I. Data Controller
We act as a Data Controller within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and the Personal Data Protection Act.

Address: 14 Tsar Osvoboditel Blvd., Floor 5, Sofia, Bulgaria
Telephone: +359 878 699 622
E-mail: tsvetelina.marinova@lexquire.com

For any matters related to the processing of personal data, you may contact us using the details provided above.

II. Nature of Our Activities and Confidentiality
In the course of our professional activities, we process personal data in strict compliance with the principles of confidentiality, professional secrecy and the protection of our clients’ rights and legitimate interests.

All data obtained in connection with the provision of legal services is treated as confidential and shall not be disclosed except in cases expressly provided for by law.

III. Categories of Data Subjects
We process personal data relating to:
 - clients – natural persons;
 - representatives and employees of corporate clients;
 - opposing parties in legal disputes;
 - individuals connected to a specific legal matter (including witnesses, experts, debtors, creditors and others);
 - visitors to our website;
 - individuals who contact us via email or other communication channels.

IV. Categories of Personal Data
Depending on the specific circumstances, we may process the following categories of personal data:
 - identification data (names, Personal Identification Number / Foreigner Identification Number, address, identity document details);
 - contact details (telephone number, email address, correspondence address);
 - data relating to representation authority;
 - financial and accounting information;
 - data relating to judicial and administrative proceedings;
 - information contained in documentation relating to a specific legal matter;
 - special categories of personal data (including health data and data relating to criminal proceedings), where such processing is necessary for the establishment, exercise or defense of legal claims.

V. Legal Bases for Processing
1. Performance of a Contract
Article 6(1)(b) of Regulation (EU) 2016/679 – where processing is necessary for the conclusion and performance of a contract for legal services.

2. Compliance with a Legal Obligation
Article 6(1)(c) of Regulation (EU) 2016/679 – where processing is necessary to comply with our statutory obligations (e.g. accounting and tax obligations).

3. Legitimate Interests
Article 6(1)(f) of Regulation (EU) 2016/679 – where processing is necessary for the purposes of defending against legal claims, preserving evidence, and safeguarding our professional rights.

4. Special Categories of Personal Data
Article 9(2)(f) of Regulation (EU) 2016/679 – where processing is necessary for the establishment, exercise or defense of legal claims.

5. Data Relating to Criminal Convictions and Offences
Processing is carried out in accordance with Article 10 of Regulation (EU) 2016/679 and the applicable national legislation where necessary in connection with legal representation and defense.

6. Consent
Article 6(1)(a) of Regulation (EU) 2016/679 – where processing cannot be based on another legal ground (e.g. subscription to a newsletter). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal.

VI. Disclosure of Personal Data
Personal data may be disclosed solely where necessary for the performance of the mandated legal representation and defense, including to:
 - courts and public prosecutors’ offices;
 - administrative and supervisory authorities;
 - notaries and enforcement agents (bailiffs);
 - court-appointed experts;

 - opposing parties and their legal representatives;
 - accounting firms;
 - IT service providers and hosting companies;
 - courier and translation service providers.

All persons acting as data processors on our behalf are bound by contractual confidentiality obligations and process personal data strictly in accordance with our instructions.

VII. Transfers of Personal Data Outside the European Union
Transfers of personal data outside the European Union shall take place only where one of the following safeguards applies:
 - an adequacy decision of the European Commission;
 - appropriate safeguards pursuant to Article 46 of Regulation (EU) 2016/679; or
 - a relevant derogation under Article 49 of Regulation (EU) 2016/679.

VIII. Retention Period
Personal data shall be retained:
 - for a period of five (5) years following the completion of the relevant legal engagement;
 - for a longer period where necessary for the establishment, exercise or defense of legal claims;
 - accounting documents – in accordance with the statutory retention periods prescribed by applicable law.

IX. Mandatory Nature of the Provision of Data
The provision of personal data is necessary for the conclusion and performance of a contract for legal representation and legal assistance.

Failure to provide the required personal data may result in our inability to accept or perform the relevant legal engagement.

X. Rights of Data Subjects
You have the following rights:
 - the right of access to your personal data;
 - the right to rectification;
 - the right to erasure;
 - the right to restriction of processing;
 - the right to data portability;
 - the right to object to processing;
 - the right to withdraw consent (where processing is based on consent);
 - the right to lodge a complaint with a supervisory authority.

Given the nature of the legal services provided, certain rights may be restricted where their exercise would adversely affect the rights of other individuals, professional secrecy obligations, or the conduct of ongoing or prospective legal proceedings.

We do not carry out automated decision-making or profiling within the meaning of Regulation (EU) 2016/679.

Requests concerning the exercise of your rights may be submitted using the contact details provided above. We shall respond within one (1) month in accordance with Article 12 of Regulation (EU) 2016/679.

XI. Right to Lodge a Complaint
You have the right to lodge a complaint with the competent supervisory authority:

Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd. 1592 Sofia, Bulgaria
Website: www.cpdp.bg
Email: kzld@cpdp.bg

XII. Data Security
We implement appropriate technical and organisational measures to ensure the  security of personal data, including:
 - access control mechanisms;
 - secure communication channels;
 - restricted access to physical and electronic archives;
 - contractual confidentiality clauses with employees and collaborators.

These measures are designed to protect personal data against unauthorized access, unlawful processing, accidental loss, destruction or damage.

XIII. Amendments to this Policy
This Privacy Policy may be updated in the event of changes to applicable legislation or to the manner in which personal data is processed.

The current version of the Policy is published on our website.

Last updated: 1 March 2026