persons according to the specific assignment of the Client.
• This is necessary for the conclusion, amendment, performance or termination of Our contract with the Client:
o Attorneys - Our partners with whom We work together or collaborate on a particular case, including attorneys from other jurisdictions, when the nature of the services and assistance We provide involves researching foreign law;
o State and judicial authorities;
o Banks and payment service providers (e.g. for the purposes of payments between the Law Firm and the Client);
o Postal Operators;
o Third parties with whom the Client or an affiliate of his is in, plans to enter into or had been in legal or factual relations - if such disclosure is assigned by the Client to Us (contractual relationships, negotiations, etc. below);
o If you are not Our Client and We have collected Your personal data in the process of providing legal services and assistance to Our Client, We may disclose that information to Our Client to the extent not prohibited by law;
o Notaries;
o Private and state bailiffs;
o Other persons to whom it is necessary to disclose personal data in connection with the conclusion, amendment, performance or termination of Our contract with the Client.
• This is necessary to protect the rights or legitimate interests of the Law Firm, the Client or their affiliates:
o State and judicial authorities;
o Private and state bailiffs;
o Attorneys - Our partners with whom We work together or collaborate on a particular case, including attorneys from other jurisdictions, when the nature of the services and assistance We provide involves researching foreign law;
o Accountants and accounting houses;
o Auditors;
o Notaries;
o Experts and other similar.
• This is necessary in order to promote Our activity, to the extent expressly agreed with the Client subject while complying with the requirements of attorney-client privilege - with third parties to help Us measure Our performance and improve and promote Our services (e.g. with persons maintaining lawyer directories, rankings, etc.);
• in other cases provided for by law.
5.1. Transmission of data outside Bulgaria
Depending on the nature of the relevant Customer Case, it may be possible to transfer personal data We process to countries outside the jurisdiction in which we are located. We do not intend to disclose Your personal data outside of the European Union (EU) or the European Economic Area (EEA) unless the services We perform within the scope of Our legal relations are bound by such obligations. In such cases, the data transfer is subject to appropriate safeguards, such as, for example, standard contractual data protection clauses adopted by the European Commission, or to at least one of the following conditions: (i) the transfer is necessary for the performance of a contract between the Client-individual and Us or for the performance of pre-contractual measures taken at the request of the Client-individual; (ii) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the Client-individual between Us and another individual or legal entity (lawyer, law firm, etc. - depending on the possibilities of exercising the legal profession in the relevant jurisdiction); (iii) the transfer is necessary for the establishment, exercise or defence of legal claims of the Client, of Dimitrov, Petrov & Co. or persons related to them.
If You would like to receive further information about these precautions, please contact Us using the contact details set out in section 1 of this Policy.
5.2. Attorney-client privilege
The disclosure of personal data to third parties in the cases described above is made to the extent and in the volume permitted by Our obligation to protect the legal professional privilege during the exercise of the legal profession under the Bar Association Act.
6. Storage of personal data
We respect the principle that the period for which personal data are kept is limited to a strict minimum and personal data are not kept longer than necessary to achieve the purposes of the processing.
6.1. Storage of personal data in connection with the contract with the Client
Personal data collected in connection with the conclusion and performance of a contract with a Client may be processed throughout the term of the contract and for up to five (5) years after termination of the contract in accordance with Our internal rules and Our legal obligations as lawyers under the Bar Association Act, except in cases where longer retention of relevant information is required in accordance with the requirements of the applicable law or this Policy. Within the same period, We also retain the papers in cases in which We or lawyers at full-time work at the Law Firm have acted as attorney or counsel, as well as the papers in relation to which We have provided other assistance to the Client (counseling, representation in deals, negotiations, etc.).
6.2. Storage of personal data for compliance with legal requirements
The personal data related to and/or contained in documents/information carriers for which there are statutory retention periods (accounting documents; documents, information and other records related to tax control, etc.) will be retained for the periods provided for in the applicable legislation (e.g., tax and social security control documents are retained for up to ten (10) years from the beginning of the year following the year in which payment of the public tax liability related to the records kept for the relevant financial year is due), unless this Policy provides for a longer retention period for the relevant documents/carrier. Also, in the context of a legal dispute or proceeding in which we have represented Our Client, We may retain the data until the final conclusion of the dispute or proceeding before all instances, and up to 5 years thereafter. These time limits may be changed if a different retention requirement is established under applicable law.
6.3. Retention of personal data when processing on the basis of consent
Where the processing of Your data is based on consent (e.g. to receive Communications from Us), we may continue to process Your personal data for the purposes for which You have consented until Your consent is withdrawn.
7. Your rights and how to exercise them
In relation to the processing of Your personal data, You have the following rights granted to You by the Regulation:
Right to information (Articles 13 and 14 GDPR): You have the right to receive information about the processing ofbYour personal data by Us. This Policy aims to provide You with such information.
Right of access (Article 15 GDPR): You have the right to obtain confirmation of whether Your personal data is being processed and to receive access to the personal data processed and to the detailed information about the processing and Your rights under the Regulation.
Right of rectification (Article 16 GDPR): You have the right to have Your personal data corrected or completed if they are inaccurate or incomplete.
Right to erasure (Art. 17 GDPR): You have the right to request the erasure of Your personal data if the grounds provided for in the Regulation are present.
Right to restriction of processing of personal data (Article 18 GDPR): You have the right to ask Us to restrict the processing of Your personal data to the extent provided for in the Regulation if the grounds provided for in the Regulation are present.
Notification of third parties (Art. 19 GDPR): You have the right to require from Us to notify third parties to whom Your personal data have been disclosed of any rectification, erasure or restriction of processing of Your personal data, unless this is impossible or requires a disproportionate effort by Us.
Right to data portability (Art. 20 GDPR): You have the right to receive the personal data concerning You that You have provided to Us in a structured, commonly used and machine-readable format and to transfer that data to another controller without interference from Us.
The right of portability applies when the following two conditions are met simultaneously:
• The processing is based on consent or a contractual obligation; and
• Processing is carried out in an automated manner.
If technically feasible, You have the right to obtain a direct transfer of Your personal data from Us to another controller. The right to data portability may be exercised in a manner that does not adversely affect the rights and freedoms of others.
Rights in automated individual decision-making, including profiling (Article 22 GDPR): You have the right not to be the subject of an automated decision based solely on automated processing (i.e. processing without human intervention), including profiling within the meaning of the Regulation, which produces legal effects concerning You or similarly significantly affects You, unless the grounds for doing so are provided for in the Regulation and appropriate safeguards are provided to protect Your rights and freedoms and legitimate interests. Such safeguards are at least the right to human intervention on Our part, Your right to express Your points of view and to contest the decision.
If such a decision, including profiling, is taken in respect of You, You have the right to obtain from Us, for each individual case, essential information about the logic used, the meaning and intended consequences of such processing for You, as well as about how to exercise Your rights under this paragraph.
Right to withdraw consent to processing (Art. 7 par. 3 GDPR): If the processing of personal data is based solely on Your consent (Article 6(1)(a) or Article 9(2)(a) GDPR), You have the right to withdraw Your consent at any time.
Such withdrawal shall not affect the lawfulness of the processing based on the consent before its withdrawal.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data relating to You violates applicable data protection law. The supervisory authority in the Republic of Bulgaria is the Commission for Personal Data Protection, with address City of Sofia, postcode, 1592, 2 Prof. Tsvetan Lazarov Blvd., email address and website: kzld@cpdp.bg; www.cpdp.bg
Right to object: You have the right at any time and on grounds relating to Your particular situation to object to the processing of personal data concerning You, including profiling within the meaning of the Regulation, which is based on public interest, the exercise of official authority or the legitimate interests of Us or a third party. In these cases, We will cease processing the personal data unless We demonstrate that there are compelling legitimate grounds for the processing which override Your interests, rights and freedoms, or the establishment, exercise or defence of legal claims.
If Your personal data are processed for direct marketing purposes, You have the right at any time to object to the processing of personal data relating to it for this type of marketing, which includes profiling, and We will stop the processing for these purposes.
You may exercise any of the rights set out above by contacting Us on the contact details set out in section 1 of this Policy.
8. Changes to this Policy
We reserve the right to update and amend this Policy from time to time to reflect any changes in the way We process Your personal data or to comply with changes in applicable law.
Any changes we may make in the future will be posted on this page and, if appropriate, brought to Your attention by a message to Your e-mail address. Please, check frequently to ensure You are aware of any updates or changes to Our Policy in a timely manner.
This Personal Data Protection Policy has been approved by the Supervisory Board of Dimitrov, Petrov & Co. and has been last updated at 26.06.2023.
Please read this Notice carefully. It contains important information about how we process the personal data of job applicants and participants in recruitment processes (You).
1. Who is the data controller of Your personal data?
The data controller of Your personal data is Dimitrov, Petrov & Co. Law Firm, registered with a court decision under company file 6082/2005 in the company registry of Sofia City Court, BULSTAT 131433772, having its seat and registered address in Sofia, 28 Todor Alexandrov Blvd., fl. 6 & 7, website: https://www.dpc.bg/, telephone: +359 2 4214201, e-mail address: info@dpc.bg, with partners George Georgiev Dimitrov, Bogdan Kostadinov Petrov, Alexander Todorov Todorov, Hristo Ivanov Nihrizov, Zoya Nikolaeva Todorova, Boyana Asenova Milcheva, Desislava Emilova Krusteva-Doncheva, Pencho Kunchev Stanchev, and Martin Vassilev Zahariev (we/ the Law Firm).
2. What type of personal data do we process during the recruitment process for оur staff and attorneys?
When applying for a position with us or for entering into a civil contract (e.g. a contract for full-time work with an attorney-at-law under Article 77 of the Bar Act (BA)) and You participate in our recruitment procedures, we may process certain information about You, namely:
(1) Data concerning You and Your contact details: full name; address (permanent, current and correspondence address); e-mail; phone number; information about the position You apply for;
(2) Data concerning Your education and qualifications: resume/CV; cover letter, information contained in documents certifying level of education completed; professional qualifications, professional certification, membership in organisations (including in the bar associations) and additional specialisations; information about the languages You have command of and Your level of fluency; information about Your skills and qualifications (computer skills, technical skills, additional qualifications, certificates and courses);
(3) Data concerning Your professional experience: previous work or other professional experience (including information on the name of a previous employer or other organisation with which You have been contracted (e.g. law firm, etc.), term of employment, place of employment, position held, recommendation letters, legal practice within the meaning of the BA, etc.); information on the nature and scope of work performed with previous employers/other organisation with which You have been contracted, as well as information on current employment and civil contract relations;
(4) Data that became known to us in the course of interviews and tests conducted during the recruitment process, incl. information on requested/proposed remuneration, information generated in the course of performed tests, interviews and any other forms of assessment of the presence of relevant knowledge, skills, competences, qualifications, etc.;
(5) Data from communications carried out with You in connection with Your application and participation in the recruitment process;
(6) Other information included in Your application at Your discretion, including information concerning recommendations; a photo; other data which You have included in Your application at Your own discretion, e.g. information about age; date of birth; information contained in CVs, cover letters, other supporting documentation for the application, etc.;
(7) Information collected and prepared by recruitment agencies, to which the Law Firm has assigned separate stages of or the overall recruitment process, such as considering and assessing applications, conducting interviews, etc. (including data from reports, recommendations, etc., prepared by such agencies);
(8) Information contained in other documents required for the conclusion of an employment or civil contract – e.g. a document certifying the level of education, specialty, qualification, professional certification, scientific title or scientific degree acquired, where such is required for the role or position for which the person applies.
If You are selected and appointed to a relevant position with us, the information and documents provided to us within the application and recruitment process could become part of Your file as an employee or contractor (e.g. attorney-at-law at a full-time work at the Law Firm). We will store these documents and information in accordance with the terms for storing data of employees and contractors under civil contract set by us. If You are selected for the relevant position for the purposes of concluding a contract with You (employment or civil contract), it may be necessary that You provide additional information and documents in accordance with the requirements of the applicable law and our internal rules and procedures. In these cases, we will bring to Your attention our Privacy policy for employees and contractors under civil contract of DPC.
Information not to be included in Your application:
In case You wish that we do not process the data specified in item (6) above, please do not include such data in Your application. In addition, we explicitly ask You not to include in Your application and send to us any copies of official identification documents – ID, passport, driving license, residence permit.
3. For what purposes and on what grounds do we process Your personal data?
We may process Your personal data for the following purposes and on the following grounds:
(1) Recruitment for a specific position: When You apply for a specific position with us, we process the personal data specified above in order to consider Your application and to assess to what extent Your qualifications and professional experience meet the requirements for that position. The data we process for this purpose include the data You have provided to us in Your application and the data generated during the recruitment process (e.g. data which became known to us during the interview conducted with You). When considering Your application and carrying out the recruitment, we may contact You through the contact details You have provided for the purpose of conducting interviews or clarifying other matters regarding Your application.
For this purpose, we process Your personal data on the basis of Art. 6, Para 1 (b) of Regulation 2016/679 (“GDPR”/ the “Regulation”) – taking the necessary steps before concluding an employment or civil contract with You, and pursuant to Art. 6, Para 1 (f) of GDPR – legitimate interest, where our legitimate interest is to evaluate the compatibility of Your application with the necessary requirements and to carry out recruitment to fill certain vacancies with us.
(2) Exercise and protection of our legitimate rights and interests or those of third parties such as recruitment agencies, employees, partners and attorneys at the Law Firm (including assistance in exercising and protection of legitimate rights and interests of such third parties): In case of complaints, reporting, etc. to the competent state and judicial authorities, we may process the personal data mentioned above to the extent necessary to exercise or protect our rights and interests or to assist our employees, partners, attorneys or contractors in the exercise and protection of their legal rights and interests.
In these cases, we may process Your Personal data on the basis of Art. 6, Para 1 (f) of GDPR – our legitimate interest in the exercise and defense of legal claims and, accordingly, the legitimate interest of our employees, partners, attorneys or contractors in the exercise and defense of legal claims.
(3) Compliance with the legal obligations: In certain cases and on the grounds of Art. 6, Para 1 (c) of the GDPR, we may process Your personal data in order also to comply with legal obligations that apply to us, such as the obligation to respond to Your request regarding the protection of Your personal data.
(4) Future recruitment: In case You provide Your prior and explicit consent, we may process Your personal data that were provided in spontaneous application (where no vacancy has been posted) or in application to a vacancy posted by us for the purposes of carrying out future recruitment process. This includes listing You in our database of applicants for future recruiting, assessment of Your suitability for a certain position (including a different one from the position You originally applied for, if any), considering Your application and contacting You in this connection.
In such cases, we will process Your personal data on the grounds of Art. 6, Para 1 (a) of GDPR – Your explicit consent. You have the right to withdraw Your consent at any time without detriment. Withdrawal or refusal to consent does not in any way affect Your participation in the recruitment for the particular position You are applying for.
4. Other sources of personal data
In some cases, personal data processed by us in connection with Your application are not collected or received directly from You, but from third parties such as Recruitment Agencies – e.g. when applying through such agencies, and from public sources, such as public registers (e.g. Bar registers), etc.
5. For what period do we store Your personal data?
We will process Your personal data as part of the recruitment process for the position for which Your application is submitted and will store it for a maximum of 6 (six) months after the process is completed. In the event that we have requested You to provide us with originals or notarized copies of documents certifying Your qualifications and professional experience required for the respective position, we will return those documents to You within 6 (six) months of the final completion of the recruitment procedure if You are not approved for appointment.
Where there is an explicit and voluntary written consent on Your part which allows Your data to be processed for a longer period (e.g., for You to be listed in our database of applicants for future recruitment and for participation in future recruitment procedures), we may store this data for up to 2 (two) years from the final completion of the recruitment procedure. If You withdraw Your consent, we will remove Your data from our database and will cease processing Your personal data for future recruitment.
In the event of a legal dispute or proceeding requiring the retention of personal data and/or in the case of a request from a competent public authority, it may be possible that we retain the data for a longer period until the final closure of the proceedings before all instances, as well as for a period of up to 5 (five) years from the date of final completion of that proceeding. Your personal data may also be processed for a longer period than the periods specified above, if this is necessary to achieve the purposes set out in this Notice, or if the legislation in place provides for the processing of the data for a longer period.
6. Who may have access to Your personal data?
Your personal data may be provided to:
• Service providers which process personal data on our behalf such as IT service providers, recruitment agencies, etc. These providers process Your personal data on the grounds of an agreement concluded with us, in strict compliance with our instructions and only to the extent necessary for the performance of the activities assigned to them;
• Postal service providers and telecommunications service providers for the purpose of contacting You;
• Providers of legal and notary services – in case of any need to defend our legitimate interests;
• Competent municipal, state and judicial authorities in accordance with the procedures provided for in the regulations;
• Upon explicit consent – other categories of recipients explicitly specified in the consent.
7. What are Your rights with regard to the processing of Your personal data?
With regard to the processing of Your Personal data by the Law Firm for the purposes specified in this Privacy Notice You have the following rights:
• Right of information: to obtain information regarding the processing of Your personal data on our part. The present notice has been prepared and made available to You with respect to this right.
• Right of access: to obtain confirmation whether personal data relating to You is being processed as well as to obtain access to these data, incl. to request a copy of the data;
• Right of rectification: to request rectification or completion of Your personal data in case the data are inaccurate or incomplete;
• Right of erasure: to request the erasure of Your personal data if there are the grounds for this provided for in the Regulation;
• Right of restriction of processing: to request restriction of processing of Your personal data within the limits provided for in the Regulation, if there are grounds for this;
• Notification of third parties to whom the personal data has been provided, of any rectification, erasure or restriction of processing of personal data unless this is impossible or requires a disproportionate effort on our part;
• Right of data portability (if applicable): to receive the personal data which You have provided to us, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance if there are the grounds for this provided for in the Regulation;
• Right not to be subject to a decision based solely on automated processing (i.e. without human intervention), including profiling within the meaning of the Regulation. For avoidance of any doubt we do not process Your personal data in this manner.
• Right to withdraw consent for processing, at any time and without detriment, when the processing is based on consent;
• Right to lodge a complaint with a data protection supervising authority in case You consider that the processing of Your Personal data infringes the Regulation or any other applicable requirements for data protection. The data protection supervising authority in the Republic of Bulgaria is the Commission for Personal Data Protection, with its registered address: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, Website: https://www.cpdp.bg/.
• Right to object to processing of Your personal data, which is based on legitimate interest, pursuant to Art. 6 (1) (e) GDPR, as specified above. In the event of such an objection, we will consider Your request and, if it is reasonable, we will comply with it. If we believe that there are compelling legal grounds for processing, or that it is necessary to establish, exercise, or defend legal claims, we will inform You of that.
You may exercise Your rights by submitting a written request to us using the contact details specified above in this Notice in accordance with the requirements of the applicable law.
This Notice is effective as of 25 May 2018. It is last amended on 16 September 2021.
