Privacy Policy

1. Data Controller

The controller of personal data collected and processed through the Website is:

In this Policy, "the Firm", "We" or "Innovires Legal" refer to the above-mentioned controller.

2. Data Protection Officer (DPO)

In accordance with Articles 37–39 of the GDPR, the Firm has designated a Data Protection Officer (DPO) whom you may contact on all matters related to the processing of your personal data and the exercise of your rights under the Regulation:

3. Processing Principles

When processing personal data, the Firm strictly complies with the principles set out in Article 5 of the GDPR:

• Lawfulness, fairness and transparency: We process your data only where there is a valid legal basis and inform you clearly about how we do so.
• Purpose limitation: We collect data only for specific, explicitly stated and legitimate purposes and do not process it in a manner incompatible with those purposes.
• Data minimisation: We process only the data that is necessary and sufficient to achieve the specific purpose.
• Accuracy: We take reasonable measures to keep the data up to date and accurate.
• Storage limitation: We retain data only for the period necessary to fulfil the processing purposes, or for a longer period where required by law.
• Integrity and confidentiality: We ensure appropriate protection of data, including against unauthorised or unlawful processing, accidental loss, destruction or damage.
• Accountability: We can demonstrate compliance with the above principles through documentation, policies and procedures.

4. Categories of Data Subjects

Through the Website and its associated functionalities, we process personal data of the following categories of individuals:

• Website visitors — individuals who visit innovires.com (through technical data and cookies)
• Enquiry senders — individuals or representatives of legal entities who fill in the contact form on the Website
• Newsletter subscribers — individuals who have provided their email address to receive the newsletter
• Clients — individuals or representatives of legal entities with whom the Firm enters into contractual relations for the provision of legal services

5. Personal Data Collected, Purposes and Legal Bases

Below is detailed information about the categories of personal data we process, the purposes and the applicable legal bases for each processing activity:

6. Legal Bases — Detailed Explanation

Pursuant to Article 6 of the GDPR, every processing of personal data must be based on at least one of six legal bases. The applicable bases for the Website's activities are:

6.1. Consent (Art. 6(1)(a))

Applied for: newsletter subscription; activation of analytical cookies. Consent is freely given, specific, informed and unambiguous. It may be withdrawn at any time — via the unsubscribe link in each newsletter message or by changing cookie settings (the "Cookies" link in the Website footer). Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.2. Performance of a contract (Art. 6(1)(b))

Applied for: providing legal services where the data subject is a party to a contract with the Firm or has taken steps to conclude one.

6.3. Legal obligation (Art. 6(1)(c))

Applied for: retention of accounting documents (Accountancy Act); providing information to public authorities (NRA, CPDP, courts); compliance with the requirements of the Bar Act and the Tax and Social Insurance Procedure Code (TSIPC).

6.4. Legitimate interest (Art. 6(1)(f))

Applied for: processing enquiries via the contact form; ensuring the technical functionality of the Website; protecting the Website against abuse. We carry out a balancing test (Legitimate Interest Assessment — LIA) for each processing activity based on legitimate interest to ensure that the Firm's interests do not override the rights and freedoms of data subjects.

7. Retention Periods

We retain your personal data only for the period necessary to fulfil the purposes for which they were collected, or for a longer period where required by law:

After the applicable periods expire, data is irreversibly deleted or anonymised. Upon anonymisation, the data loses its personal data status and the periods no longer apply.

8. Recipients and Data Processors

The Firm does not sell, rent or provide your personal data to third parties for their own marketing or commercial purposes.

Data may be shared with the following categories of recipients, subject to appropriate legal, technical and organisational safeguards:

8.1. Data processors (under Art. 28 GDPR)

The Firm has concluded or will conclude a Data Processing Agreement (DPA) with each data processor, in accordance with the requirements of Article 28 of the GDPR.

8.2. Other recipients

• Public and regulatory authorities — where required by law (CPDP, NRA, courts, prosecution, police)
• Lawyers, auditors, accountants — where necessary for legal protection or fulfilment of statutory obligations

9. Transfers of Data Outside the EU/EEA

Some of the data processors (Formspree Inc., Google LLC) are established in the United States. Data transfers to these processors are carried out on the basis of:

• EU-US Data Privacy Framework — European Commission adequacy decision of 10 July 2023
• Standard Contractual Clauses (SCCs) — approved by the European Commission with Implementing Decision (EU) 2021/914, as an additional safeguard

The Firm monitors the validity of the above mechanisms and will take immediate measures in the event of a change in the legal framework.

10. Automated Decision-Making and Profiling

The Firm does not carry out automated decision-making, including profiling, within the meaning of Article 22 of the GDPR, that produces legal effects concerning you or similarly significantly affects you.

11. Technical and Organisational Security Measures

In accordance with Article 32 of the GDPR, the Firm implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks. These measures include, but are not limited to:

Technical measures

• SSL/TLS encryption of all communications through the Website (HTTPS protocol)
• Encryption of data in transit and at rest
• Firewall and intrusion detection systems
• Regular software updates and application of security patches
• Data backup with recovery testing
• Strong and unique passwords with two-factor authentication (2FA)

Organisational measures

• Access control policy — principle of least privilege
• Internal data processing rules, mandatory for all employees
• Confidentiality agreements (NDA) with all persons with access to personal data
• Regular staff training on data protection matters
• Data Breach Response Plan
• Periodic review and testing of the effectiveness of security measures
• Data Processing Agreements (DPA) with all processors

12. Data Breach Notification

In the event of a personal data breach, the Firm will:

• Notify the CPDP without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach, unless it is unlikely to result in a risk to the rights and freedoms of individuals (Art. 33 GDPR)
• Notify the affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR)
• Document every breach, including the facts, consequences and corrective measures taken, in accordance with Art. 33(5) GDPR

13. Your Rights as a Data Subject

As a data subject, you have the following rights under Chapter III of the GDPR:

14. Procedure for Exercising Rights

A request to exercise any of the above rights may be submitted:

• Electronically: to the email address office@innovires.com
• On paper: to the address 25 Vitosha Blvd., fl. 2, office 4, Sofia 1000, Bulgaria, to the attention of the Data Protection Officer

Content of the request: the data subject's name; contact details (address, phone or email); description of the request and the specific right you wish to exercise.

Identification: To protect your data from unauthorised access, we may request confirmation of your identity. Where a request is submitted by a representative — a notarised power of attorney shall be attached.

Response deadline: We provide information regarding the actions taken within one month of receiving the request. Where necessary, given the complexity or number of requests, the deadline may be extended by an additional two months, of which you will be notified within the first month with reasons for the delay.

Fees: Exercising your rights is free of charge. For manifestly unfounded or repetitive requests, the Firm may impose a reasonable fee based on administrative costs, or may refuse to comply with the request.

15. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the Regulation, you have the right to lodge a complaint with the competent supervisory authority:

Without prejudice to your right to lodge a complaint with the CPDP, you also have the right to an effective judicial remedy against a controller or processor (Art. 79 GDPR), as well as the right to compensation for damages suffered (Art. 82 GDPR).

16. Protection of Children's Data

The Website and the Firm's services are not directed at persons under the age of 16. We do not knowingly collect personal data from children. If we discover that we have processed data of a person under 16 without the consent of the holder of parental responsibility, we will take immediate measures to delete it.

17. Cookies

The website innovires.com uses cookies. Detailed information about the types of cookies, their purposes, retention periods, management methods and the legal bases for their use is provided in our Cookie Policy, which is an integral part of this Policy.

18. Links to Third-Party Websites

The Website may contain hyperlinks to websites operated by third parties. The Firm is not responsible for the privacy policies and practices of these sites. We recommend that you review the privacy policy of every website you visit.

19. Amendments to the Policy

The Firm may update this Policy periodically to reflect changes in legislation, technical standards or business practices. In the event of material changes, we will publish a clear notice on the Website.

The date of last update and the version number are indicated at the beginning of this document. We recommend that you check this page periodically for current information.

20. Contact Information

For all questions related to the processing of personal data and this Policy, you can contact us: