This Privacy Policy describes how the law firm Filipov & Beleva processes the personal data of visitors to this website and of persons who contact us, in accordance with Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act.

1. Who processes your data

The controller of personal data is the law firm Filipov & Beleva.

On any matter relating to the processing of your personal data, you may contact us using the details above.

2. What data we collect and on what basis

We process only data that is necessary for a specific and clearly defined purpose.

2.1. Enquiries through the contact form and by e-mail

Data: name, e-mail address, telephone number (if you provide one) and the content of your message.
Purpose: to reply to your enquiry and, where both parties are interested, to discuss the engagement of legal assistance.
Basis: Article 6(1)(b) GDPR — taking steps at the request of the data subject prior to entering into a contract.

2.2. Booking a consultation

Appointments are booked through the Calendly platform. The data you enter there (name, e-mail address, chosen time and any note) is processed by Calendly LLC as our processor.
Basis: Article 6(1)(b) GDPR.

2.3. Client data upon engagement of legal assistance

Where a contract for legal defence and assistance is concluded, we process the data necessary for its performance, including identification data under the Measures Against Money Laundering Act (ЗМИП).
Basis: Article 6(1)(b) GDPR (performance of a contract) and point (c) (compliance with a legal obligation).

The data you entrust to us in our capacity as attorneys is protected by attorney-client privilege under Article 45 of the Bar Act (ЗАдв). It is not disclosed to third parties except where the law expressly requires this.

2.4. Technical data and website traffic statistics

Data: truncated IP address, device and browser type, pages visited, source of the visit, session duration.
Purpose: to understand which content is useful and to improve the website.
Basis: Article 6(1)(a) GDPR — your consent. Analytics tools are loaded only once you have given it through the cookie banner.

3. Cookies

Cookies are small text files that the website stores in your browser.

3.1. Strictly necessary

The website stores locally only your choice regarding cookies (fb_consent), so that you are not asked on every visit. This information does not leave your device and is not used for tracking.

3.2. Analytics — with consent only

Where consent is given, Google Analytics 4 (Google Ireland Limited) is loaded. We use IP address anonymisation. Google Consent Mode is configured so that advertising cookies and personalisation remain disabled in all cases.

3.3. How to withdraw your consent

You may withdraw or change your choice at any time. Withdrawal does not affect the lawfulness of the processing carried out up to that point.

4. To whom we transfer data

We do not sell or rent out personal data. Access to it, to the extent necessary, is granted to:

  • the hosting provider of this website — for its technical operation;
  • Google Ireland Limited — for the traffic statistics, only where consent has been given;
  • Calendly LLC — where a consultation is booked through the platform;
  • public authorities — only where the law obliges us to do so.

Where a provider processes data outside the European Economic Area, this takes place on the basis of the European Commission's standard contractual clauses or another valid ground under Chapter V GDPR.

5. How long we keep the data

  • Enquiries that do not lead to an engagement — up to 12 months from the last correspondence.
  • Client files — for the term of the contract and thereafter in accordance with the limitation periods and the requirements of the Bar Act (ЗАдв) and the Measures Against Money Laundering Act (ЗМИП).
  • Statistical data — up to 14 months in Google Analytics.
  • Your choice regarding cookies — until you delete it or for up to 12 months.

6. Your rights

Under the GDPR you have the right to:

  • access to the data we process about you;
  • rectification of inaccurate data;
  • erasure (the ‘right to be forgotten’), in so far as we are under no legal obligation to retain the data;
  • restriction of processing;
  • portability of the data;
  • objection to processing;
  • withdrawal of consent at any time.

A request may be submitted to [email protected]. We reply within one month.

If you consider that your rights have been infringed, you may lodge a complaint with the Commission for Personal Data Protection (КЗЛД) — 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, www.cpdp.bg — or with the courts.

7. Security

The website is served over an encrypted connection (HTTPS). We apply technical and organisational measures appropriate to the risk, including restricted access to the data and a duty of professional secrecy for all persons who work with it.

8. Children

The website is not directed at persons under 18 years of age and we do not knowingly collect data relating to such persons.

9. Changes

We may update this policy. The current version is always available at this address. In the event of material changes, we will post a notice on the website.