Personal Data Protection Policy

1. General Provisions

This Personal Data Protection Policy (hereinafter referred to as the “Policy”) governs the manner in which Ivanova Dimitrova Law Firm collects, processes, stores, and protects the personal data of individuals who visit the firm’s website, submit inquiries, use the legal services offered, or otherwise enter into relations with the firm.

The Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter referred to as the “Regulation” or “GDPR”), the Personal Data Protection Act (PDPA), and other applicable national and European legislation.

The firm processes personal data in strict compliance with the Bar Act, including the obligation to maintain attorney-client privilege, which takes precedence and complements the protection provided to data subjects by the Regulation.

By visiting the firm’s website and/or providing your personal data, you confirm that you have read and understood this Policy.

2. Data of the Personal Data Controller

The personal data controller is Ivanova Dimitrova Law Firm, registered in the register of law firms at the Sofia Bar Association, with the following contact details:

Name: Ivanova Dimitrova Law Firm
BULSTAT/UIC: 181314472
Registered office and management address: Sofia, p.c. 1408, Ivan Vazov district, 36 Petko Karavelov Blvd., fl. 1, office 1
Correspondence address: Sofia, p.c. 1408, Ivan Vazov district, 36 Petko Karavelov Blvd., fl. 1, office 1
Email: ivanova_dimitrova@mail.bg
Telephone: +359 888 876 366
Website: https://lawfactor.bg

Partners in the firm are Atty. Anelia Ivanova and Atty. Kristiyana Dimitrova, members of the Sofia Bar Association.

For all matters related to the processing of your personal data and the exercise of your rights, you may contact the firm at the address and email provided above. The firm is not legally required to appoint a Data Protection Officer (DPO); if one is appointed, their contact details will be published in this Policy.

3. Key Concepts

For the purposes of this Policy, the terms used have the meaning assigned to them by the Regulation, and in particular:

“Personal data” — any information relating to an identified or identifiable living natural person (e.g., names, PIN, address, telephone, email, ID card details).
“Processing” — any operation performed on personal data — collection, recording, organization, storage, use, disclosure, restriction, erasure, or destruction.
“Controller” — the person who determines the purposes and means of processing personal data; in this case, it is the firm.
“Processor” — a person who processes data on behalf of and under the instructions of the controller (e.g., a provider of accounting or information services).
“Data subject” — the natural person to whom the data relates.
“Special categories of data” — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, data concerning health or sexual life, as well as data related to criminal convictions and offenses within the meaning of Art. 10 of the Regulation.

4. Processing Principles

The firm processes personal data in compliance with the following principles:

lawfulness, fairness, and transparency;
purpose limitation — processing for specific, explicit, and legitimate purposes;
data minimization — limited to what is necessary for the respective purpose;
accuracy and keeping data up to date;
storage limitation — for no longer than necessary;
integrity and confidentiality — ensuring an appropriate level of security;
accountability — the firm can demonstrate compliance with the above principles.

5. Whose Personal Data We Process

In the course of its activities, the firm may process personal data of the following categories of persons:

clients and potential clients — natural persons, as well as natural persons who represent or manage clients — legal entities;
persons who have made an inquiry via the website, email, or telephone;
counterparties, their representatives, witnesses, and other persons whose data is contained in the materials of the assigned cases and files;
contractors, suppliers, and partners of the firm and their representatives;
candidates for employment and cooperation with the firm;
visitors to the firm’s website.

6. What Personal Data We Process

Depending on the specific legal relationship, the firm may process the following categories of personal data:

Identification and contact data: first, middle, and last name, PIN or Foreigner’s Personal Number, ID document details, address, email, telephone.
Data in connection with the legal service provided: information, documents, and circumstances provided by the client or contained in the case materials or file and necessary for the protection of their rights and interests.
Financial and accounting data: bank account, data on payments made, and invoicing.
Technical data from the website visit: IP address, device and browser type, operating system, data on pages visited and time of visit, collected through cookies and similar technologies (see the separate Cookie Policy).

Special categories of data. Due to the nature of legal practice, it is possible that in providing legal services, the firm may process special categories of data (e.g., health data in family, inheritance, or insurance cases) and data related to criminal convictions and offenses under Art. 10 of the Regulation. Such data is processed only to the extent necessary for the establishment, exercise, or defense of legal claims and for the performance of the assigned legal service, and under enhanced security measures.

Third-party data. When a client provides us with personal data of third parties (e.g., an opposing party, family member, or witness), the client is responsible for ensuring they have a legal basis to provide it to us. The firm processes this data within the scope of the assigned service and under the conditions of attorney-client privilege.

7. For What Purposes We Process Personal Data

The firm processes personal data for the following purposes:

providing legal consultations, drafting documents, and procedural representation and defense;
concluding and performing contracts for legal aid and assistance, as well as managing client relations;
responding to inquiries made via the website, email, or telephone;
invoicing, reporting, and fulfilling the firm’s accounting and tax obligations;
fulfilling the firm’s obligations as an obliged entity under the Measures Against Money Laundering Act, including client identification and storage of collected information;
fulfilling other legal obligations of the firm, including providing information to competent state authorities when required by law;
protecting the legitimate interests and rights of the firm, including the establishment, exercise, and defense of legal claims;
with explicit consent — sending information about the firm’s activities and other communications.

8. On What Basis We Process Personal Data

The firm processes your personal data on one or more of the following legal bases under Art. 6 of the Regulation:

performance of a contract (Art. 6, § 1, (b)) — when processing is necessary for the conclusion and performance of a legal aid contract or to take steps at your request prior to entering into a contract;
legal obligation (Art. 6, § 1, (c)) — when processing is necessary for compliance with a legal obligation to which the firm is subject, including under the Bar Act, accounting and tax legislation, and the Measures Against Money Laundering Act;
legitimate interest (Art. 6, § 1, (f)) — when processing is necessary for the protection of the firm’s legitimate interests, provided they prevail over the interests and rights of the data subject; such interests include, for example, website security, collection of due fees, and defense against claims;
consent (Art. 6, § 1, (a)) — when you have given explicit consent for a specific purpose; consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal;
protection of vital interests and public interest — in cases provided for by law.

The processing of special categories of data and data on criminal convictions and offenses is based on Art. 9, § 2, (f) and Art. 10 of the Regulation — processing is necessary for the establishment, exercise, or defense of legal claims, as well as for the practice of the legal profession in accordance with the Bar Act.

9. Attorney-Client Privilege

All information entrusted by the client to the firm constitutes attorney-client privilege and enjoys the special protection of the Bar Act. According to the law, an attorney is obliged to keep their client’s secrets without limitation in time, and papers, files, correspondence, and materials related to the client’s defense are inviolable and not subject to review, inspection, copying, or seizure.

The protection provided by attorney-client privilege applies alongside the rules for personal data protection and, in the event of a conflict, ensures a higher level of protection for the client’s interests.

10. To Whom We May Disclose Personal Data

The firm does not sell or provide personal data to third parties for remuneration. Personal data may be disclosed only when necessary to achieve the purposes under point 7 and in the presence of a legal basis, to the following categories of recipients:

courts, state and municipal authorities, pre-trial investigation bodies, bailiffs, notaries, and other competent authorities — within the scope of the assigned legal service or by virtue of law;
personal data processors who provide services to the firm (e.g., accounting services, IT system maintenance, website hosting), acting under written assignment and with data protection guarantees;
banks and payment service providers — in connection with making payments;
other persons when required by law or necessary for the protection of the firm’s rights and legitimate interests.

Any disclosure is carried out in compliance with attorney-client privilege and in the minimum necessary volume.

11. Transfer of Data to Third Countries

As a rule, the firm processes and stores personal data within the territory of the Republic of Bulgaria and within the European Union and the European Economic Area. The firm does not transfer personal data to third countries or international organizations unless necessary for a specific legal service or required by law, in which case the transfer is carried out in the presence of appropriate safeguards within the meaning of Chapter V of the Regulation.

12. Data Retention Period

The firm stores personal data for a period no longer than necessary to achieve the purposes for which they are processed, except when a longer period is required by law. Specifically:

case materials and files: at least 5 years from the conclusion of the respective case or file according to the Bar Act;
accounting and tax documents: for the periods provided for in accounting and tax legislation;
documents under the Measures Against Money Laundering Act: for the periods provided for in this Act;
data from inquiries that do not lead to a contract: for a reasonable period necessary for their processing, after which they are deleted;
data processed based on consent: until withdrawal of consent or until the purpose no longer exists.

After the expiry of the applicable period, personal data is deleted or destroyed in a secure manner.

13. Automated Decision-Making

The firm does not perform automated decision-making, including profiling, that would produce legal effects for data subjects or significantly affect them in a similar way.

14. Cookies

The firm’s website uses cookies and similar technologies. Detailed information about their purpose, the types of cookies used, and how to manage them is contained in the separate Cookie Policy, which is an integral part of this Policy and the General Terms and Conditions.

15. Data Security

The firm implements appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Access to personal data is granted only to persons for whom it is necessary in connection with the firm’s activities and who are bound by a confidentiality obligation. Security measures are reviewed and updated in accordance with technological developments and applicable requirements.

16. Your Rights

In connection with the processing of your personal data and under the conditions of the Regulation, you have the following rights:

right to information and access — to receive confirmation as to whether we process your data and a copy thereof;
right to rectification — to request the correction of inaccurate or completion of incomplete data;
right to erasure (“right to be forgotten”) — to request the deletion of data when there is no basis for its processing;
right to restriction of processing in cases provided for by law;
right to portability — to receive the data you have provided to us in a structured, commonly used, and machine-readable format;
right to object to processing based on legitimate interest;
right to withdraw consent at any time when processing is based on consent;
right to lodge a complaint with the supervisory authority.

Restrictions. The listed rights are not absolute and may be restricted when processing is necessary for compliance with a legal obligation of the firm, for the storage of case materials according to the Bar Act, for the fulfillment of obligations under the Measures Against Money Laundering Act, or for the establishment, exercise, and defense of legal claims. In particular, the right to erasure does not apply when storage is mandatory by law.

Procedure for exercise. You may exercise your rights by submitting a request in free text to the firm at the contact details specified in point 2. For the purpose of protecting your data, we may request additional information to establish your identity. The firm shall respond within one month, which may be extended if necessary. The exercise of rights is free of charge; in the case of manifestly unfounded or excessive requests, in particular because of their repetitive character, the firm may charge a reasonable fee or refuse to act.

17. Right to Lodge a Complaint with the Supervisory Authority

If you believe that the processing of your personal data violates applicable legislation, we would appreciate it if you first contact the firm to clarify the matter. Regardless of this, you have the right to lodge a complaint with the supervisory authority:

Commission for Personal Data Protection (CPDP)
address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592;
email: kzld@cpdp.bg;
website: www.cpdp.bg.

18. Changes to the Policy

The firm reserves the right to amend and supplement this Policy in the event of a change in the way data is processed or in the applicable legislation. The current version is always available on the firm’s website. In the event of significant changes, the firm may announce the changes in an appropriate manner. Please check the content of this Policy periodically.