Privacy Policy

1. Data Controller

Dimitrova, Cholakov & Partners (trading as "Innovires")
UIC: 204566706
Registered address: 25 Vitosha Blvd., fl. 2, Sofia 1000, Bulgaria
Email: info@innovires.com
Phone: +359 888 787 414

Dimitrova, Cholakov & Partners ("we", "us", "our", or the "Firm") is the data controller responsible for your personal data collected through this website (innovires.com) and in connection with our legal services. We are a law firm registered with the Sofia Bar Association, operating under the laws of the Republic of Bulgaria.

2. What Personal Data We Collect

We collect and process the following categories of personal data, depending on how you interact with us:

Data you provide directly

• Contact and inquiry data: Name, email address, phone number, and any information you include in a consultation request, contact form submission, or email to us.
• Newsletter subscription data: Email address provided when subscribing to our newsletter.
• Client engagement data: Full name, date of birth, nationality, passport or ID details, tax identification numbers, address, financial information, employment details, and any other data necessary for providing our legal services (tax residency applications, company formation, freelancer registration, etc.).
• KYC/AML data: Identity documents, proof of address, source of funds documentation — collected to comply with anti-money laundering obligations.

Data collected automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, referring URL, and language preference.
• Usage data: Pages visited, time spent on pages, click patterns, scroll depth, and navigation paths — collected via cookies and analytics tools.
• Cookie data: See our Cookie Policy for full details on the cookies we use.

3. How We Use Your Data and Legal Basis

Purpose	Legal Basis (GDPR Art. 6(1))	Data Involved
Responding to consultation requests and inquiries	(b) Pre-contractual steps at your request	Contact data, inquiry details
Providing legal services under an engagement agreement	(b) Performance of a contract	Client engagement data, KYC/AML data
KYC/AML due diligence	(c) Legal obligation (Bulgarian AML Act; EU Directive 2015/849)	Identity documents, source of funds
Tax compliance and statutory reporting	(c) Legal obligation (Bulgarian Tax Procedure Code)	Client financial data, tax identifiers
Issuing invoices and accounting	(c) Legal obligation (Bulgarian Accountancy Act)	Name, address, tax number, payment details
Sending our newsletter	(a) Your consent	Email address
Website analytics and performance improvement	(a) Your consent (via cookie banner)	Technical data, usage data
Protecting our legal rights and defending claims	(f) Legitimate interest	Engagement records, correspondence
Ensuring website security and preventing abuse	(f) Legitimate interest	Technical data, IP address

Where we rely on legitimate interest (Art. 6(1)(f)), we have conducted a balancing test to ensure our interests do not override your fundamental rights. You may request details of this assessment at any time.

4. Who We Share Your Data With

We do not sell your personal data. We share data only where necessary and with appropriate safeguards:

• Bulgarian public authorities: National Revenue Agency (NRA), Trade Registry, Migration Directorate, National Social Security Institute — as required for providing our legal services and complying with legal obligations.
• Banks and financial institutions: When assisting with bank account opening, we may share client data with the relevant bank as part of their KYC requirements.
• Accounting and audit providers: Our accountants process financial data on our behalf under a data processing agreement.
• IT and hosting providers: Our website hosting and email providers process technical data under data processing agreements. Current providers: Cloudflare, Inc. (USA — adequate safeguards under EU–US Data Privacy Framework).
• Analytics providers: Google LLC (Google Analytics) — only if you consent via the cookie banner. Data is anonymized by IP truncation. Google participates in the EU–US Data Privacy Framework.
• Professional advisors: In exceptional cases, we may share data with other lawyers, notaries, or tax advisors directly involved in your matter, with your knowledge.

5. International Data Transfers

Your personal data is primarily processed within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure appropriate safeguards are in place:

• United States: Transfers to US-based providers (Cloudflare, Google) are protected by the EU–US Data Privacy Framework adequacy decision (adopted July 10, 2023), supplemented by Standard Contractual Clauses (SCCs) where applicable.
• We do not transfer personal data to any country that lacks an adequacy decision without implementing appropriate safeguards under GDPR Art. 46.

6. How Long We Keep Your Data

Data Category	Retention Period	Reason
Client engagement files	Duration of engagement + 10 years	Statute of limitations for legal claims; professional obligations
Accounting and financial records	10 years from the end of the financial year	Bulgarian Accountancy Act
KYC/AML records	5 years after end of business relationship	EU Anti-Money Laundering Directive; Bulgarian AML Act
Tax-related documents	10 years	Bulgarian Tax Procedure Code
Consultation inquiry data (non-clients)	12 months after last contact	Legitimate interest in following up; then deleted
Newsletter subscription	Until you unsubscribe	Consent; withdrawal deletes data within 30 days
Website analytics data	14 months	Google Analytics default retention; anonymized
Server access logs	90 days	Security and troubleshooting

When the retention period expires, we securely delete or anonymize your personal data. If deletion is not technically feasible (e.g., data in backups), we isolate the data and restrict further processing until deletion is possible.

7. Your Rights Under GDPR

As a data subject, you have the following rights under the General Data Protection Regulation:

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): Request deletion of your data where there is no compelling reason for continued processing.
• Right to restriction (Art. 18): Request that we limit how we process your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to automated decision-making (Art. 22): We do not use automated decision-making or profiling that produces legal effects concerning you.

To exercise any of these rights, contact us at info@innovires.com. We will respond within one month of receiving your request, as required by GDPR Art. 12(3). If the request is complex, we may extend this by a further two months, notifying you accordingly.

Exercising your rights is free of charge. However, if requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act, as permitted by Art. 12(5).

8. Legal Professional Privilege

As a law firm, certain communications between us and our clients are protected by legal professional privilege (attorney-client privilege) under Bulgarian law (Bar Act, Art. 45). This means:

• Privileged communications may be exempt from disclosure in response to data subject access requests under GDPR, to the extent that disclosure would undermine the privilege.
• We will inform you if any part of your access request involves privileged material and explain the scope of any exemption applied.

9. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with the law, you have the right to lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection (CPDP)
(Комисия за защита на личните данни)
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Phone: +359 2 915 3518
Email: kzld@cpdp.bg
Website: www.cpdp.bg

You also have the right to lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work.

10. Children's Data

Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. Under Bulgarian law (Personal Data Protection Act, Art. 25b), the age of digital consent is 14 years. If we become aware that we have collected data from a child without appropriate parental consent, we will delete it promptly.

11. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

• TLS/SSL encryption for all data transmitted via our website
• Access controls limiting data access to authorized personnel only
• Encrypted storage for sensitive client documents
• Regular security reviews of our systems and processes
• Data processing agreements with all third-party processors

12. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or regulatory guidance. Material changes will be communicated via a notice on our website. We encourage you to review this page periodically. The "Last updated" date at the top indicates when the most recent revision was made.

13. Contact Us

For any questions about this Privacy Policy, to exercise your data subject rights, or to raise a concern about how we handle your personal data:

Dimitrova, Cholakov & Partners
25 Vitosha Blvd., fl. 2, Sofia 1000, Bulgaria
Email: info@innovires.com
Phone: +359 888 787 414