Privacy Policy

Personal Data Protection Policy of Stoychev, Dr Valkov & Co Law Firm

Stoychev, Dr Valkov & Co Law Firm is an association of lawyers entered in the register of the Sofia Bar Association and also as an association under the Obligations and Contracts Act in the BULSTAT Register under No. 175250218, with registered office at Sofia, 20 Damyan Gruev Street, 4th floor, Apartment 9. The lawyers participating in the firm are Georgi Stoychev, Grigor Valkov, Anton Kolarov and Delina Pavlova, all members of the Sofia Bar Association.

Stoychev, Dr Valkov & Co Law Firm and the lawyers associated in it are registered as a personal data controller under the applicable Personal Data Protection Act (PDPA) and protect, use, process and store the personal data received in accordance with the provisions of the Act and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), applicable from 25 May 2018.

The information in this section is aimed at every natural person, regardless of whether they are personally in a legal relationship with Stoychev, Dr Valkov & Co Law Firm, as a representative, authorised person or employee of a legal entity, or are a visitor to this site. This section is intended to inform persons about the personal information we collect, why we collect it, and the manner and periods in which we process and protect it. The data protection policy also aims to explain the rights that natural persons have in connection with the processing of their personal data.

Personal data

‘Personal data’ means any information relating to an identified natural person or a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, personal identification number (EGN), location data, an online identifier (email, IP address and others) or to one or more factors specific to the physical, physiological, genetic, mental, intellectual, economic, cultural or social identity of that natural person.

Processing of personal data

‘Processing of personal data’ means any operation or set of operations performed on personal data by automated or other means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal data processed

The law firm/the lawyers within it process various types of personal data of their clients and of third parties indicated by clients, depending on the purposes and statutory requirements: identification data (full name, personal identification number (EGN), address, data from an identity document), contact information (names, address, email address, telephone number), bank information and other information provided in connection with the assigned legal work, without which that work cannot be performed. The data are processed electronically and on paper.

Grounds for collecting, processing and storing your personal data

Stoychev, Dr Valkov & Co Law Firm collects and processes the personal data provided only on the grounds provided for by law, namely: a) consent to the processing of personal data for one or more specific purposes; b) where processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; c) where processing is necessary for compliance with a legal obligation to which the controller is subject; d) where processing is necessary for the purposes of the legitimate interests of the controller or of a third party; e) other grounds laid down by law. The provision of personal data is always voluntary and may be withdrawn at any time.

Methods of collecting personal data

The provision of personal data is always voluntary and may be withdrawn at any time.

We collect personal data through the contracts we conclude with the client, the information provided by the client, including by email, as well as from third parties, including public sources.

Purposes of collecting, processing and storing your personal data

The information collected from and in relation to natural persons – data subjects – is processed by Stoychev, Dr Valkov & Co Law Firm solely for identification for the conclusion, performance and amendment of contracts, the provision of requested services, as well as for compliance with the controller’s legal obligations and requirements of state and municipal authorities and commissions.

Stoychev, Dr Valkov & Co Law Firm does not require the provision of personal information in order to browse the firm’s website or to access most of its content.

Personal data processed

Stoychev, Dr Valkov & Co Law Firm processes various types of personal data depending on the purposes and statutory requirements: identification data (full name, personal identification number (EGN), address, data from an identity document), contact information (names, address, email address, telephone number), bank information and other information necessary for the performance of the assigned work.

The data are processed electronically and on paper, on the basis of information provided by the data subject and by third parties, including public sources.

Period for storing personal data

Stoychev, Dr Valkov & Co Law Firm will process your personal data for a period no longer than the period necessary to achieve the purposes for which they are processed (5 (five) years after the end of the calendar year in which the contract expired or, respectively, the performance of the work assigned by the client ended) and an additional period of time for tax purposes or to comply with legislative requirements.

After the expiry of the data storage periods, Stoychev, Dr Valkov & Co Law Firm takes the necessary care to erase and destroy all your data without undue delay, with any storage of the data carried out in anonymised form, unless the data are necessary for pending judicial, administrative or other proceedings for the consideration of a legal dispute with us.

Provision of personal data to third parties

For the purposes of processing and in accordance with applicable law, the personal data collected by Stoychev, Dr Valkov & Co Law Firm may be processed and included in the database of third parties – subcontractors of Stoychev, Dr Valkov & Co Law Firm on a contractual basis, as well as of another person where this is provided for in a statutory instrument or is necessary for the performance of the assigned work. Stoychev, Dr Valkov & Co Law Firm will notify you in the event of an intention to transfer part or all of your personal data to third countries or international organisations.

Rights of the data subject in the collection, processing and storage of their personal data

Every person has the right:

• to obtain access to the personal data relating to him or her;
• at any time to request that Stoychev, Dr Valkov & Co Law Firm: 1) rectify, erase or restrict his or her personal data whose processing does not meet the requirements of applicable law, and 2) notify the third parties to whom his or her personal data have been disclosed of any rectification, erasure or restriction carried out in accordance with the preceding point, except where this is impossible or involves excessive effort for Stoychev, Dr Valkov & Co Law Firm;
• to obtain direct transfer of the personal data from one controller to another (right to portability) where this is technically feasible;
• to object to the processing of his or her personal data before Stoychev, Dr Valkov & Co Law Firm where there is a legal ground for this; where the objection is justified and there are no compelling legal grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims;
• to lodge a complaint with a supervisory authority;
• to all other rights under the Personal Data Protection Act and the General Data Protection Regulation.

Requests, enquiries and objections may be submitted in writing to the address of Stoychev, Dr Valkov & Co Law Firm: 7 Hristo Belchev Street, 4th floor, Sofia, or by email [email protected].

The competent supervisory authority is the Commission for Personal Data Protection, address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, telephone: 02 915 3 518, website: www.cpdp.bg.

Protection of personal data

Stoychev, Dr Valkov & Co Law Firm has adopted a policy and instructions to ensure the confidentiality and protection of personal data. The firm takes the necessary technical and organisational measures to protect the data against accidental or unlawful destruction, or accidental loss, unauthorised access, alteration or dissemination, as well as against other unlawful forms of processing.

This policy is current as at 15.05.2018. It may be amended on the initiative of Stoychev, Dr Valkov & Co Law Firm or by a competent authority due to amendments to applicable law. Notification of persons of changes to the personal data protection policy is effected by publishing it on the firm’s website www.sv-lawfirm.com.

Processing in connection with legal practice

In the event of an enquiry, conflict check, negotiations for the assignment or provision of legal assistance, the firm may process identification, contact, contractual, financial, procedural and other data that are necessary for the assessment and handling of the specific matter. Depending on the case, the information may also relate to representatives, employees, counterparties, opposing parties, witnesses, experts and other participants.

Professional secrecy and restricted access

Access to the information is granted only to persons for whom this is necessary in connection with the assigned work, administrative services, security or a legal obligation. Members of the team and engaged specialists are bound by the applicable professional and contractual confidentiality obligations. Legal professional privilege applies alongside the rules on personal data protection.

Data in an email enquiry

In the event of an email enquiry, your name, organisation, email, telephone, description of the matter, preferred method of contact and documents that you choose to send may be received. The data are used to respond, carry out an initial assessment, perform a conflict check, protect against abuse and organise subsequent communication. Please provide only what is necessary and do not send particularly sensitive materials before confirmation.

Legal bases

Depending on the context, processing may be based on taking steps at your request prior to a contract, performance of a legal assistance contract, a legal obligation, a legitimate interest in security, protection of rights and management of correspondence, as well as on explicit consent where required by law. Consent is not used as a universal basis where another basis applies.

Special categories and data on offences

Some legal cases may necessarily involve health data, political or religious beliefs, membership of organisations, biometric data, data on convictions or offences. Such data are processed only where relevant and where an applicable legal basis exists, including for the establishment, exercise or defence of legal claims and in compliance with professional safeguards.

Recipients and professional partners

Where necessary and permissible, data may be provided to courts, administrative and investigating authorities, notaries, enforcement agents, translators, experts, accountants, correspondent offices, providers of secure IT and communication services and other persons involved in the case. Only the necessary volume is provided and appropriate safeguards are applied.

International transfers

In an international matter or where a provider outside the European Economic Area is used, it may be necessary to transfer data. In such a case, the existence of an applicable mechanism is checked, for example an adequacy decision, standard contractual clauses, necessity for legal claims or another permissible safeguard.

Retention periods and criteria

Data are kept for the period necessary for the purpose, for the performance of professional and legal obligations, for accountability and for the establishment, exercise or defence of rights. When determining the period, account is taken of the type of matter, the contractual relationship, the applicable limitation and archival periods, legal professional privilege obligations and the existence of a dispute. Declined enquiries are stored only to the extent necessary for communication, conflict checks, security and the protection of legitimate interests.

Security

Organisational and technical measures are applied according to risk, including access management, restriction of access rights, archiving, protection of devices and systems, instructions to the team and control of suppliers. No electronic system is absolutely secure; if you suspect an unlawful message or file, contact the firm through an independent channel.

Rights of individuals

Under the conditions of the GDPR, you may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest. Where the basis is consent, you may withdraw it. Rights are not absolute and may be restricted where this is necessary for legal professional privilege, the rights of other persons, legal claims or the performance of a legal obligation.

Requests and complaints

Requests may be submitted to [email protected]. Reasonable identification may be requested for data protection purposes. You have the right to lodge a complaint with the Commission for Personal Data Protection or a competent court, without prejudice to other remedies.

Automated decisions

The website does not use automated decision-making that produces legal effects or similarly significantly affects you. The initial assessment and decisions on accepting instructions are made by people.