Velinov & Partners

I. TERMS USED AND THEIR MEANING

1. What data is “Personal Data”?

According to the definition set out in Article 4, paragraph 1 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as the “Regulation” in this policy), personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Examples of personal data include your three names, your Personal Identification Number (PIN), and passport details, but also your IP address. You should note that even if a single identifier, considered alone, does not allow you to be identified, it is considered personal data when, together with other identifiers, it allows your identity to be established.

2. What is the “Processing” of personal data?

According to the definition contained in the Regulation, processing of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3. What is the difference between a Controller and a Processor?

A Controller of personal data is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

A Processor of personal data is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

The terms used in this privacy policy have the meaning given to them in the Regulation.

II. INFORMATION ABOUT THE PERSONAL DATA CONTROLLER

The Controller of the personal data processed when visiting the website www.advokatite.bg is “Vektor 97” EOOD.

Controller Identification Data:

III. TYPES OF PERSONAL DATA WE PROCESS, PURPOSES AND PERIODS OF PROCESSING

1. Data processed via cookies

When visiting the website www.advokatite.bg, the controller processes the personal data described below via cookies:

2. Data processed via our contact form

2.1. When using the contact form on www.advokatite.bg, we process the following types of personal data (from the category of physical identity):

• Name;
• E-mail;
• Phone (optional element);

2.2. Legal Basis: We collect the personal data described above based on legitimate interest (Art. 6, § 1, letter “f” of the Regulation) in order to process the received inquiries and provide you with the necessary information and assistance. In some cases, the basis for processing is transformed into pre-contractual relations (Art. 6, §1, letter “b” of the Regulation). Providing additional information, including other types of personal data, is at your discretion and desire.

2.3. Period: We process the data provided via our contact form for a period of up to 1 (one) year from the date of receiving the inquiry, except in cases where the inquiry precedes the conclusion of a contract.

3. Data processed when applying for a job with us

3.1. For the purpose of selecting new employees, we process the following types of personal data:

• Regarding your physical identity: three names, date of birth, address, nationality, gender, contact details: e-mail, telephone number;
• Regarding your social identity: data regarding education and professional qualification, work experience gained, and other information that you voluntarily provide for the purpose of the selection process.

3.2. Legal Basis: The basis for processing your personal data in this case is pre-contractual relations (Art. 6, §1, letter “b” of the Regulation), as the provision of the information is carried out voluntarily by the data subject.

3.3. Period: The storage period for the information you provide for the purpose of the selection process is up to 3 (three) months from the date of receipt, except in cases where the selection has led to the conclusion of a contract.

IV. MORE INFORMATION ON COOKIES AND THE PURPOSES OF THEIR USE

An HTTP cookie, commonly referred to simply as a “cookie,” is a piece of information, in the form of a very small file, sent from a web server to your Internet browser, and then returned by the browser each time it accesses the same server.

The cookies we use on www.advokatite.bg are divided into:

• Functional Cookies These cookies are necessary for the correct functioning of the site on your chosen device. If you disable this cookie, there is a possibility that our website may not be displayed in the correct or most appropriate way on the device you are using.
• Performance Cookies These cookies allow us to count visits and traffic sources so that we can improve the performance of our site. They help us to understand which pages are the most popular and to track how visitors navigate within the site. All information these cookies collect is aggregated and anonymous.
• Advertising Cookies These cookies are used to track user visits and offer advertisements tailored to their interests. The information we receive is anonymised.

On your first visit to the website, you can deactivate all non-functional cookies we use. It is sufficient to select the “Deactivate cookies” button. Cookies can also be disabled through the settings of the browser you are using. If you need more information about the possibilities for disabling cookies, you can visit the following link: https://www.allaboutcookies.org/manage-cookies/

V. DATA SUBJECTS’ RIGHTS

If we process personal data related to you via www.advokatite.bg, you have the following rights:

1. Right of Access

You have the right to obtain confirmation as to whether or not personal data concerning you are being processed. If we are processing such data, we will provide you with a copy of the documents containing personal data (on the respective medium), as well as the following information:

• The purposes of the processing;
• The categories of personal data concerned;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed;
• Where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
• The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• The right to lodge a complaint with a supervisory authority;
• Where the personal data are not collected from the data subject, any available information as to their source;
• The existence of automated decision-making, including profiling (with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject).

In the event that the documents containing personal data for the subject also contain personal data of other persons, they are appropriately redacted.

2. Right to Rectification

You have the right to request us to rectify the personal data concerning you that we process if they are inaccurate. If you wish us to supplement your personal data, you will need to submit a declaration containing the relevant information.

Upon receipt of your request, we will rectify/supplement them as soon as possible.

3. Right to Erasure (the “Right to be Forgotten”)

You have the right to request the erasure of personal data concerning you, which will be erased where one of the following grounds applies:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• You withdraw your consent on which the processing is based and we have no other legal ground for the processing;
• You object to the processing and there are no overriding legitimate grounds for the processing. Where you have objected to processing for direct marketing purposes, the grounds are not analysed.
• Your personal data have been unlawfully processed;
• The personal data have to be erased for compliance with a legal obligation in Union or Bulgarian law;
• The personal data have been collected in relation to the offer of information society services; An information society service is any service normally provided for remuneration, at a distance, by electronic means and at the individual request of the recipient of the services.

Even if one of the hypotheses described above exists, we will not erase your personal data when the processing is necessary:

• For exercising the right of freedom of expression and information;
• For compliance with a legal obligation which requires processing by Union or Bulgarian law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• For the establishment, exercise or defence of legal claims;
• Two more specific hypotheses set out in Art. 17, § 3, letters “c” and “d” of the Regulation.

4. Right to Restriction of Processing

You have the right to request us to restrict the processing where one of the following applies:

• You contest the accuracy of the personal data. In this case, the restriction is for a period enabling the controller to verify the accuracy of the personal data.
• The processing is unlawful, but you oppose the erasure of the personal data and request the restriction of their use instead;
• The controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
• You have objected to processing pending the verification whether the legitimate grounds of the controller override your interests.

The controller shall inform every recipient to whom the personal data have been disclosed of any rectification or erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. If you wish, we will inform you about those recipients.

5. Right to Data Portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller of your choice. For us to take such action, the following two conditions must be met:

• The processing is based on consent or a contractual obligation, and
• The data are processed by automated means.

6. Right to Object

You have the right to object to the processing of your personal data when it is based on:

• The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or
• Legitimate interest.

We will immediately cease the processing of your data if we are unable to demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Where processing is carried out for direct marketing purposes, we will cease processing your data immediately.

HOW TO EXERCISE THE RIGHTS DESCRIBED ABOVE?

If you wish to exercise any of your rights, please download the Application from here and fill in the necessary information. The Application is in .pdf format and can be filled in either electronically or on paper.

If you wish, you can also send us an application in a free format, but it must mandatorily contain the following information:

• Your three names;
• PIN/Foreigner’s Personal Number (FPN);
• Address;
• Correspondence address;
• Description of the request;
• Preferred form for receiving a response and information;
• Signature;
• Date of submission;

Please send your application in one of the following ways:

• By email to dpo@advokatite.bg under the terms of the Electronic Document and Electronic Certification Services Act, the Electronic Governance Act, and the Electronic Identification Act (i.e., via an electronic signature, electronic identifier, or otherwise).
• By post or in person to the address: Sofia 1000, “Sredets” region, 29 Ivan Vazov Str., entr. A, fl. 1. When the application is submitted by an authorised person, a power of attorney must be attached to it.

After reviewing your application, we will analyse its content and, if necessary, ask you for additional information. You will receive information regarding its processing within a one-month period from its submission in the manner you indicated as preferred for communication.

If you need assistance in filling out the form we provided, please do not hesitate to contact the person indicated in Section II of this policy for contact details.

Other Rights

Separately from the rights described above, you have the right to:

Lodge a complaint with the Commission for Personal Data Protection

Every data subject has the right to lodge a complaint with the Commission for Personal Data Protection (CPDP) if you consider that the processing of personal data relating to you infringes the provisions of the Regulation or the Personal Data Protection Act (PDPA).

Contact details for the Commission for Personal Data Protection:

• Email: kzld@cpdp.bg
• Website: www.cpdp.bg
• Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.

Lodge a complaint with the Administrative Court – Sofia City

Without prejudice to your right to lodge a complaint with the CPDP, described in point 1, you have the option to lodge a complaint with the competent Administrative Court if you consider that your rights under the Regulation/PDPA have been violated as a result of the processing of your personal data.

Right to compensation and liability for damages caused

If you have suffered material or non-material damage as a result of an infringement of the Regulation, you have the right to receive compensation from the controller for the damages incurred.

VI. RECIPIENTS OF PERSONAL DATA

We do not transfer your personal data to third countries or international organizations. Your data may be transferred for processing to our partner (providing technical support or advertising services), in which case we conclude a data processing agreement after ensuring that the person adheres to high standards of personal data protection and has implemented the necessary technical and organizational measures in this regard.

1. Facebook Ireland

When administering our Facebook page, it is possible for “Vektor 97” EOOD and Facebook Inc. to be joint controllers. You can familiarise yourself with the Facebook privacy policy at the following link: https://www.facebook.com/policy.php

When people interact with the Controller’s Facebook Page and the content related to it, triggering the creation of a Page Insights event that includes personal data, for the processing of which the Controller is responsible, we determine the means and purposes of the processing jointly with Facebook Ireland Limited, i.e., we become joint controllers. The legal basis for processing personal data in this case is legitimate interest (pursuant to Art. 6, §1, letter “f” of the Regulation), and the specific purposes pursued are: market research, analysis of interest in specific legal topics, analysis of attendance and interactions with specific posts, photos, etc.

2. Google

Google Privacy Policy: https://policies.google.com/privacy?hl=en-US

3. YouTube

YouTube Privacy Policy: https://support.google.com/youtube/answer/2801895?hl=bg

4. LinkedIn

LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy

If you need additional information on issues concerning the processing and protection of your personal data, do not hesitate to contact the person indicated in Section II of this policy for contact details.

When we make changes to this privacy policy, they will be reflected immediately on the website www.advokatite.bg. In the event of material changes to the policy, we will notify you through a notice on our website or by sending an e-mail, if we have one.