Skip links

Privacy policy

PRIVACY NOTICE

in reference to practicing the attorney-at-law profession

(notification for confidential treatment of personal data)

To

CLIENTS, who assign to us LEGAL SERVICES

ALL SUBJECTS, relevant to our legal assistance and cooperation

OUR PARTNERS and other CONTRACTORS

CANDIDATES, who wish to join our TEAM

We, Legaltera Law firm, UIC: 180796215, address: Sofia, neighbourhood “Yavorov”, Str. “Khan Omurtag” № 74, floor: 1, app. 1., reg. under file № 6621/2007 by the Sofia City Court, member of Sofia Bar Association,have committed, during and in reference to the exercise of our attorney-at-law profession, to process personal data in accordance with the General Data Protection Regulation (GDPR, (EU) 2016/679),  the  Bulgarian Personal Data Protection Act and in compliance with the Constitution of the Republic of Bulgaria, the Bulgarian Bar Act, the Bar Code of Ethics, a number of procedural laws and the rest applicable law to our profession.

When we determine the purposes and means of the processing of personal data, such as when we process the data of our clients, partners and contractors, and data of the candidates who wish to participate in our team, we are responsible for that data as a controller within the meaning of the General Data Protection Regulation.

During and in reference to the exercise of our attorney-at-law profession, we are required to process a wide range of personal data, incl. data of persons who are involved in the legal assistance and cooperation we have been assigned, but have nothing to deal with us.

All this data is part of the relevant client file (case). Very often and usually when advising clients on legal matters, incl. drafting contracts and other legal acts, we process personal data on behalf of our client, who has provided the data to us, and in his capacity of administrator of the personal data, has determined the purposes and means for the data processing.

There are situations, usually when we provide complex legal services or work closely with the client on a case-by-case basis, wherein we and the client jointly determine the purposes and the means of data processing in the client’s cases.

However, there are also situations, usually in the litigation process, but also in instances where we have been asked for advice, where the client has given us complete freedom to judge how to organize his or her legal defence and assistance, as well as when we have been assigned with protecting the client’s interests without the right to disclose the client, wherein we independently determine for what and how to collect and process certain personal information.

Whenever we process personal data on client files, either as an administrator or as a processor, we are guided solely by the legitimate interests of the particular client(s), who we have a duty to protect in the best way by lawful means, bearing the relevant responsibility with respect to the data subjects under the General Data Protection Regulation and by law in general.

The personal data we collect and process:

  • Basic personal data of the clients – identification data, contact details.
  • A wide range of various personal data on client files (cases), containing ordinary (general) personal information such as names, Personal Identification Number/personal number of foreigner; address; date of birth; personal identity card details; place of birth; citizenship; telephone number; email address, etc., but also special categories of personal data might be processed, such as health data, political opinion data, ethnic data, philosophical and ideological belief data, syndicate union membership data, biometric data, sexual life and orientation data, etc.
  • Basic personal data of our partners and contractors – identification data; contact details; occupied office or position.
  •  When we perform complex verification of clients, partners and contractors in accordance with the requirements of the Bulgarian Anti Money Laundering Measures Act (AML Act), we also process additional data, such as identity documents; country of residence and address; profession/activity (position, nature); whether the person is a prominent political figure or is associated with such a person; information for the origin of the funds.
  • Basic personal data for the candidates who wish to join the team – data on their identity; contact details; autobiography/CV, containing at least education data; foreign language skills; professional skills and qualifications; previous professional experience.

Source: We receive the above personal data from you personally, from the client, who assigns data processing to us, or we collect data from publicly available databases or databases to which we are entitled to access for the exercise of our legal profession, including, where necessary, through court intervention (such as the Commercial Register, the Real Estate Register, court files, files of court or administrative authorities, etc.).

We declare that the personal data we collect will only be used for legitimate purposes, such as:

  • We process client’s data for the purpose of their identification, communication with them at and on the occasion of receiving, executing and transfer of the assigned legal service, for the needs of active / passive legal protection and for financial accounting;
  • We process personal data contained in client files solely for the purpose of providing adequate, effective  and complete legal protection and assistance to a particular CLIENT; we do not extract personal data from the contents of the files and do not process them outside the context of the assigned service; we undertake to restrain from using the personal data for any purpose other than the purpose stated here; if a client wishes from us to process personal data for other purposes, the client should assign this in advance and in writing;
  • We process the data of our partners and contractors for the purpose of establishing their representative power, for concluding and properly executing a contract and for the needs of active/passive legal protection.
  • The data collected for clients, partners and contractors under the AML Act is processed solely to prevent money laundering and terrorist financing;
  • We may process part of the personal data (names, contact details, place of employment, position) for direct marketing purposes;
  • We process the data of the candidates who wish to join our team in order to fill vacant or newly created positions with the persons suitable for them, as well as to contact the candidates.

The grounds that entitle us to process your data:

  • We process the personal data of our clients on the basis of the steps taken by them to assign or based on direct assignment of legal protection and assistance; when the client is a legal entity, as well as always when the client is represented by another person, we have a legitimate interest in establishing the proper exercise of representative powers, in view of the legal consequences under the Bulgarian Obligations and Contracts Act and the Commerce Act, as well as in the preparation of accounting documentation, record keeping and communication; in many cases, it is impossible for us at the assignment stage, and even subsequently, to determine whether the client’s documents contain third party personal data, and therefore we have a legitimate interest in collecting personal data of the client that may not be required to perform the service (as a unique identifier and address), but to enable us to identify the client in a way that allows the data subjects to be directed to the client – controller, who has transferred their data, in order to exercise their rights toward the client;
  • An occasion for processing personal data in client files is always a specific case of a client who has requested legal protection or assistance from us; the ground on which we process personal data provided by the client is always our contract with the client for legal assistance, as depending on the case, this contract may constitute a ground under Art. 6, paragraph 1, letter. b) by the GDPR for our processing of personal data as an administrator or an agreement under Art. 28 of the GDPR for processing and explicit written assignment by the respective client to us, as a processor of personal data, or an agreement under Art. 26 of the GDPR for the processing of data by joint administrators; in certain situations, the processing of personal data may be based on our need to comply with legal obligations that apply to us, for example when, in accordance with a statutory requirement of a procedural or substantive law, a document drawn up by us (application, complaint, labor contract, notary deed, etc.) should contain certain personal data; in addition, we collect and process personal data ex officio, as this may also be grounded on our legitimate interest in providing quality legal services; very often, when third party’s data processing is required, such processing is based on the legitimate interest of the client to receive adequate protection of his recognized right or legitimate interest;
  • When it is necessary to process special categories of personal data, it is usually carried out in order to establish, exercise or protect the legal claims of the CLIENT. In some situations, it is possible for our law firm to process special categories of personal data on any of the other grounds provided for in the General Data Protection Regulation, inter alia processing of personal data that has been made publicly available by the data subjects (for example through interviews, publications, including in their profiles on social networks, etc.); the processing of data necessary for reasons of public interest, necessary for the purposes of the preventive or labour medicine; for the assessment of ability to work or medical diagnosis; necessary for reasons of public interest in the field of public health; and on the grounds of the explicit consent of the data subject when there is no alternative basis for the processing of data;
  • We process the personal data of our partners and contractors on the basis of the need to fulfill our contractual relations with them, as well as on the legitimate interest in establishing the proper exercise of representative power, in view of the legal consequences of the Bulgarian Obligations and Contracts Act and the Commerce Act, the preparation of commercial documentation and keeping of communication;
  • The processing of data of clients, partners and contractors for the purposes of the prevention of money laundering and terrorist financing is carried out solely on the basis of the need to fulfill specific obligations under the BgAML Act, its Implementing Regulations, and the Bulgarian Measures Against the Financing of Terrorism Act;
  • For the purposes of direct marketing, in the case of long-term relationships with our clients, partners and contractors, we process personal data on the basis of our legitimate interest in marketing communication, but in the other cases of direct marketing by our law firm or our partners, we will request the explicit written consent of the subjects, who themselves may give such consent  at any time;
  • The processing of data of candidates is based on the steps taken at their request to take a position in our team, and when the data will be retained for further selection or transferred to our partner for recruitment, this processing shall be based on the consent of the candidate;
  • There is no obstacle, when we process personal data, in certain cases to rely on the explicit consent of the data subject, but considering the possibility of such consent to be withdrawn at any time and the consequences of such withdrawal, the consent will be used by us, only when there is no alternative legal basis for processing.

Processing period:

We will only process your personal data as long as necessary to achieve the set purposes. In general, where a relationship with a client, partner or contractor is in place, personal data (including those in client files) will be processed throughout the lifetime of that relationship, resp. all the time while we are running a case, after which the data shall be archived until the expiry of the limitation periods for claiming responsibility by/to the data subject and/or by a public authority in reference to the legal relationship (5 years in the general case, unless otherwise required by law).

Outside the general situation, we process personal data within the following time periods:

  • personal data processed in fulfilment of the obligations under the BgAML Act will be stored for a period of 5 years. In the case of establishment of business relations with clients, partners and contractors, as well as in the case of entering into correspondent relations, the period starts at the beginning of the calendar year following the year of termination of the relations; in the case of incidental operations or transactions, the period starts at the beginning of the calendar year following the year in which they were carried out; in the case of disclosure of information to the Financial Intelligence Directorate of the State Agency for National Security, the period starts at the beginning of the calendar year following the year of the disclosure; at the written instruction of the Director of the Financial Intelligence Directorate of the State Agency for National Security, the term may be extended by not more than two years, unless there is explicit and voluntary written consent from the data subject allowing the data to be processed for a longer period;
  • It is possible that the texts of documents created in reference and on the occasion of the provided legal protection and assistance may be useful and preserved by us in order to improve the quality of the practised legal profession, as well as client papers, the court acts and another information from a client file collected in reference and on the occasion of the legal protection and assistance to be preserved by us for the purpose of scientific researches in the legal sphere; in such cases, we will depersonalize and anonymize the personal data contained in the file, through which the subjects will no longer be able to be related to the CLIENT’s file and we will in practice not process their personal data.
  • When acting as a personal data processor, we are obligated, at the client’s choice, to delete or return to the client (the data controller) all personal data after the completion of the processing services and to delete the existing copies, unless EU or Bulgarian law requires their storage, such as the requirement of Art. 47 of the Bar Act for storage of the court case files within 5 years after their completion;
  • The data of the candidates to join our team will be stored for no more than 6 (six) months after the recruitment process is completed unless there is explicit and voluntary written consent from the data subject allowing the data to be processed for a longer period.

Beyond the periods specified above, we may only process personal data for a period of time specified in a special law or for the time necessary for us to establish, exercise or defend legal claims, as well as to provide required by-law assistance to competent authorities for the investigations they carry out and also if personal data will be processed  for archiving purposes, for purposes in the public interest, for scientific or historical research purposes and for statistical purposes.

Whenever processing outside the time limits specified is necessary, such processing shall be carried out in a justified and proportionate manner, by taking appropriate technical and organizational measures to ensure the interests and fundamental rights and freedoms of the data subjects.

If personal data is processed only on basis of the consent of the data subject, we will delete the personal data when the data subject has withdrawn his or her consent for the processing.

When personal data is processed on the basis of legitimate interest and the data subject objects to the processing, we will delete the personal data unless we are able to prove that there are compelling legal grounds for processing that have priority over the interests, rights and freedoms of the objecting subject, or for the establishment, exercise or protection of legal claims.

When personal data is provided to us by the data subject without a legal basis under Art. 6, § 1 of the GDPR or in contradiction with the principles under Art. 5 of the GDPR, within one month of knowing, we will return them, and if this is impossible or requires a disproportionate effort, we will delete or destroy them.

We do not perform automated individual decision-making (without human intervention) in the processing of your personal data for any of the above purposes.

Recipients of your personal data:

We will only provide personal information to individuals and authorities (organizations) who are relevant to the achievement of the purposes described above, with strict observance of the confidentiality rules under the Bulgarian Bar Act and the Attorney Code of Ethics.

Above all, these are our associated attorneys-at-law, who we work with, our assistants and technical staff, and other persons who support us in the legal profession, such as translators, experts in various fields, etc., as well as individuals who assist us in achieving the purposes described above: accountants, human resources consultants, etc. These persons, as processors of personal data, resp. sub-processors (as the case might be) act on the basis of a written agreement with us, in accordance with our explicit instructions and with the implementation of appropriate technical and organizational measures to protect  personal data. We guarantee that these individuals are committed to the confidentiality of the personal information we provide to them for processing.

Personal data may also be shared with other recipients – our professional service providers – data controllers whose activities, incl. on the processing of data, are regulated by law (banks, insurance companies, couriers, etc.), as well as with competent public authorities (such as the Bulgarian National Revenue Agency, National Insurance Institute, court bodies, etc.) and/or private persons (Bailiffs, Notaries-Public, etc.) at and in the exercise of their powers of authority.

Depending on the nature of the particular service assigned by the client, we may provide personal information contained in the client files to relevant public authorities or authorized persons and organizations – controllers of personal data for the performance of the relevant activity or a service, for example, to revenue authorities when declaring circumstances or obtaining certificates; to registry authorities for recording acts and circumstances; to municipal authorities for providing documents, to Notaries-Public for execution of deals or verification of documents; to Bailiffs for claiming debts; to banks and insurance institutions and so on.

We may provide personal data processed in the performance of our obligations under the BgAML Act to the Financial Intelligence Directorate of the State Agency for National Security, only if there are prerequisites in the legislation, such as suspicion and/or knowledge of money laundering and/or available funds with criminal origin, as well as any payment in excess of BGN 30,000 or their equivalent in a foreign currency.

Personal data will not be shared outside the European Union or the European Economic Area, unless otherwise instructed by our client or when we are obliged to do so under EU or Member State law, in which case we will inform the client for this legal requirement prior to processing, unless the right which obliges us to transfer the data prohibits us from such information on important grounds of public interest.

In exceptional circumstances, it is possible that we may provide the personal data to a person(s) or structure who acquires our attorney-at-law activity and/or assets, or relevant parts thereof, or to another person(s) when required by law.

Security of personal data:

We will process personal data, either as an administrator or as a processor, upon taking necessary and sufficient technical and organizational measures for their protection. Among others, we have adopted the necessary internal policies and have taken steps to protect your personal data at the design stage; all the attorneys-at-law and staff members responsible for the data, as well as the outsourcers engaged, are well-informed of the personal data protection requirements; the processing of your personal data is limited to the minimum necessary to achieve the relevant purposes; we have implemented the necessary security measures for data confidentiality and integrity.

Your rights as a personal data subject:

At any time while we store or process your personal data, you are the subject of this data and you have the following rights:

  • Right of ACCESS

You can request confirmation that personal data relating to you are being processed and, if so, access to the data, respectively a copy of the same, as well as processing information. The right to receive a copy of personal data should not adversely affect the rights and freedoms of others. Additional copies requested by the entity may be subject to a reasonable fee in view of the administrative costs involved;

  • Right to RECTIFICATION

You have the right to request the correction of personal data when it is inaccurate and when it is no longer up-to-date, as well as the filling in of your personal data which is incomplete. We will notify all recipients to whom personal data have been provided, of any correction of personal data, except where this is not possible or involves excessive efforts and, upon request, will inform the data subject of such notified recipients.

  • Right of ERASURE (right “to be forgotten”)

You have the right to wish to erase your personal data without undue delay, if and to the extent necessary for the purposes of Art. 17 of the GDPR and/or Bulgarian law, in the cases inter alia when: personal data are no longer necessary for the purposes for which they were collected; when the subject has withdrawn its consent; when the subject has objected to the processing and there are no legitimate grounds for the processing to take precedence; when processing is unlawful; when personal data have to be deleted in order to comply with a legal obligation under EU law or Bulgarian law. In exercising this right, similar to the right of rectification, we will notify all recipients to whom personal data have been provided, of the deletion of the data, except where this is not possible or involves excessive efforts and, upon request, will inform the subject of the data of the recipients so notified. When we have made personal data public and are required to delete personal data, we, taking into account available technology and implementation costs, will take reasonable steps, including technical measures, to notify the data controllers that the data subject has requested the deletion from these administrators of any links, copies or replicas of this personal data.

  • Right to RESTRICT the processing

You have the right to request a restriction on processing, if and to the extent applicable in the light of the grounds of art. 18 of the GDPR and/or the Bulgarian law, in cases, inter alia: when challenging the accuracy of the time data required for their verification; in case of irregularity of processing and the subject’s desire to limit the use of the data instead of deleting them; in the case of objection to processing based on public interest, the official  powers of the controller, the legitimate interest of the controller or third parties. Limited data processing usually comes down to pure storage. In the exercise of this right, similar to the right of rectification and the right of erasure, we will notify all recipients to whom personal data have been provided of the restriction of processing, except where this is not possible or involves excessive efforts, as requested, we will inform the data subject of the recipients so notified.

  • Right to data PORTABILITY

You may request that your personal data be provided in a structured, widely used and machine-readable format, to you personally or to another administrator, without hindrance on our part, if and as far as is applicable in the light of the grounds of Art. 20 of the GDPR and/or the Bulgarian law, in the case of, inter alia, where the processing is based on the consent given by the subject for a specific purpose or is necessary for the execution of a contract to which the subject is a party and the processing is carried out in an automated manner. The right to portability of personal data should not adversely affect the rights and freedoms of others.

  • Right to OBJECT

You have the right at any time, and on grounds relating to your particular situation, to object to the processing of your personal data, if and in so far as is relevant in view of the grounds under Art. 21 of the GDPR and/or Bulgarian law, in the cases inter alia, when the processing of data is in the exercise of a public interest task or in the exercise of official powers, where the processing is necessary for the purposes of our legitimate interests or those of a third party, including profiling on those grounds. In the case of objection to the processing of personal data, we will cease processing of the personal data, unless we prove that there are compelling legal grounds for processing it, which have an advantage over the interests or fundamental rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. When we conclude that there is a compelling legal basis for the processing of personal data, we will inform the data subject, providing information also for the possibility of additional data protection and will continue processing the personal data. However, when we conclude that there is no compelling legal basis to process personal data, we will inform the data subject, suspend the processing and delete the personal data. If the objection is against the processing of personal data for the purposes of direct marketing, the processing shall be terminated unconditionally.

  • Right of the subject not to be subject to automated individual decision-making, incl. profiling

You have the right not to be subject to automated decision-making, incl. profiling that would significantly affect you, without the possibility of human intervention, if and as far as is relevant in view of the grounds under Art. 22 of the GDPR and/or Bulgarian law.

In most cases, your rights as data subjects are not absolute insofar as they are limited by the rights and freedoms of others. In many cases (see Articles 15-23 of the GDPR), the exercise of rights is under certain conditions. We may deny the exercise of a specific right for statutory reasons, according to the law, such as, inter alia, most often the grounds for such denial shall be: compliance with a legal obligation on our part or for the performance of a task of public interest; in the exercise of the public powers granted to us (if applicable); for the establishment, exercise or protection of legal claims. Our refusal must always be explicit, written, and justified by a specific statutory reason.

You have the absolute right to WITHDRAW YOUR CONSENT for the processing of personal data, which is based solely on that consent, in which case the subsequent withdrawal will not affect the lawfulness of the processing already performed.

We provide conditions to ensure the exercise of  your rights as data subjects by contacting us at the contact details above or by email at office@legaltera.com. Your claim for the exercise of rights must meet the requirements of Art. 37b and Art. 37c of the LPPD. To facilitate you, we can provide you with an appropriate form for exercising your right, as well as information on the progress of your request. We will respond to your comments, questions and requests within one month of receiving them. If necessary, this period may be extended by a further two months, taking into account the complexity and number of requests for which you will be informed within the original one-month period. We are not obliged to respond to a request in the event that we are unable to identify the data subject, and because of this, we may request additional information to be provided to verify the identity of the applicant.

Apart from the above rights, you have the absolute right to file complaints relating to the processing of your personal data, the processing of your request and your complaint, or the handling of complaints. You can bring your complaints directly to the Supervisory Authority – Commission for Personal Data Protection (CPDP), address: 2, Prof. Tzvetan Lazarov Str., 1592 Sofia, (www.cpdp.bg), within 6 months of becoming aware of the violation, but no later than two years after it has been committed.

In case you believe that we as a data controller or our data processor have violated your rights under the General Data Protection Regulation and the Bulgarian Personal Data Protection Act, you may appeal the actions and acts of the data controller and the processor of personal data to the court under the Administrative Procedure Code, as in the same proceedings you may claim compensation for any damages you suffered as a result of the illegal personal data processing by the data controller. This right cannot be exercised if there are pending proceedings before the CPDP for the same infringement.

26.04, 2023

“Legaltera” Law Firm

error:
Legaltera
-->