DATA CONTROLLER DETAILS
Valkov, Genova & Co. Law Firm, registered in the Unified Register of Law Firms at the Supreme Judicial Council under No. 2400080710, Sofia Bar Association (SBA), registered in the BULSTAT Register under UIC 181395314, with registered office and address of management at: Sofia, 3 Prof. Hristo Vakarelski Str., Entrance B, Floor 2, Apt. 10, is a personal data controller (hereinafter referred to as the "Controller" or "Law Firm").
You can contact the Law Firm in one of the following ways:
by email: office@valkov-genova.com;
by phone: +359 898460337, +359 876372813;
via the contact form on the website;
at the registered office address: Sofia, 3 Prof. Hristo Vakarelski Str., Entrance B, Floor 2, Apt. 10.
LEGAL BASIS
This Personal Data Processing Policy has been prepared in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR). Its purpose is to inform you about the ways in which the Law Firm collects, uses, processes, and stores personal data, the purposes and legal bases of processing, as well as the rights you have in connection with the processing of your personal data when using the website https://www.valkov-genova.com (hereinafter referred to as the "Website").
The Controller processes personal data only where there is a valid legal basis under the provisions of the GDPR. When visiting the Website, cookies may be used that collect certain information, including technical data and data such as IP address. The processing of this data is necessary to ensure the normal functioning, security, and optimization of the Website and is carried out on the basis of the Controller's legitimate interest. The processing of data through third-party cookies or for purposes other than strictly necessary ones is carried out on the basis of your explicitly provided consent, which may be withdrawn at any time through the settings of your internet browser or through the relevant cookie management tool.
When submitting an inquiry via the Website's contact form, the Controller processes the data provided by you - name, email address, phone number and company name (the last two optional), the selected area of law, the type of client, the urgency, the preferred form of engagement and contact method, and the content of the message - for the purpose of reviewing and responding to the inquiry. Information about the page from which the inquiry was sent is submitted together with it and, if you have consented to analytics cookies, also how you reached the Website (for example a referring site or an advertising campaign). Inquiries are transmitted to the Law Firm through the Formspree service described below. Depending on the nature and content of the message, the processing of personal data may be based on different legal grounds. When the inquiry relates to steps prior to entering into a contract or the performance of an existing contract for legal services, the processing is carried out on the basis of the necessity to take steps at your initiative prior to entering into a contract or for the performance of a contract. When the inquiry relates to a legal consultation, the Visitor decides what personal data to provide, including their own or that of third parties. When the message contains comments, recommendations, or complaints, the processing is based on the legitimate interest of the Controller to maintain quality service, effective communication, and the protection of its reputation. In cases where the inquiry relates to the exercise of rights under the GDPR, processing is carried out on the basis of a legal obligation. Where no other legal basis exists, but you voluntarily provide personal data, the processing is carried out on the basis of your consent, which you may withdraw at any time.
CATEGORIES OF DATA SUBJECTS WE PROCESS
In connection with our activities, which include maintaining our digital platforms and effectively managing communication, we process personal data belonging to the following groups of individuals:
Users of our digital channels: Individuals who visit our Website or interact with the content and posts on our official social media profiles.
Communicating parties: Any person who uses any of the channels provided by us (such as email, telephone, physical mail, or contact form) to make an inquiry, submit a business proposal, file a report or complaint, or establish any other type of contact.
Related parties in correspondence: Third parties whose personal data are included or referenced in inquiries, complaints, or other documents we receive through our official communication and in our digital channels.
PERSONAL DATA WE COLLECT AND PROCESS FROM YOU AS WEBSITE VISITORS OR CLIENTS
The Law Firm collects and processes the following personal data:
Information about your computer or device used during your visits to our Website (including IP address, geographical location, browser type and version, operating system, length of visit, subpages visited);
Information you submit to book a consultation through any of the methods provided on the Website;
Information contained in or related to any communication made/sent through our Website (including the content of communication, metadata associated with the communication);
Information necessary to identify data subjects - names as per identity document, national identification numbers such as PIN/LNCH/BULSTAT, date of birth; address (permanent and/or current address), place of birth, age, identity document data, gender, citizenship; VAT number, etc., as well as any other information necessary to identify data subjects;
Any other personal information you have submitted to us in order to use the Website's functionality.
The Controller does not process special categories of data during your visit to the Website.
PURPOSE OF PERSONAL DATA PROCESSING
The Law Firm processes personal data only where there is a valid legal basis within the meaning of Regulation (EU) 2016/679 (GDPR) and applicable national legislation, and only to the extent necessary to achieve specific, explicitly stated, and legitimate purposes.
Personal data is processed to ensure the normal functioning, technical support, security, and optimization of the Website, including to prevent abuse and guarantee information security, on the basis of the Controller's legitimate interest.
Data is also processed in connection with receiving, reviewing, and responding to inquiries submitted via the Website's contact form or by other provided means, including preparing offers and preliminary communication with prospective clients. Depending on the nature of the inquiry, processing is carried out on the basis of taking steps at the request of the data subject prior to entering into a contract, performance of a contract, or on the basis of the legitimate interest of the Law Firm.
Personal data is processed for the purpose of establishing and maintaining contractual relations with clients, including the conclusion, performance, amendment, and termination of contracts for the provision of legal services and assistance. Within this scope, processing includes providing legal defense and assistance, consisting of oral and written legal consultations and opinions, drafting legal documents, applications, complaints, submissions, and other papers, as well as representation in and out of court before courts, administrative bodies, institutions, natural and legal persons, to the extent necessary to protect the client's rights and legitimate interests.
The processing of personal data is also carried out to maintain ongoing communication with clients and prospective clients regarding the conclusion, performance, and administration of contractual relations, as well as in connection with comments, recommendations, reports, and complaints, on the basis of the Law Firm's legitimate interest to maintain effective and professional communication and a high quality of services.
For the purposes of complying with legal obligations, including in connection with exercising data subjects' rights under the GDPR and complying with tax, accounting, and other applicable legal requirements, the Law Firm processes personal data on the basis of a legal obligation.
Personal data is also processed where the data subject voluntarily provides it for purposes not covered by the scenarios mentioned above; in such cases, processing is carried out based on explicitly given consent, which may be withdrawn at any time without affecting the lawfulness of processing carried out prior to the withdrawal.
PROCESSING OF YOUR PERSONAL DATA BY THIRD PARTIES
The Law Firm does not disclose personal data to third parties, except where necessary to achieve the processing purposes, adhering to the data minimization principle and where a valid legal basis exists under applicable law.
Personal data may be disclosed to the following categories of recipients: hosting and IT service providers supporting the Website and the Law Firm's information systems; communication, security, or technical support service providers; employees, associates, and partners of the Law Firm; state authorities, courts, and other competent institutions when required by law or pursuant to a legal obligation.
Where third parties process personal data on behalf of the Law Firm, they act as data processors within the meaning of the GDPR and are bound by contractual confidentiality and data protection obligations complying with the requirements of Regulation (EU) 2016/679.
In connection with the Website, the Law Firm uses the following data processors:
Formspree, Inc. (United States) - provider of the service through which inquiries from the Website's contact form are delivered by email to the Law Firm. Formspree receives and stores the content of submitted inquiries as well as technical information (for example IP address, date and time of submission) needed to deliver them and to protect against abuse. More information: https://formspree.io/legal/privacy-policy
Google Ireland Limited (Ireland) and Google LLC (United States) - provider of the Google Analytics 4 service, which is used only if you have consented to analytics cookies. Google processes pseudonymised data about visits: pages viewed, source of the visit, device and browser type, approximate location and actions on the Website, such as sending an inquiry. Google Signals and ad personalisation are switched off. More information: https://policies.google.com/privacy
The Law Firm does not disclose personal data to third parties for marketing purposes without the explicit prior consent of the data subject.
TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
The use of Formspree and Google Analytics may result in personal data being transferred to the United States. Such transfers take place only where appropriate safeguards under Chapter V of Regulation (EU) 2016/679 are in place - the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework for recipients that participate in it, or standard contractual clauses approved by the European Commission. You may request further information about the applicable safeguards using the contact details above.
USE OF COOKIES
The Controller considers it necessary to inform you that cookies may be used when visiting the Website. Strictly necessary cookies are used on the basis of the Controller's legitimate interest to ensure the functionality and security of the Website. All other cookies, including third-party cookies, are used only upon your explicitly given consent. Consent may be withdrawn at any time through browser settings or through the cookie management tool. Google Analytics cookies are set only after you accept them in the cookie banner, and you can withdraw your consent through the "Cookie settings" link at the bottom of every page. Please refer to our Cookie Policy, where this process is described in more detail.
DATA RETENTION PERIOD
The Controller will store your personal data for no longer than the periods established in statutory and regulatory acts of applicable labor, tax, and social security legislation, for compliance with which the Law Firm has established a Data Retention and Destruction Schedule. Data will be stored in accordance with an approved Data Retention and Destruction Procedure.
Data submitted through the contact form is kept in the Law Firm's email and in its account with the Formspree provider for as long as necessary to review the inquiry and for the subsequent communication, unless a contractual relationship or a legal obligation requires a longer period. Statistical data in Google Analytics is kept for up to 14 months.
RIGHTS OF DATA SUBJECTS
In accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation, any person whose personal data is processed by the Law Firm has the following rights:
Right to information:
The data subject has the right to obtain confirmation as to whether or not personal data concerning them is being processed, as well as access to that data and information regarding the purposes of processing, categories of personal data, recipients or categories of recipients, retention periods, and the source of data. A copy of the personal data undergoing processing may also be provided upon request.
Right to rectification:
The data subject has the right to request the rectification of inaccurate or incomplete personal data, as well as the updating of data that no longer reflects reality, without undue delay.
Right to erasure:
Subject to the grounds provided under the GDPR, the data subject has the right to request the erasure of their personal data, including when the data is no longer necessary for the purposes for which it was collected, when consent has been withdrawn and there is no other legal basis for processing, when a justified objection to processing has been lodged, when processing is unlawful, or when data must be erased to comply with a legal obligation.
The right to erasure may be limited in cases provided for by applicable law, including where processing is necessary to comply with a legal obligation, for the establishment, exercise, or defense of legal claims, for the performance of a task carried out in the public interest, or for archiving purposes in the public interest, scientific, historical, or statistical purposes, insofar as erasure would impede the achievement of those purposes.
Right to restriction of processing:
The data subject has the right to request restriction of processing of their personal data, in which case the data will only be stored but not otherwise processed, except in explicitly specified legal cases. Any decision refusing restriction shall be justified and communicated in writing.
Right not to be subject to automated decision-making, including profiling:
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in cases provided for by law and subject to suitable safeguards.
Right to data portability:
The data subject has the right to data portability, obtaining personal data provided by them in a structured, commonly used, and machine-readable format, as well as requesting the direct transmission of data to another controller where technically feasible.
Right to withdraw consent:
Where processing is based on consent, the data subject has the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
Right to object:
The data subject has the right to object to the processing of their personal data, including processing based on legitimate interest, as well as the right not to be subject to a decision based solely on automated processing, including profiling, to the extent applicable.
In the event that the Law Firm intends to process personal data for a new purpose incompatible with the original purposes, the data subject will be informed in advance, and explicit consent will be requested where necessary.
To exercise their rights, data subjects may contact the Law Firm at the email address: office@valkov-genova.com.
PROCESSING OF PERSONAL DATA OF JOB APPLICANTS
When submitting a job application to the Law Firm, the applicant voluntarily provides their personal data, which is processed by the Law Firm as a data controller in accordance with Regulation (EU) 2016/679 (GDPR), applicable national legislation, and this Privacy Policy. Applying itself constitutes confirmation that the applicant is familiar with the terms and principles of personal data processing applied by the Controller as part of the recruitment process.
During the application process, the Law Firm processes personal data provided by the applicant, which typically includes identification and contact details, information regarding education, professional qualifications, work and professional experience, as well as other data contained in CVs, cover letters, or supporting documents. The applicant may, at their discretion, provide additional information they deem relevant to their application.
For recruitment purposes, the Law Firm may also process publicly available information regarding the applicant, including data that the applicant has made publicly available on the internet or on professional platforms and social networks, to the extent permissible and relevant to the evaluation of the application.
The processing of applicants' personal data is carried out on the basis of the Law Firm's legitimate interest to conduct an effective, lawful, and objective recruitment process, as well as in connection with taking steps at the applicant's request prior to entering into a potential employment or civil contract.
Personal data is used solely for reviewing and evaluating the specific application and, if necessary, assessing the possibility of including the candidate in future recruitment procedures. For this purpose, data may be stored for up to 6 (six) months from the date of application, unless the applicant objects to such storage or exercises their right to erasure.
The applicant has the right at any time to withdraw their application or exercise their rights as a data subject, including the right to access, rectification, restriction of processing, or erasure of personal data. The Law Firm will comply with any lawful request unless an applicable legal obligation or other legal basis exists for further data retention, including where an employment or other legal relationship arises.
RIGHT TO LODGE A COMPLAINT
You have the right to lodge a complaint directly with the supervisory authority in the Republic of Bulgaria - Commission for Personal Data Protection, address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592 (www.cpdp.bg) - or with a supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of personal data relating to you infringes Regulation (EU) 2016/679.
If you wish to submit a complaint regarding the processing of your personal data through the Controller, you may do so using the contact details provided above.
SECURITY MEASURES
The Controller implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, unauthorized access, alteration, or disclosure.
POLICY CHANGES
The Controller reserves the right to amend this Personal Data Processing Policy at any time. The current version is published on the Website and is applicable from the moment of publication.
This Privacy Policy enters into force on November 06, 2026.