← Back to yardlaw.eu

Privacy Policy

Last updated: 22 June 2026

This Privacy Policy explains how YARD Law Co. - Адвокатска Кантора YARD ("YARD Law", "we", "our") collects, uses, stores and protects personal data. It applies to visitors of yardlaw.eu and to clients and prospective clients who contact the firm.

A note on attorney–client privilege. Communications with the firm that are made for the purpose of seeking or providing legal advice are protected by attorney–client confidentiality (адвокатска тайна) under the Bulgarian Bar Act (Закон за адвокатурата) and the Code of Ethics of Bulgarian Lawyers. This privilege takes precedence over general data-protection rights of access and erasure where the two would conflict.

1. Who is the data controller

YARD Law Co.
Vitosha Blvd. 12, fl. 2 · 1000 Sofia, Bulgaria
Email: [email protected]
Registered with the Sofia Bar Association.

The supervisory authority for personal data in Bulgaria is the Commission for Personal Data Protection (Комисия за защита на личните данни) - www.cpdp.bg.

2. What data we collect

2.1 Website visitors

The website has no user accounts and no advertising or remarketing cookies. Analytics run only with your consent (see section 9). We store the following functional entries in your browser's localStorage, on your device:

  • yardLang - your chosen interface language.
  • yardTheme - your chosen colour theme (dark or navy).
  • yardConsent - your cookie-consent choice (accepted or declined), so we don't ask you again.

These entries are not sent to any server. You can clear them at any time from your browser settings.

2.2 People who contact us via the website

If you use the contact form, we receive the data you provide - typically: name, email address, the practice area selected, and the message you write. The form is submitted to Formspree, which forwards the message to our office inbox.

2.3 Clients and prospective clients

In the course of an engagement or pre-engagement discussion we may collect:

  • Identity data (full name, ID/EGN where required by law, address, nationality).
  • Contact data (email, phone).
  • Matter-specific data - anything you share with us so that we can advise you (contracts, corporate documents, financial records, correspondence, court filings, etc.).
  • Billing data (invoicing details, bank/payment information).
  • Information about other natural persons that you choose to share with us in the context of the matter (e.g. counterparties, beneficiaries, employees).

3. Why we collect it (purposes & legal basis under GDPR)

  • Performance of a contract (Article 6(1)(b) GDPR) - to provide the legal services you instruct us to provide, including advising, drafting, negotiating, and representing you.
  • Compliance with a legal obligation (Article 6(1)(c) GDPR) - anti-money-laundering checks under the Bulgarian Measures Against Money Laundering Act (ЗМИП), tax and bookkeeping obligations, and statutory record-keeping rules for attorneys.
  • Legitimate interests (Article 6(1)(f) GDPR) - responding to enquiries, conflict-of-interest checks, internal administration of the firm, and the establishment, exercise or defence of legal claims.
  • Consent (Article 6(1)(a) GDPR) - only where we explicitly ask for it (rare; we generally rely on the bases above).

For special-category data (Article 9 GDPR - e.g. health information shared in a personal-injury or family matter), the legal basis is Article 9(2)(f): processing is necessary for the establishment, exercise or defence of legal claims.

4. Where we store data

Client files are kept in a combination of:

  • Password-protected office computers at our premises in Sofia - access limited to the lawyers and assistants assigned to the matter.
  • Google Workspace (Google Drive, Gmail) - encrypted at rest and in transit. Google LLC is a U.S.-headquartered processor. Transfers outside the EEA are covered by the European Commission's Standard Contractual Clauses and Google's certification under the EU–U.S. Data Privacy Framework.
  • Physical paper files for documents that must be retained in original form (e.g. notarised powers of attorney) - stored in locked archives at the office.

5. Who we share data with

We do not sell personal data. We share data only with:

  • Courts, public authorities and counterparties, to the extent necessary to represent you or to comply with a court order or statute.
  • Service providers (processors) bound by written confidentiality and data-processing terms - currently: Google (Workspace, and - only with your consent - Google Analytics), Formspree (contact-form delivery), and Cloudflare (website hosting and content delivery). We do not authorise sub-processors to use the data for any other purpose.
  • Substitute counsel or experts we instruct in connection with your matter, with your knowledge.

6. How long we keep it

  • Active matter files: for the duration of the engagement.
  • Closed matter files: a minimum of 5 years from the end of the engagement, in line with the Bulgarian Bar Act and the firm's professional obligations; longer if required by law (e.g. 10 years for accounting records under the Accountancy Act) or if needed to defend against potential claims.
  • Contact-form enquiries that do not lead to an engagement: deleted within 12 months.
  • Anti-money-laundering records: 5 years from the end of the business relationship, as required by ЗМИП.

7. Your rights

Under GDPR you have the right to:

  • Request access to your personal data.
  • Request correction of inaccurate data.
  • Request erasure or restriction of processing.
  • Receive your data in a portable format.
  • Object to processing carried out on the basis of legitimate interests.
  • Withdraw any consent you have given.
  • Lodge a complaint with the Commission for Personal Data Protection.

These rights are subject to the limits set out in the GDPR and Bulgarian law. In particular, we may refuse a request for access, erasure or portability to the extent that complying with it would breach our attorney–client confidentiality obligations to you or to another client, would prejudice the establishment, exercise or defence of legal claims, or would conflict with the firm's statutory record-keeping duties.

8. Security

We protect personal data with reasonable organisational and technical measures: device passwords and full-disk encryption, two-factor authentication on email and cloud accounts, role-based access to client folders, regular backups, locked physical archives, and confidentiality obligations on every member of the firm and every contractor.

9. Cookies & analytics

We use Google Analytics 4 to understand aggregate, anonymous traffic - which pages are read, roughly where visitors come from, and how the site performs. We do not use it for advertising, remarketing or profiling.

  • Consent first. Analytics load only after you click "Accept" on the cookie banner. If you decline (or ignore it), no analytics cookies are set and no data is sent to Google. We use Google Consent Mode, which keeps analytics, advertising and personalisation storage denied by default until you opt in.
  • What it collects, if enabled. Google Analytics sets cookies (e.g. _ga) on your device and sends pseudonymised usage data to Google. IP addresses are anonymised, and we have disabled Google "products & services" data sharing and ad-personalisation signals.
  • International transfers. Google LLC acts as our processor; transfers outside the EEA are covered by the European Commission's Standard Contractual Clauses and Google's certification under the EU–U.S. Data Privacy Framework.
  • Withdrawing consent. You can withdraw at any time by clearing the yardConsent entry in your browser (which makes the banner appear again so you can choose "Decline"), by using your browser's cookie controls, or with a browser opt-out extension.

Apart from analytics (on consent), the only client-side storage we set is the functional localStorage entries described in section 2.1, which never leave your device.

10. Changes

We may update this policy from time to time. Material changes will be flagged on this page with a new "Last updated" date.

11. Contact

Questions, requests or complaints about how we handle personal data can be sent to [email protected]. We aim to respond within 30 days.

© 2026 YARD Law Co. · yardlaw.eu