Privacy Notice
Please read this document carefully. It aims to inform you how the Djingov, Gouginski, Kyutchukov & Velichkov Law Firm collects and processes your personal data in relation to the services we provide to clients, related services offered to visitors at DGKV’s offices (such as the use of conference rooms, local networks (e.g., WiFi), and others), as well as in connection with your visits to the website www.dgkv.com. Once you have read this document, as well as other notices we may provide you with (e.g., Cookie Policy, Job Applicants’ Disclaimer), you will be able to understand why we collect and process your personal data.
- Who does the information below concern?
The information below concerns you if you are a natural person who is:
(a) a client/potential client – a natural person party to a legal services contract or other legal relationship related to the provision of legal assistance or other professional services by DGKV; or
(b) a representative (contact person, legal representative, attorney-in-fact) of a company or other legal entity – a DGKV client/potential client; or
(c) an employee of a DGKV client or a natural person in respect of whom DGKV takes action on behalf of a client in relation to the execution of a service, assigned by a DGKV client; or
(d) a person (including employees of such person) who is a party to a transaction in connection with which we advise a client, as well as competing participants in tenders, participants in court, administrative, or other proceedings involving our current or prospective clients; or
(e) a business contact of DGKV; or
(f) a visitor of the website www.dgkv.com (the „Website“).
- Who is the data controller?
The controller of your personal data is Djingov, Gouginski, Kyutchukov & Velichkov Law Firm, with a seat and registered office in Bulgaria, Sofia 1000, Sredets District, 10 Tsar Osvoboditel Blvd., floor 3, registered in the Register of Law Firms at Sofia City Court under c.c. № 13868/2006, BULSTAT 175174585 and e-mail address [email protected] ("DGKV").
- Contact details of the data controller
Contact address: Bulgaeia, Sofia, 10 Tsar Osvoboditel Blvd., fl. 3
Contact telephone: +359 2 9321 100
E-mail: [email protected]
- Personal data we process in relation to the legal assistance and professional services provided by DGKV
4.1. What personal data do we process?
Use of DGKV’s services is voluntary and at your discretion. When you use our legal assistance (whether legal services, corporate address services, contact person under the Bulgarian Law on Measures Against Money Laundering (“LAML”), or simply visit our offices), you provide us or we collect from other sources certain information and documents that allow us to provide the relevant service and conduct our business. This information typically includes the following categories of data, grouped here for clarity and to avoid repetition:
- Identifying information: full name, personal identification number (or other ID number where applicable), date of birth, ID card number;
- Contact data: email address, phone number, permanent address, etc.
- Payment data: bank account, credit card number, and other data related to payment processing, invoicing, fraud prevention, or money laundering;
- Information on your contractual relationship with us: instructions given, data on the service you receive from us, feedback on the service;
- Identification data under LAML, where applicable;
- Data concerning assigned tasks: personal data provided by or on behalf of our clients in connection with assigned tasks (which may include sensitive or special categories of data), employer, position, education, professional experience, previous employment, power of attorney (when acting as attorney-in-fact), and any other relevant information related to legal disputes, complaints, investigations, arbitration consultations, or other legal services or professional services requested by our client;
- Information collected during your visit to the Website: website usage data (services viewed or searched, IP address, page load times, download errors, time spent on page, interaction with the webpage such as scrolling, clicks, browser type and version, time zone and location, browser plug-ins and their versions), local network usage, and similar electronic services. Additional information about personal data processing on our website is available in Section 5 below, as well as in our Cookie Policy http://dgkv.com/cookie-policy;
- Marketing information: information about your preferences regarding marketing and communications with you (e.g., when you receive and read marketing communications from us, events organized by us you attended or were invited to, etc.);
- Special categories of personal data: when providing our services, we may represent you/your organization on legal matters that require processing of special categories of personal data (e.g., data on race, ethnicity, religion, political opinions, union membership, physical or mental health, data on previous convictions). We process these data for different purposes, including:
- compliance with legal obligations, e.g., identifying if you are a politically exposed person under LAML;
- asking about dietary needs when organizing catering for events at our premises;
- collecting data on union membership, previous convictions, health, or political opinions where necessary for providing legal assistance in labor disputes, criminal proceedings, or discrimination claims.
Our services are not intended for children. However, we may process data concerning children in relation to certain legal services (e.g., inheritance consultations).
- How is your personal data collected?
We may collect or receive your personal data in several different ways, such as:
- You provide it to us directly, in a personal meeting, or by corresponding with us by email, or via other direct interactions with us, including through any marketing communication we may send to you; or
- Information collected from third parties, for example, where we receive information from other partners, judiciary bodies, state or municipal authorities, or other entities;
- Publicly available sources - we may, for example, use such sources to help us keep the contact details we already hold for you accurate and up to date, or for professional networking purposes, e.g., clients' websites, publicly accessible registers, professional networks such as LinkedIn, etc.
4.3. Why (for what purpose) does DGKV process your personal data?
The main reason why we need your personal data is to provide you with the legal assistance sought (e.g., legal services, corporate address services, or to act as a contact person under the LAML). This data helps us protect your interests as our client and ensure that you receive the best possible legal service and assistance. Additionally, we use your personal data to comply with our legal obligations, to establish and maintain business communication with you, for marketing purposes, and to provide you with information that we believe will be of interest to you.
4.4. On what legal bases do we process your personal data?
We may process personal data on the following legal bases:
- Under Article 6(1)(b) of Regulation (EU) 2016/679 (“GDPR”) – to take steps at the request of the data subject prior to entering into a contract.
- Under Article 6(1)(e) of the GDPR – legitimate interest of the data controller (DGKV – to perform the contracted services) and legitimate interest of the data subject (officials exercising their powers).
- Under Article 6(1)(a) of the GDPR – explicit consent given by the data subject.
- Exercising and protecting the lawful rights and interests of DGKV and assisting in exercising and protecting the lawful rights and interests of DGKV’s lawyers and employees and persons processing personal data on its behalf: we may process your personal data for the purpose of establishing, exercising, or defending legal claims, including judicial proceedings, such as filing complaints, reports, and similar actions with competent state and municipal authorities and judicial bodies, as well as administering and handling received complaints, reports, requests, and similar. For these purposes, we may process your personal data based on Article 6(1)(f) of the GDPR – the legitimate interest of the data controller (DGKV) to establish, protect, and exercise legal claims, or to provide in other ways legal assistance and conduct its business, provided that such interests are not overridden by your data protection interests or fundamental rights and freedoms.
- Your personal data may also be processed to enable us to comply with legal obligations, such as the obligation to inform you about circumstances related to your rights or the protection of your interests, the obligation to keep records, to notify competent state or municipal authorities (if applicable), and so forth. In this regard, we may process your personal data based on Article 6(1)(c) of the GDPR – compliance with a legal obligation to which the controller is subject.
4.5. Purposes and legal bases for which DGKV may use your personal data
The cases in which we collect and process your personal data, the purposes for which we do so and the legal grounds for the processing are as follows:
| Activity | Types of Personal Data and Purpose of Processing | Legal Bases for Processing Personal Data |
| Engaging in communications with you, submitting fee offers and credentials to you, collecting information about the potential client. | To introduce our offering of services and assistance, to fulfill our obligation to avoid conflict of interest in the process of acquiring you as a client.
Identifying information; Email address, phone number. | To take steps at the request of the data subject prior to entering into a contract, compliance with a legal obligation to which the controller is subject. |
| Onboarding a new client and setting up a new client’s account in our billing system, including performing anti-money laundering, sanction screening, and fraud background checks. | To ensure adherence to all requisite legal and regulatory requirements applicable to DGKV.
Identifying information; Contact data; Payment data; Identification data under LAML. | Compliance with a legal obligation to which the controller is subject; legitimate interest (to allow us to receive payment and reimbursement of costs related to the provided services). |
| Providing our legal assistance and other professional services, and conducting our business | To provide our services and conduct our business. This helps us protect your interests as our client and ensure you receive the best possible legal assistance.
Contact Data; Information on your contractual relationship with us; Data concerning assigned tasks; Special categories of personal data. | Contract performance, legitimate interest (to enable us to perform our obligations and provide legal assistance and our professional services), consent. |
| Contacting current and prospective clients and business contacts with legal updates, invitations to seminars and events, or other marketing communications; providing legal directories (e.g. Chambers Europe, Legal500, IFLR, etc.) with information about the individuals involved in common projects. | For marketing and business development purposes. We will provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent to you, or you may opt out by contacting us as set out in Section 13 below.
Full name; Email address, phone number. | Legitimate interest (to maintain the clients’ / business contacts’ relationship, to expand and improve our business, to communicate with you, and to promote services); consent. |
| Conducting research and development. | To better understand your and our clients' needs, and to improve our business and service offerings.
Full name; Email address, phone number. | Legitimate interest (to improve our services and to receive new assignments). |
| Undertaking actions to collect any unpaid amounts owed to us and, if necessary, enforcing recovery by initiating legal action, including the commencement and conduct of legal and court proceedings. | To ensure that we are paid for the legal assistance and services provided, as well as to receive reimbursement of costs and expenses incurred on behalf of the client.
Identifying information; Contact data; Payment data; Information on your contractual relationship with us. | Legal claims, legitimate interests (to ensure that we receive the remuneration agreed for our assistance and services and the reimbursement of the are costs paid on behalf of the client). |
| Informing you of changes that apply to you. | Providing you with information about the amendments we made to our Standard Terms of Engagement and Billing, the applicable hourly rates, this Privacy Notice, etc.
Full name, Email address, phone number. | Legitimate interest (to make sure that you are informed of changes to terms that are applicable to you). |
| Protecting our legal rights, for example, by defending claims against us and conducting litigation to defend our interests. | Sharing information with law enforcement and third parties (e.g., our insurers, banks, etc.) when needed.
Identifying information; Contact data; Payment data; Information on your contractual relationship with us. | Legitimate interest (to protect our business interests). |
4.6. How does DGKV share data with third parties?
In the services provided by DGKV, third parties are involved for various reasons and in different ways. The main reason is to protect your rights and interests and to assist in issuing documents – these are usually judicial bodies, state and municipal authorities, or your counterparties when we represent you in proceedings before them. Other parties who may receive some of your personal data include those with whom we jointly provide our services. These include, for example, translators and other partners or, in some cases, if required by applicable laws, government or municipal authorities, and non-governmental organizations. We may also disclose your personal data with your consent (obtained separately from any contract between us).
If, in the course of advising clients based outside of the European Economic Area, we may be required to share matter-relevant personal data with them, we will only share the minimal amount of personal data necessary for the purpose of processing and, where possible, we will share the personal data in an anonymized form.
- Personal data that we process in relation to the visitors of the Website
- Collection and use of personal data
DGKV only processes the minimum amount of personal data that is absolutely necessary for the specific purpose or occasion in order to enable you to use the Website, to respond to your request, or to fulfil another obligation.
We collect the following personal data from visitors to the Website:
- Name, phone number, and/or email address for contact if you have used our contact form.
- IP address and other data related to a terminal technical device, as well as data about the use of our web page.
- We do not collect special categories of data.
The cases in which we collect and process your personal data, the purposes for which we do so and the legal grounds for the processing are as follows:
| Activity | Types of Personal Data and Purpose of Processing | Legal Bases for Processing Personal Data
|
| Use of cookies | In order for the Website to function properly, it uses cookies. For the information that is processed in connection with the cookies-IP address, data related to the end technical device, and data concerning the use of the Website, please read our Cookie Policy at
| Legitimate interest regarding the proper functioning and use of the Website. |
| End device data: IP address and other data associated with an end technical device, as well as data regarding the use of our web page. | In order to pursue our legitimate interests, we need to use endpoint data to:
| Legitimate interest regarding the maintenance of the Website. |
| Use of the contact form. | When you write to us via our web page, it is necessary to provide a name and contact telephone number or email so that we can contact you. If you share other personal information with us in the text of your inquiry, we will process this information as necessary to respond to your questions. | We process this data on the basis of the application and at your request.
Legitimate interest to improve the quality of our services. |
Regardless of your reason for sharing your personal data with us, we recommend that you do not disclose sensitive personal information (such as data regarding racial or ethnic origin, religion, health status, etc.) or any additional personal data.
5.2 Who do we share your personal data with?
In limited circumstances, the DGKV will disclose personal data to the following persons:
- IT service providers: in connection with some of the data processing, such as to troubleshoot potential Website performance and security issues. If it becomes necessary for DGKV to use the services of third parties, they will be bound by the implementation of specific data protection measures.
- State authorities and institutions, judicial bodies - to fulfil our obligations under the applicable law. In these cases, unless otherwise provided by law, the DGKV only provides the necessary information in aggregate and, where possible, anonymous form. In all cases, DGKV discloses data to third parties in strict compliance with the requirements and restrictions of the applicable law.
- How long do we store your personal data?
DGKV processes personal data within the statutory time limits, where applicable, or to the extent that the processing is necessary for our specific purpose.
The retention periods of the cookies used by the Website are set out in our Cookie Policy at http://dgkv.com/cookie-policy
- Who can access your personal data?
Within DGKV, a limited number of partners, lawyers, and employees have access to personal data, depending on the specific interaction with the client or potential client, or on their particular function related to the Website. DGKV partners, lawyers, and employees have a duty of confidentiality and are only allowed to handle the data in the performance of their functions and in accordance with the client's instructions.
- What are your rights?
- Access: You have the right to obtain confirmation and/or detailed information, including a copy of the personal data processed about you.
- Rectification: You have the right to request that your personal data be corrected (updated) without undue delay.
- Erasure: Right to erasure of your personal data, for example, if:
(a) the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or
(b) processed unlawfully, or
(c) in the case of processing based on consent, if you withdraw your consent.
However, the right to erasure is not applicable if, for example, the processing is required to fulfill a legal obligation under the applicable law (e.g., statutory retention requirements), or to assert, exercise, or defend a legal claim is required.
- Object: you may object to the collection and further processing of your personal data where there is no legal basis for us to continue processing it.
- Withdraw your consent: it is important to know that you can withdraw your consent to the processing of personal data (if you have given such consent) at any time.
- Which is the responsible Complaints Office?
If you believe that your data protection rights have been violated, you have the right to file a complaint with:
Commission for Personal Data Protection
Bulgaria, Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd.
T: + 359 2 91 53 518, E: [email protected]
- How can you exercise your rights?
You can exercise your rights by sending an email to [email protected]. In addition, you may contact directly:
Ms. Elena Vassileva
Bulgaria, Sofia 1000, 10 Tsar Osvoboditel Blvd., floor 3
T: +359 2 9321 100, E: [email protected]
We do not have a standard form for exercising rights. According to the Bulgarian Law on Personal data Protection, your request must contain at least:
- name or email or other data that will enable us to identify you;
- a description of your request;
- your preferred form for receiving the data (if you want access to your personal data);
- signature, date of request, and preferred correspondence address.
We will use our best efforts to respond to requests to exercise rights within 14 days. In some circumstances, this may take us longer, depending on the complexity of your request. In certain statutory circumstances (for example, if you have objected to processing carried out on the basis of a legitimate interest), we may not have to comply with your request. Even if we do, we will let you know the reason for the refusal.
- How do we protect your data?
We maintain a system of technical and organizational measures to protect data against unauthorized access or unlawful use and/or against accidental loss, alteration, disclosure, access, and/or corruption or copying. Here are some of the measures we implement: limited access to personal data; a duty of confidentiality on the part of data accessors; delineated access rights to personal data by authorized personnel; access on a need-to-know basis; and maintenance of physical, electronic, and other procedural safeguards to protect the confidentiality, integrity, and availability of your personal data.
In addition to the foregoing, the Website is accessible only over an encrypted connection and TLS 1.2 and TLS 1.3 encryption protocol with a 2048 bit key. Data is encrypted prior to being sent to a mail server under the management of DGKV to a dedicated shared mailbox set up for this purpose with controlled access to certain persons at DGKV involved in the use of the web page.
The personal data received from you is not subject to automated processing.
All personal data is stored on a server of the DGKV. We do not engage third parties to process data in connection with the Website.
DGKV is ISO/IEC 27001:2022 certified and has developed and implemented an information security management system in accordance with the standard. We re-evaluate the effectiveness of technical and organizational measures on a regular basis in order to achieve continuous data security.
- Other questions
What happens if visitors to the Website do not provide personal data?
You are under no obligation to visit the Website or to provide personal information to use it, but some features will not work if you do not provide it. We will not be able to respond your questions if you do not provide us with the necessary contact details.
Do we use automatic processing of Personal Data without human intervention?
We do not use automated decision-making without human intervention, including through profiling, that may be relevant to you or affect you in any way.
How will DGKV notify you of a change in the processing of personal data?
DGKV may update this notice if our services or our internal privacy policies and practices change. In the event of a change, the current version of the notice will be posted on the Website and, if consent is required for the processing of personal data, it will be requested. In the event of a material change to the information, we will further notify you by sending an email message to the extent that we have a legal basis to process your contact details.
Other information about your privacy
This notice applies only to the manner in which DGKV uses the personal data related to DGKV’s clients / potential clients, business contacts, as well as visitors to the Website. If you disclose your data to a third party (such as our business partners), the data you provide to that third party or that third party collects about you is subject to their privacy notices and practices.
- Contact details
If you have any questions about this notice or about our handling of personal data, you can contact:
Ms. Elena Vassileva
Bulgaria, Sofia 1000, 10 Tsar Osvoboditel Blvd., floor 3
T: +359 2 9321100, E: [email protected]
Sofia, last updated June 2025