Privacy Policy

This Privacy Policy has been developed in accordance with Art. 13 and Art. 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

We at Georgiev, Todorov & Co. Law Offices take care of the security of your personal data and have taken all necessary measures to bring our activities in line with the requirements of Reg. (EU) 2016/679, following the principles of lawfulness, fairness, transparency, purpose limitation, integrity and confidentiality, accuracy, as well as the principle of data minimization.

I. Controller’s contact details

Georgiev, Todorov & Co Law Offices is a legal entity registered in the Register of Law Companies at the Sofia City Court, with seat and registered office: 1000 Sofia, Triaditsa district, 27 Petar Parchevich Str.

Should you have any inquiries, you may send them at the following e-mail address:; by phone (+359 2) 937 65 00/01/02/03/04, as well as by sending a letter to the address: Sofia 1000, Triaditsa district, 27 Petar Parchevich Str. Should you want a personal meeting with our Data Protection Officer, you may call the indicated telephone numbers or send an e-mail to arrange it.

II. Purposes and legal grounds for processing, data retention

Georgiev, Todorov & Co Law Offices processes personal data in connection with the activities provided for in the Attorney Act, the Legal Aid Act and other normative acts, as follows:

  • Clients

For Clients of the Law firm are considered all persons to whom legal services are provided in accordance with a legal services agreement (LSA). All other persons with whom the Law firm has a pre-contractual relationship, as well as the persons who have sent an inquiry to the Law firm, are also considered clients.

The personal data we collect about our clients is determined by the type of specific legal services provided is contained in the attached file.

Data retention

Georgiev, Todorov & Co Law Offices retains personal data of its clients for the term of the LSA, until the expiration of the limitation period for engaging the professional liability of the lawyers or up to 5 years from the completion of the case in which a lawyer from the Law firm was a legal representative. The personal data of potential clients with whom a LSA has not been concluded shall be stored within 1 month from the end of the respective correspondence.

  • Job applicants and Internship applicants

Georgiev, Todorov & Co Law Offices processes personal data of job and internship candidates, as provided by the candidate.

The data is collected from the provided CV, diploma, student book, certificates for participation in seminars or trainings or other documents certifying the educational degree and professional qualification of the applicant, provided by him at his or hers discretion to prove his or hers suitability for the relevant position.

The retention period of the personal data of the applicant is 6 months from the end of the recruitment procedure. In case the applicant has given explicit consent, his or her personal data may be processed for a longer period of time, for the purposes of participating in subsequent recruitment procedures. In this case, the retention period may not be longer than the period for which the applicant has given consent.

  • Suppliers of goods or services

Georgiev, Todorov & Co Law Offices processes personal data of its suppliers or of representatives of its suppliers regarding the provision of goods and services to the Law firm.

The purposes of processing personal data of suppliers of goods or services depend on the type of product or service, e.g. external archival services, courier services, consultancy services.

The legal basis for processing personal data of suppliers of goods or services are the following:
– For the performance of a contract to which the supplier of goods or services is a party – Art. 6, para. 1, p. “b” of the GDPR;
– For protection of the legitimate interest of the Law firm – Art. 6, para. 1, p. “f” of the GDPR.

The retention period of the personal data of the suppliers of goods or services lasts until the expiry of the statutory limitation period commencing from the termination or rescission of the contract.

  • Individuals involved in court and arbitration proceedings

Georgiev, Todorov & Co. Law Offices processes personal data of individuals – participants in court proceedings, administrative proceedings, conciliation proceedings and arbitration proceedings, for the purposes of carrying out the agreed representation. The personal data of the counterparties, supporting and assisted party or their representatives, are provided by the client or by the court. The personal data of the witnesses is provided by the party that engaged the respective witness. The personal data of the experts are provided by the court.
The data is processed on the basis of legitimate interest – Art. 6, para. 1, p. “f” of the GDPR, since the legal profession may not be practiced effectively in the absence of this data. The data, part of a closed case, are stored for a period of 5 years.

  • CCTV

Georgiev, Todorov & Co. Law Offices processes personal data through video surveillance to control access to the office and security. Records shall be kept for a short period of two months, unless a longer period is required, e.g. for the purpose of further incident investigation.

III. Categories of recipients of personal data outside the Law firm “Georgiev, Todorov & Co”

Georgiev, Todorov & Co Law Offices discloses personal data to the following categories of recipients:

1. To other attorneys for the purpose of providing the assigned legal services;
2. To trusted external consultants, for the purpose of providing complex services, with the client’s approval;
3. To courier companies and postal operators – for the purposes of correspondence with data subjects;
4. To credit institutions – for the purposes of remuneration;
5. To state bodies and authorities charged with public functions within their powers for the purpose of implementation of the legal obligations (Ministry of Interior, State Agency for National Security, Sofia Bar Association, Supreme Bar Council and others);
6. To court or arbitration court, for the purposes of legal representation in legal proceedings, as well as for the purpose of collection of the firm’s receivables.

The personal data of clients or their representatives shall not be disclosed in any other country or international organization, except in cases where, on the basis of an agreement, the Law firm provides legal services in the field of international arbitration or cooperate with law firms established outside the country. In each such case, the relevant provisions of the legislation on personal data protection shall be complied with.

IV. Your rights

As a data subject, you have the right to receive confirmation and/or detailed information, incl. a copy of the personal data which we process for you (right of access).

In addition, you may object to the collection and further processing of your personal data, and request that they be corrected (updated) or deleted (when there is no valid legal basis for us to continue processing them).

You also have the right to request a restriction of processing, i.e. require the controller to process them for specific purposes when they cannot delete them due to a legal obligation.

In cases where we process your data for legitimate interest, you have the right to object to the processing if you believe that the Law firm lacks such an interest.

All rights can be exercised freely using the contact details specified in this policy.

In case you find your rights of data protection violated, you may file a complaint with the Commission of Personal Data Protection: 1592 Sofia city, 2 Prof. Tsvetan Lazarov Blvd., tel. 02 / 91- 53-518, email:

Any amendments to this Policy will be timely indicated on our website. In the event of significant amendments, we will further notify you by sending a message via email or SMS.

Privacy Policy EN