+359 8777 22 700 BG / EN

Personal Data Privacy Policy

1. Identification of Markova & Panchovska Law Office

Markova & Panchovska Law Office (the “Law Office” or the “Controller”) is a controller of personal data. The Law Office consists of the partners Yordanka Ivanova Panchovska, attorney-at-law at the Sofia Bar Association, personal number 1000492610, and Stanislava Petrova Dimova-Markova, attorney-at-law at the Plovdiv Bar Association, personal number 1000112940.

2. Contacting the Controller

You can contact the Controller in any of the following ways:

  • in person or in writing at: 5 Saborna St, floor 4, Sredets District, Sofia;
  • by telephone: +359 8777 22 700;
  • by email: office@mplegis.com;
  • website: www.mplegis.com;
  • contact persons: Yordanka Panchovska, Stanislava Markova.

3. Personal data processed by the Controller

The Controller collects and processes your personal data in connection with your access to and use of the website www.mplegis.com maintained by the Controller, and with contacting users of the website, on the basis of Article 6(1) and Article 9(2)(h), in conjunction with paragraphs 1 and 3 of the same Article, of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or “GDPR”).

In addition, in order to personalise your preferences and serve you better, the Controller may collect and subsequently process certain information about your behaviour when browsing the website and using the online booking system.

In operating the website and the online booking system, the Controller may store and collect information by means of cookies and similar technologies in accordance with the Policy on the Use of Cookies and Other Similar Technologies (the “Cookie Policy”), available on the website of Markova & Panchovska Law Office.

The Controller collects and processes sensitive data falling within the special categories of personal data under the General Data Protection Regulation solely on the grounds, and in strict compliance with the requirements, of the GDPR and of national data protection legislation.

3.1. Personal data

The personal data which the Controller collects and processes about you are:

3.1.1. Personal data collected automatically:

  • Log files – when you access the website www.mplegis.com, the Controller automatically receives information from log files (a set of system information about the user): internet protocol (IP) addresses, browser type and language, internet service provider (ISP), referring and exit pages, operating system, date/time stamp and clickstream data; the time you have spent on a given site and which pages of the site you have visited. The information contained in these files includes the use of cookies – more information on the use of cookies can be found in the Cookie Policy available at www.mplegis.com.

3.1.2. Personal data which you provide:

  • names;
  • email address;
  • telephone number;
  • other data which you voluntarily choose to provide when completing the contact form.

3.2. Legal basis for the processing of personal data by the Controller

The Controller processes your personal data on the basis of:

(a) Article 6(1)(a) of the General Data Protection Regulation, namely your explicit consent in connection with accessing and browsing the website of Markova & Panchovska Law Office and/or communicating with persons from Markova & Panchovska Law Office and/or the use of cookies;

(b) Article 6(1)(b) of the General Data Protection Regulation, namely in order to take steps prior to entering into a contract for legal consultation and legal services with a lawyer from Markova & Panchovska Law Office, and for the preparation and conduct of the consultation and the provision of the legal services by a lawyer from Markova & Panchovska Law Office;

(c) Article 6(1)(c) of the General Data Protection Regulation, namely processing is necessary for compliance with a legal obligation to which the Controller is subject, including but not limited to obligations under the Measures Against Money Laundering Act and others;

(d) Article 6(1)(f) of the General Data Protection Regulation, namely processing is necessary for the purposes of the legitimate interests of the Controller in carrying on and protecting its business (including but not limited to measures to protect the website and its users, measures to prevent and detect attempted fraud, and measures to manage various other risks);

(e) Article 9(2)(b) of the General Data Protection Regulation, namely processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject;

(f) Article 9(2)(d) of the General Data Protection Regulation, namely processing is necessary in connection with members or former members of a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim, or with persons who have regular contact with it in connection with its purposes, on condition that the personal data are not disclosed without the consent of the data subjects;

(g) Article 9(2)(f) of the General Data Protection Regulation, namely processing is necessary for the establishment, exercise or defence of legal claims.

3.3. Purposes of the processing of personal data by the Controller

The personal data referred to above, provided by you in connection with accessing and browsing the website www.mplegis.com, communicating and booking an appointment for a consultation with a lawyer from the Law Office, including when entering into a contract for legal consultations and services with a lawyer from the Law Office, preparing and conducting the consultation and providing the services, are processed by the Controller for the following purposes:

  • access to and browsing of the website www.mplegis.com, on which a system for contacting the Law Office also operates;
  • contact by the Law Office with users of the website www.mplegis.com;
  • identification of the person who has requested a consultation with a lawyer at the Law Office, and preparation and performance of the consultation (scheduling the consultation, checks, correspondence and any other actions related to a request for legal consultation with a lawyer from the Law Office, providing access to other services through the website and all relations between the parties in connection with such contracts), as well as performance of the Controller’s resulting legal and contractual obligations;
  • provision of legal consultation by a lawyer from the Law Office;
  • the functioning and improvement of the Law Office’s website, analysis of the behaviour of visitors to the website, and marketing purposes;
  • compliance with legal obligations under accounting and tax legislation.

3.4. Recipients and categories of recipients of personal data

Your personal data referred to above may be provided to the following recipients and categories of recipients:

(a) competent state authorities – in performance of the Controller’s obligations under Bulgarian law;

(b) providers of various services to the Controller, as follows:

  • legal, tax and other advisers;
  • a provider under a contract for accounting services;
  • providers of payment/banking services and banking institutions (all banks and branches of banks in the Republic of Bulgaria and abroad) for the administration of money transfers in connection with payment for legal consultation and legal services provided by lawyers from the Law Office;
  • insurance companies;
  • IT service providers;
  • other companies supplying the Controller in connection with the operation of the website and the online consultation booking system, including providers of software and web solutions – Google products and services, Google platforms and other online platforms.

If the Controller is required to do so by law, or if this is necessary to protect its legitimate interests, the Controller may also disclose certain personal data to public authorities.

The Controller guarantees that access to your data by private third parties takes place in accordance with the legal provisions on data protection and confidentiality of information, on the basis of contracts concluded with them.

3.5. Period for which the Controller stores the personal data provided

(a) For the term of the contract for legal consultations and services concluded between you and a lawyer from the Law Office and for the relevant limitation period thereafter, in accordance with the applicable legislation;

(b) Until the website user withdraws consent (where the processing of personal data depends on the consent of the website user) or, as the case may be, until the website user objects (where the processing of personal data is related to cookie and other similar technology and/or marketing activities), and subject to the technical possibilities for erasing these files while the browser/device settings are in use;

(c) For a longer period, where a law (e.g. accounting or tax legislation) so provides. If the storage period needs to be extended in order to comply with a legal or contractual obligation of the Controller and/or for the legitimate interests of the Controller or a third party, you will be duly notified by the Controller.

3.6. Transfer of personal data outside Bulgaria

The Controller does not intend to provide the personal data collected about you to recipients in countries outside the European Union and/or the European Economic Area. Nevertheless, should any of your personal data be transferred to entities located outside the European Union, including in countries for which the European Commission has not recognised an adequate level of personal data protection, the Controller will take steps to ensure that any international transfer of personal data is carefully managed in order to protect your rights and interests.

4. Your rights in relation to your personal data processed by the Controller

You have the right at any time to request the following from the Controller:

4.1. Rectification of your personal data, where the personal data processed about you are inaccurate. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

4.2. Erasure of your personal data, where:

(a) the personal data are no longer necessary for the purposes for which they were collected and processed;

(b) you withdraw the consent on which the processing of your personal data is based (for personal data processed on the basis of consent), as described in detail in point 4.5 below;

(c) you object to the processing, as described in detail in point 4.4 below, and there are no overriding legitimate grounds for the processing;

(d) your personal data have been unlawfully processed;

(e) the personal data have to be erased for compliance with a legal obligation of the Controller under Bulgarian law and/or European Union law.

The Controller may decline your request for erasure of your personal data where their processing is required:

  • for compliance with a legal obligation (e.g. under recital 65 of the GDPR, the further retention of personal data should be lawful where it is necessary, including for exercising the right of freedom of information, for compliance with a legal obligation, for the performance of a task carried out in the public interest, for archiving purposes in the public interest, for scientific research purposes or for statistical purposes); or
  • for the establishment, exercise or defence of a legal claim.

4.3. Restriction of the processing of your personal data, where:

(a) you contest the accuracy of the personal data – for a period enabling the Controller to verify the accuracy of your data;

(b) the processing of the personal data is unlawful, but you do not wish the personal data to be erased and request the restriction of their use instead;

(c) the Controller no longer needs your personal data for the stated purposes, but you require them for the establishment, exercise or defence of legal claims;

(d) you have objected to the processing, as described in detail in point 4.4 below, pending verification of whether the legitimate grounds of the Controller override your interests.

You have the right at any time to:

4.4. Object to the processing of your personal data, where:

(a) the processing of your personal data is necessary for the purposes of the legitimate interests of the Controller or of a third party;

(b) your personal data are processed for scientific research or statistical purposes.

4.5. Withdraw your consent to data processing.

You may withdraw your consent to the processing of your personal data at any time (with regard to personal data processed on the basis of consent) – but this will not affect the lawfulness of the processing carried out by the Controller on the basis of your consent before its withdrawal, nor processing in the cases set out in detail in point 4.2(e) above. Notwithstanding this, the Controller will process your data for purposes related to the performance of the contract for legal consultation and services concluded between you and the Controller with a lawyer from the Law Office, as well as any possible disputes between you and the Controller in connection with or arising from the concluded contract for legal consultations and services.

You may exercise all rights under point 4 by sending a written request to the Controller’s address or an electronic request to the Controller’s email address, both set out in point 2 of this document.

5. Right of access to data

You may request the Controller:

(a) to confirm that it processes your personal data;

(b) to provide you with a copy of those data;

(c) to provide you with information about your personal data.

If you wish to receive further copies of a medium on which your personal data have been provided to you, a reasonable administrative fee may be charged.

6. Right to data portability

You have the right to receive the personal data concerning you which you have provided to the Controller, in a suitable format, and to transmit those data to another controller, with regard to personal data processed by the Controller on the basis of your consent or for the performance of contractual obligations relating to the legal consultation you have requested with a lawyer from the Law Office, and where the processing of those personal data is carried out by automated means (i.e. through automated electronic systems and not in the form of a paper archive). You have the right to have the personal data transmitted directly from the Controller to another controller, where technically feasible.

7. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) if you consider that your personal data are being processed unlawfully or that your rights in relation to your personal data have been infringed.

Contacting the CPDP:
2 Prof. Tsvetan Lazarov Blvd, Sofia 1592
Email: kzld@cpdp.bg
Website: www.cpdp.bg

8. Provision of personal data

Please note that the provision of your personal data in connection with booking an appointment for a legal consultation, and the provision of data in connection with the consultation so requested and its preparation, are necessary for entering into and performing the legal consultation you have requested with a lawyer from the Law Office and for your rights arising from the concluded contract for legal consultation or from the applicable law. You are not obliged to provide your personal data in connection with your request for a legal consultation with a lawyer from the Law Office and the preparation and provision of legal consultation and services, but the provision of your personal data is an absolutely necessary condition and requirement for the preparation and provision of such consultation and services. You may choose not to provide these personal data, and you may at any time exercise your rights in respect of the personal data you have provided, but if the Controller does not have these personal data, this may prevent the legal consultation you have requested from being carried out, as well as the performance of the Controller’s related contractual or legal obligations.

Please note that the provision of your personal data in connection with accessing, browsing and using the Law Office’s website, including requesting an appointment for a legal consultation through the contact system on the website, and in connection with sending a message through the Controller’s website, is necessary for using the website with its full functionality and, as the case may be, for communicating with the Controller. You may choose not to provide these personal data, and you may at any time exercise your rights in respect of the personal data you have provided in connection with accessing, browsing and using the Law Office’s website or, as the case may be, in connection with booking an appointment through the online system and/or contacting the Controller, but in that case the Controller cannot provide you with access to the content of its website, including the contact system, or guarantee that you will be able to use the website with its full functionality, and you will not be able to communicate with the Controller.

9. Use of automated decision-making

In order to carry out analyses for improving the website and to provide each individual user of the website with a personalised service in line with that user’s individual preferences, the Controller may collect and process data about the user’s interests and preferences, for example by analysing the number of visits and/or views by that user. This makes it possible to understand the user’s expectations better and to adapt to the user’s needs, without, however, significantly affecting the user’s decisions. Thanks to the Controller’s use of advanced technologies, the above activities may be performed by the system automatically, so that the content sent is as up to date and useful as possible for the user of the website.

You may request the Controller not to subject you to a decision based solely on automated processing, but only where that decision:

(a) produces legal effects concerning you; or

(b) similarly significantly affects you.

This right does not apply where the decision taken following the automated decision:

  • is necessary for the Controller in order to enter into and/or perform a contract for legal consultation with a lawyer from the Law Office;
  • is authorised by law and adequate safeguards for your rights and freedoms are in place; or
  • is based on your explicit consent.

10. Links to other websites

The website and/or the online consultation booking system operating through it may contain links to other websites. You can separately review the terms and personal data privacy policies applicable to those other websites; the Controller bears no responsibility for them. This Policy applies only to the Controller’s activities described above.

This Personal Data Privacy Policy was adopted on 7 October 2026 and is valid until it is repealed or amended by publication of such repeal or amendment on the website www.mplegis.com.