Last updated: 14 October 2026
Controller and contact details
International Legal Advice Center (ILAC), Bulgarian NGO registration number 176397057, is responsible for personal data processed through crypto-bulgaria.eu. Registered office: 123 Knyaz Boris Str., 1000 Sofia, Bulgaria. Correspondence address: 4 Saborna Str., 1000 Sofia, Bulgaria. For privacy questions or requests, email info@ilac.eu, contact the ILAC Data Protection Officer at dpo@dpa.bg, or write to the correspondence address.
Where a separate lawyer or other professional is engaged, you will receive information about that provider and any additional processing connected with the engagement. This website policy is not a substitute for a client-specific privacy notice.
What we receive
If you contact us, we receive the name, email address, optional company name, selected enquiry topic and message you provide. If you telephone or email us directly, we also receive the information contained in that communication. Please avoid including sensitive personal information in an initial enquiry.
Our hosting and email providers process technical information necessary to deliver the service, such as IP addresses, timestamps, requested URLs, browser information, delivery details and security events. The enquiry endpoint uses an essential session cookie and a short-lived rate-limit record to prevent abuse. The rate-limit record contains a hashed network identifier and submission timestamps, not your enquiry text.
Purposes and legal bases
We use enquiry information to understand your request and respond. Where you ask us to take steps towards a personal engagement, the legal basis is the steps necessary before entering a contract under GDPR Article 6(1)(b). Where you contact us on behalf of a business, or ask a general question, we rely on our legitimate interest in responding to genuine correspondence under Article 6(1)(f).
We rely on legitimate interests to keep the website secure, prevent spam and maintain service reliability. Where a legal obligation requires preservation or disclosure of information, Article 6(1)(c) applies. The contact form does not enrol you in marketing, and we do not sell your personal information.
Who may receive information
Access is limited to ILAC personnel and professionals who need the information to handle your enquiry, together with hosting, email and technical service providers acting under appropriate arrangements. We may disclose information to competent authorities where legally required, or where necessary to establish, exercise or defend a legal claim.
We do not intentionally publish enquiry information. If a service provider processes personal data outside the European Economic Area, the applicable transfer must be supported by an adequacy decision or another lawful safeguard, such as standard contractual clauses where appropriate. Contact us for information about safeguards relevant to your data.
Retention
We retain an enquiry for as long as reasonably needed to respond and manage follow-up, taking into account the nature of the matter, any complaint, applicable legal obligations and the period in which a legal claim may arise. Information relating to an accepted engagement follows the retention requirements communicated for that matter and applicable legal or professional obligations.
The form’s anti-abuse records become eligible for deletion after 24 hours and are removed when the next enabled, valid submission triggers the cleanup process. The essential session cookie expires at the end of the browser session, subject to browser session restoration. Hosting and email security logs follow the providers’ retention settings and are retained only as needed for service operation, incident investigation and applicable obligations. We can provide details of the relevant arrangements on request.
Cookies and external services
The ordinary information pages do not set analytics or advertising cookies. Opening the protected contact form creates the essential PHP session cookie used to validate the form and prevent cross-site submissions. It is not used for advertising or cross-site tracking.
Fonts, artwork and team photographs are served from this website. There are no embedded social feeds, third-party maps or marketing pixels in this version. Following an external link takes you to a separate website with its own privacy arrangements. If optional tracking is introduced, we will update this policy and obtain consent where required before activating it.
Your rights
Depending on the circumstances, you may request access to your personal data, correction, deletion, restriction, or portability. You may object to processing based on legitimate interests. If processing is based on consent, you may withdraw that consent without affecting the lawfulness of earlier processing. Some rights are subject to legal conditions and exceptions.
Send requests to info@ilac.eu or to the ILAC Data Protection Officer at dpo@dpa.bg. We may need proportionate information to verify your identity. We normally respond within one month; where the GDPR permits an extension, we will explain why. We do not use contact enquiries for solely automated decisions producing legal or similarly significant effects.
You can complain to the Bulgarian Commission for Personal Data Protection at cpdp.bg or to another competent supervisory authority. You do not have to contact us before exercising that right.
Security and updates
We use proportionate access controls and technical safeguards, but no internet transmission is completely risk-free. Never submit wallet recovery phrases, private keys, passwords or payment credentials. This website is intended for business and professional enquiries and does not knowingly solicit children’s personal data.
We will update this notice when website processing changes. The date shown above identifies the latest published version. Contact us if you would like clarification about any part of this policy.