Personal Data Protection Policy

Last updated: 2 November 2026

Important:
Sending a message through the Website or by email does not, by itself, create an attorney-client relationship. Such a relationship arises only after the engagement has been accepted and, where applicable, an agreement for legal services and assistance has been concluded.

Where personal data have not been obtained directly from you, the individual information requirement under Article 14 GDPR may not apply in cases where the personal data must remain confidential subject to a statutory obligation of professional secrecy, including attorney-client confidentiality (Article 14(5)(d) GDPR).

5. Purposes and legal grounds for processing

5.1. Pre-contractual steps and performance of a contract – Article 6(1)(b) GDPR

Where you are a natural person who is a prospective or current client, we process the necessary personal data in order to:

• review an enquiry and assess whether we can accept the engagement;
• prepare a proposal and negotiate the terms of engagement;
• conclude and perform an agreement for legal services and assistance;
• provide oral and written legal advice and opinions;
• prepare and submit contracts, applications, complaints, statements of claim, objections and other documents;
• provide representation and defence before courts, administrative authorities and other persons;
• communicate regarding the progress of the assigned work, expenses, fees and completion of the engagement.

5.2. Compliance with a legal obligation – Article 6(1)(c) GDPR

We process personal data where and to the extent this is necessary for compliance with applicable legal obligations, including:

• obligations under the Bulgarian Bar Act and professional rules, including those relating to the retention of legal files and professional record-keeping;
• obligations under MAMLA and related legislation, but only in relation to activities and situations falling within the scope of that regime;
• tax, accounting and other financial obligations;
• lawful obligations to provide information or assistance to competent authorities, subject to the limitations arising from attorney-client confidentiality and professional independence;
• handling requests for the exercise of rights under data protection legislation.

5.3. Legitimate interests – Article 6(1)(f) GDPR

Where necessary and after balancing the relevant interests against the rights and interests of the affected individuals, we may process personal data for the following legitimate interests:

• conducting conflict-of-interest checks and safeguarding the Attorney’s independence;
• communicating with and providing services to clients that are legal entities or other organisations, including processing data of their representatives and contact persons;
• organising and administering the professional practice, maintaining records of clients and engagements and quality control;
• protecting the Website, email, devices and information systems from misuse, unauthorised access, fraud and cyberattacks;
• establishing, exercising and defending legal claims of the Attorney, a client or third parties;
• collecting fees and expenses due;
• maintaining professional contacts and responding to correspondence which does not result in a contract;
• maintaining professional social media profiles and presenting general information about the practice without disclosing attorney-client confidential information.

Where processing is based on a legitimate interest, you have the right to object under Article 21 GDPR.

5.4. Consent – Article 6(1)(a) GDPR

Where the law requires consent or where we have chosen to rely on consent, we process the data only for the clearly specified purposes. This may include subscriptions to electronic communications, the use of non-essential cookies or similar technologies, and other separately described cases.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

6. Special categories of data and data relating to criminal convictions and offences

Certain legal matters may require the processing of special categories of personal data under Article 9 GDPR, for example data concerning health, political opinions, religious beliefs, trade union membership, biometric or genetic data, or data concerning a person’s sex life or sexual orientation.

Where such processing is necessary for the establishment, exercise or defence of legal claims, the relevant condition is Article 9(2)(f) GDPR, together with the applicable legal basis under Article 6 GDPR. In other situations, another appropriate condition under Article 9(2) GDPR will apply where available.

Data relating to criminal convictions and offences under Article 10 GDPR are processed only where permitted by European Union or national law and where necessary for the practice of law, defence or legal representation, subject to appropriate safeguards.

The receipt of sensitive information does not mean that it will be used for purposes beyond the specific engagement or legal obligation.

7. Website, cookies and electronic communications

7.1. Technical data and logs

When you access the Website, the server and technical services used may automatically process your IP address, the date and time of the request, browser and device type, operating system, requested resource, referring page and technical logs. These data are necessary for content delivery, diagnostics and information security.

7.2. Cookies and similar technologies

The Website does not use cookies and does not store information on your device. If this changes, this Policy will be updated before the relevant technology is introduced and, where required by law, the technology will be activated only after you have given your consent.

7.3. Subscription to electronic communications

If you subscribe to our electronic communications list, we use the email address provided to send legal updates, publications, invitations and other information described at the time of subscription. You can unsubscribe using the mechanism provided in the relevant message or by writing to office@kuzmanovlaw.com.

7.4. External links

The Website may contain links to websites and services provided by third parties. We do not control their independent processing of personal data. We recommend that you read their privacy policies before using the relevant service.

8. Recipients of personal data

Personal data are disclosed only where necessary, lawful and compatible with attorney-client confidentiality. Depending on the particular circumstances, recipients may include:

• courts, prosecutors’ offices, pre-trial authorities, administrative authorities, registry authorities and other competent public institutions;
• notaries, state and private enforcement agents, arbitrators, mediators, trustees in bankruptcy, liquidators, experts, translators and interpreters;
• other attorneys-at-law and law firms in Bulgaria or abroad, where necessary for the particular engagement and consistent with professional secrecy;
• external experts and specialists whose assistance is required for the matter;
• banks, payment institutions and payment service providers;
• accountants and accounting service providers to the extent necessary to comply with legal obligations;
• hosting providers (the Website is hosted by Webflow, Inc., USA), email, cloud, IT, cybersecurity and technical support providers which may act as processors;
• courier, postal and telecommunications service providers;
• providers of communication, videoconferencing, electronic signature or secure document exchange platforms, where used;
• persons to whom disclosure has been expressly instructed or authorised by the client, to the extent lawful;
• other recipients where disclosure is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

Where a service provider processes personal data on our behalf, we seek to use providers that offer sufficient guarantees concerning security and confidentiality and are bound by appropriate contractual obligations.

9. Transfers outside the EU/EEA

As a rule, we seek to use services and recipients located in the European Union/European Economic Area. However, certain technology providers or international legal matters may result in access to or transfer of personal data to a third country.

Where personal data are transferred outside the EU/EEA, we apply the requirements of Chapter V GDPR. Depending on the circumstances, a transfer may be based on an adequacy decision of the European Commission; the European Commission’s Standard Contractual Clauses and, where necessary, supplementary measures; or an applicable derogation under Article 49 GDPR, for example where the transfer is necessary for the establishment, exercise or defence of legal claims.

For transfers to participating organisations in the United States, the EU-U.S. Data Privacy Framework may apply where the recipient is duly certified and the relevant adequacy decision is applicable.

You may request additional information about the applicable transfer mechanism where a transfer concerns your personal data, except to the extent that disclosure is restricted by attorney-client confidentiality, law or the rights of third parties.

10. Retention periods

We retain personal data only for as long as necessary for the relevant purpose, taking into account statutory retention periods, professional obligations, limitation periods, the need to defend legal claims and the principle of data minimisation.

10.1. Client matters and legal files

Pursuant to Article 47(1) of the Bulgarian Bar Act, files in matters in which the Attorney has acted as counsel or representative are retained for five years after completion of the matter. The same period is used as a general reference for other client files and documents unless the nature of the engagement, a statutory requirement, a contractual obligation or the need to defend legal claims requires a longer period. Original documents received from the client in connection with the engagement are returned in accordance with the Bulgarian Bar Act and the organisation of the particular matter.

10.2. Data under MAMLA

Where MAMLA applies, the documents, data and information collected or prepared under that Act are generally retained for five years in accordance with Article 67 MAMLA, calculated from the point specified by law. Upon written instruction from the competent authority, that period may be extended within the limits provided by law.

10.3. Accounting and tax documents

Accounting and tax documents are retained for the periods required by the applicable accounting and tax and social security legislation. For example, under Article 12 of the Bulgarian Accountancy Act and Article 38 of the Bulgarian Tax and Social Security Procedure Code, accounting registers and financial statements are retained for ten years, while documents relevant to tax and social security control may be subject to a longer period linked to the limitation period applicable to the relevant public liability.

10.4. Enquiries that do not result in an engagement

Correspondence concerning an enquiry that does not result in an engagement is normally retained for up to two years from the last substantive communication, unless a longer period is necessary for conflict-of-interest checks, the defence of legal claims, compliance with a legal obligation or another justified reason.

10.5. Technical and security logs

Server, system and security logs are normally retained for up to twelve months, unless an incident, dispute, inspection or specific technical necessity requires longer retention.

10.6. Subscriptions and consent

Data processed on the basis of consent are retained until the consent is withdrawn or the purpose no longer applies. We may retain limited information about the consent or its withdrawal and an address on a suppression list to the extent necessary to demonstrate compliance with the law and to ensure that communications are not sent contrary to your expressed preference.

10.7. Applications

Applications for a specific position or internship are normally retained for up to six months after completion of the relevant selection process. Where express consent has been given for future opportunities, the data may be retained for up to two years unless the consent is withdrawn earlier.

10.8. Disputes and proceedings

Where a dispute, inspection or proceeding arises in connection with the processing or our relationship, the relevant data may be retained until the final resolution of the dispute or proceeding and for the applicable limitation period thereafter, to the extent necessary for the establishment, exercise or defence of legal claims.

11. Attorney-client confidentiality and security

Legal files, case records, electronic documents, correspondence and other information carriers are protected by the specific rules of the Bulgarian Bar Act. Pursuant to Article 45(1) of the Bulgarian Bar Act, an attorney-at-law must preserve the client’s confidential information without limitation in time.

When selecting and using information society services, we also comply with Article 41(3) of the Bulgarian Bar Act, which requires such services to provide protection of personal data, protection against unauthorised access, secure direct contact with the client and preservation of attorney-client confidentiality.

Depending on the risk, we apply appropriate technical and organisational measures, which may include:

• access controls for electronic systems and devices;
• strong authentication mechanisms and, where appropriate, multi-factor authentication;
• updates, security software and protection against malicious code;
• encryption or other appropriate safeguards for storage and transmission where the risk requires it;
• backups and recovery procedures;
• limiting service provider access to what is strictly necessary;
• contractual confidentiality and data protection obligations;
• appropriate procedures for responding to incidents and personal data breaches.

No technical system can guarantee absolute security. Where a personal data breach is identified, we take action in accordance with the GDPR, including notification of the supervisory authority and/or the affected individuals where required by law.

12. Your rights

Subject to the conditions of the GDPR, you have the following rights:

Right to information: to receive transparent information about the processing of your personal data (Articles 13 and 14 GDPR).

Right of access: to obtain confirmation as to whether we process your personal data, access to those data and a copy, as well as the information specified in Article 15 GDPR.

Right to rectification: to request correction of inaccurate data and completion of incomplete data (Article 16 GDPR).

Right to erasure: to request erasure where the conditions of Article 17 GDPR are met. This right is not absolute and may not apply where retention is required by law or for legal claims.

Right to restriction of processing: to request restriction of processing under the conditions of Article 18 GDPR.

Right to data portability: where processing is automated and based on consent or a contract, to receive the data you have provided in a structured, commonly used and machine-readable format and, where technically feasible, request transfer to another controller (Article 20 GDPR).

Right to object: to object to processing based on legitimate interests on grounds relating to your particular situation (Article 21 GDPR).

Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting processing carried out before withdrawal.

Rights in relation to automated decisions: not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in the cases permitted by law (Article 22 GDPR).

As of the date of this Policy, we do not use solely automated individual decision-making within the meaning of Article 22 GDPR in connection with the provision of legal services.

To exercise a right, please send your request to office@kuzmanovlaw.com or to the office address stated above. We may request additional information necessary to verify your identity. We will respond within the time limits provided by the GDPR. The exercise of rights is free of charge except in the cases expressly provided by law for manifestly unfounded or excessive requests.

GDPR rights are exercised subject to the rights and freedoms of other persons, attorney-client confidentiality, procedural rules and other applicable statutory restrictions. For example, a right of access does not entitle a person to obtain information that would breach another client’s confidentiality or the rights of third parties.

13. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP):

• address: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria;
• email: kzld@cpdp.bg;
• website: www.cpdp.bg.

Before lodging a complaint, you may contact us so that we can try to clarify and resolve the matter. This does not limit your right to refer the matter to the CPDP.

14. Changes to this Policy

We may update this Policy from time to time, including where there is a change to the Website, the technologies and service providers used, the organisation of the professional practice or applicable law.

The current version will be published on the Website with the date of the latest update. Where a material change affects processing for which we hold your contact details and notification is appropriate, we may also inform you by another suitable means.

Legal framework and useful links

Regulation (EU) 2016/679 (GDPR): EUR-Lex

Bulgarian Bar Act: Ministry of Justice

Bulgarian Commission for Personal Data Protection: cpdp.bg

Bulgarian Measures Against Money Laundering Act: Lex.bg

Bulgarian Accountancy Act: Lex.bg

Controller’s Website: kuzmanovlaw.com