Privacy Policy

1. Data Controller

The controller of personal data collected and processed through the Website is:

In this Policy, "the Firm", "We" or "Innovires Legal" refer to the above-mentioned controller.

2. Data Protection Officer (DPO)

In accordance with Articles 37–39 of the GDPR, the Firm has designated a Data Protection Officer (DPO) whom you may contact on all matters related to the processing of your personal data and the exercise of your rights under the Regulation:

3. Processing Principles

When processing personal data, the Firm strictly complies with the principles set out in Article 5 of the GDPR:

• Lawfulness, fairness and transparency: We process your data only where there is a valid legal basis and inform you clearly about how we do so.
• Purpose limitation: We collect data only for specific, explicitly stated and legitimate purposes and do not process it in a manner incompatible with those purposes.
• Data minimisation: We process only the data that is necessary and sufficient to achieve the specific purpose.
• Accuracy: We take reasonable measures to keep the data up to date and accurate.
• Storage limitation: We retain data only for the period necessary to fulfil the processing purposes, or for a longer period where required by law.
• Integrity and confidentiality: We ensure appropriate protection of data, including against unauthorised or unlawful processing, accidental loss, destruction or damage.
• Accountability: We can demonstrate compliance with the above principles through documentation, policies and procedures.

4. Categories of Data Subjects

Through the Website and its associated functionalities, we process personal data of the following categories of individuals:

• Website visitors — individuals who visit innovires.com (through technical data and cookies)
• Enquiry senders — individuals or representatives of legal entities who fill in the contact form on the Website
• Newsletter subscribers — individuals who have provided their email address to receive the newsletter
• Clients — individuals or representatives of legal entities with whom the Firm enters into contractual relations for the provision of legal services
• Innovires Introductions participants — individuals or representatives of legal entities who join the introductions programme
• Introduced persons — individuals who contact us after a personal introduction, or whom a participant introduces to us in advance with their permission

5. Personal Data Collected, Purposes and Legal Bases

Below is detailed information about the categories of personal data we process, the purposes and the applicable legal bases for each processing activity:

6. Legal Bases — Detailed Explanation

Pursuant to Article 6 of the GDPR, every processing of personal data must be based on at least one of six legal bases. The applicable bases for the Website's activities are:

6.1. Consent (Art. 6(1)(a))

Applied for: newsletter subscription; activation of analytical cookies. Consent is freely given, specific, informed and unambiguous. It may be withdrawn at any time — via the unsubscribe link in each newsletter message or by changing cookie settings (the "Cookies" link in the Website footer). Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6.2. Performance of a contract (Art. 6(1)(b))

Applied for: providing legal services where the data subject is a party to a contract with the Firm or has taken steps to conclude one.

6.3. Legal obligation (Art. 6(1)(c))

Applied for: retention of accounting documents (Accountancy Act); providing information to public authorities (NRA, CPDP, courts); compliance with the requirements of the Bar Act and the Tax and Social Insurance Procedure Code (TSIPC).

6.4. Legitimate interest (Art. 6(1)(f))

Applied for: processing enquiries via the contact form; ensuring the technical functionality of the Website; protecting the Website against abuse. We carry out a balancing test (Legitimate Interest Assessment — LIA) for each processing activity based on legitimate interest to ensure that the Firm's interests do not override the rights and freedoms of data subjects.

7. Retention Periods

We retain your personal data only for the period necessary to fulfil the purposes for which they were collected, or for a longer period where required by law:

After the applicable periods expire, data is irreversibly deleted or anonymised. Upon anonymisation, the data loses its personal data status and the periods no longer apply.

8. Recipients and Data Processors

The Firm does not sell, rent or provide your personal data to third parties for their own marketing or commercial purposes.

Data may be shared with the following categories of recipients, subject to appropriate legal, technical and organisational safeguards:

8.1. Data processors (under Art. 28 GDPR)

The Firm has concluded or will conclude a Data Processing Agreement (DPA) with each data processor, in accordance with the requirements of Article 28 of the GDPR.

8.2. Other recipients

• Public and regulatory authorities — where required by law (CPDP, NRA, courts, prosecution, police)
• Lawyers, auditors, accountants — where necessary for legal protection or fulfilment of statutory obligations

9. Transfers of Data Outside the EU/EEA

Some of the data processors (Formspree Inc., Google LLC, Cloudflare, Inc., MailerSend, Inc., MailerLite, Inc.) are established in the United States. Data transfers to these processors are carried out on the basis of:

• EU-US Data Privacy Framework — European Commission adequacy decision of 10 July 2023
• Standard Contractual Clauses (SCCs) — approved by the European Commission with Implementing Decision (EU) 2021/914, as an additional safeguard

The Firm monitors the validity of the above mechanisms and will take immediate measures in the event of a change in the legal framework.

10. Automated Decision-Making and Profiling

The Firm does not carry out automated decision-making, including profiling, within the meaning of Article 22 of the GDPR, that produces legal effects concerning you or similarly significantly affects you.

11. Technical and Organisational Security Measures

In accordance with Article 32 of the GDPR, the Firm implements appropriate technical and organisational measures to ensure a level of security appropriate to the risks. These measures include, but are not limited to:

Technical measures

• SSL/TLS encryption of all communications through the Website (HTTPS protocol)
• Encryption of data in transit and at rest
• Firewall and intrusion detection systems
• Regular software updates and application of security patches
• Data backup with recovery testing
• Strong and unique passwords with two-factor authentication (2FA)

Organisational measures

• Access control policy — principle of least privilege
• Internal data processing rules, mandatory for all employees
• Confidentiality agreements (NDA) with all persons with access to personal data
• Regular staff training on data protection matters
• Data Breach Response Plan
• Periodic review and testing of the effectiveness of security measures
• Data Processing Agreements (DPA) with all processors

12. Data Breach Notification

In the event of a personal data breach, the Firm will:

• Notify the CPDP without undue delay and, where feasible, no later than 72 hours after becoming aware of the breach, unless it is unlikely to result in a risk to the rights and freedoms of individuals (Art. 33 GDPR)
• Notify the affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR)
• Document every breach, including the facts, consequences and corrective measures taken, in accordance with Art. 33(5) GDPR

13. Your Rights as a Data Subject

As a data subject, you have the following rights under Chapter III of the GDPR:

14. Procedure for Exercising Rights

A request to exercise any of the above rights may be submitted:

• Electronically: to the email address [email protected]
• On paper: to the address 25 Vitosha Blvd., fl. 2, office 4, Sofia 1000, Bulgaria, to the attention of the Data Protection Officer

Content of the request: the data subject's name; contact details (address, phone or email); description of the request and the specific right you wish to exercise.

Identification: To protect your data from unauthorised access, we may request confirmation of your identity. Where a request is submitted by a representative — a notarised power of attorney shall be attached.

Response deadline: We provide information regarding the actions taken within one month of receiving the request. Where necessary, given the complexity or number of requests, the deadline may be extended by an additional two months, of which you will be notified within the first month with reasons for the delay.

Fees: Exercising your rights is free of charge. For manifestly unfounded or repetitive requests, the Firm may impose a reasonable fee based on administrative costs, or may refuse to comply with the request.

15. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the Regulation, you have the right to lodge a complaint with the competent supervisory authority:

Without prejudice to your right to lodge a complaint with the CPDP, you also have the right to an effective judicial remedy against a controller or processor (Art. 79 GDPR), as well as the right to compensation for damages suffered (Art. 82 GDPR).

16. Protection of Children's Data

The Website and the Firm's services are not directed at persons under the age of 16. We do not knowingly collect personal data from children. If we discover that we have processed data of a person under 16 without the consent of the holder of parental responsibility, we will take immediate measures to delete it.

17. Cookies

The website innovires.com uses cookies. Detailed information about the types of cookies, their purposes, retention periods, management methods and the legal bases for their use is provided in our Cookie Policy, which is an integral part of this Policy.

18. Links to Third-Party Websites

The Website may contain hyperlinks to websites operated by third parties. The Firm is not responsible for the privacy policies and practices of these sites. We recommend that you review the privacy policy of every website you visit.

19. Professional Contact via LinkedIn

Who we contact and why. We may contact professionals who publicly post or comment on LinkedIn about moving to Bulgaria, Bulgarian tax residency, freelancing from Bulgaria or setting up a company here; who react to public posts on these topics or to our own posts; or whose public profile matches the people we work with (for example founders of agencies and consultancies, and independent IT professionals, in other European countries). We do this on the basis of our legitimate interest in informing people about the legal services of Innovires Legal (Article 6(1)(f) GDPR). We have documented the balancing of that interest against your rights and can provide it on request.

How we contact you. We send a personal message only if you write to us first or, where the law allows it without prior consent, at most one message and one reminder after you accept the request. If you have not written about the topic yourself, we only send the connection request. We do not contact people in Germany, Austria or Switzerland, or people who write in German, unless they have reacted to our own posts or write to us first.

What we process. Your name, your professional headline, the link to your public profile, the link to the public post or comment that prompted our contact and a short excerpt of it, or the fact that you reacted to it; the date; your LinkedIn member ID where the data contains it; the location shown on your profile and, if available, its "About" text (read for the relevance score, not stored) where we found you through a profile search; the country, language and interest we infer; an internal relevance score and topic; and the status of our conversation. We do not collect your e-mail, phone number, photos or connections, and we do not combine this data with sources outside LinkedIn. The relevance score is used only to decide whom we contact first; it has no legal or similarly significant effect on you, and you may object to it at any time, without giving reasons (Article 21(2) GDPR).

Where it comes from. From your public LinkedIn post, comment or reaction, or from a search of public LinkedIn profiles by job title, country, industry, words in the profile that indicate remote work or relocation, company size and time in the current role, collected through our data service provider.

Who receives it. Our data service provider Apify Technologies s.r.o. (Czech Republic), which may use sub-processors in the United States, and Anthropic, the provider of the AI assistant we use to prepare drafts, which may process data in the United States. You can ask us about the safeguards for these transfers, and for a copy of them, at [email protected]. Nobody else. Every message is reviewed and sent personally by Yordan Cholakov.

How long we keep it. We delete the raw export as soon as it is processed and at the same time instruct our data service provider to delete it. If we never contact you, we delete your data within 30 days of collecting it. If we contact you, we delete it within one year of our last exchange. If you become a client, your data moves to our client file, where the retention periods for client files apply; we remove it from this channel's records within one year. After deleting the data of a person we contacted, we keep a pseudonymised identifier (a hash of your profile link and of your LinkedIn member ID) for 24 months, so that we do not contact you again; if you say no or ask us to stop, we keep it for as long as we use this channel. Our statistics on how many conversations reached each step do not identify you.

Your rights. You can object at any time, without giving reasons: just tell us in reply to our request or message, or write to [email protected]. You also have the rights of access, rectification, erasure and restriction, and the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the supervisory authority in your country.

Controller. Dimitrova, Cholakov & Partners (UIC 204566706), 25 Vitosha Blvd., fl. 2, office 4, Sofia 1000, Bulgaria; [email protected]. The contact details of our data protection officer are given at the beginning of this policy.

20. Amendments to the Policy

The Firm may update this Policy periodically to reflect changes in legislation, technical standards or business practices. In the event of material changes, we will publish a clear notice on the Website.

The date of last update and the version number are indicated at the beginning of this document. We recommend that you check this page periodically for current information.

21. Contact Information

For all questions related to the processing of personal data and this Policy, you can contact us: