Privacy Policy

1. General provisions. Who processes you data

„BOICIUC ELISABETA-MARIA – Law Office”, is an individual law firm, having its registered office in Romania, Bucharest, 3^rd District, Camil Ressu Street, no. 29, bl. N2, entrance 5, 4^th floor, ap. 203, room 1, duly authorized pursuant to the decision no. 500/1-30.01.06 issued by Bucharest Bar and the decision no. 2461/12.11.2019 issued by Bucharest Bar, fiscal registration code RO41925136, duly represented by Mrs. Elisabeta-Maria Boiciuc, in capacity as Managing Partner, hereinafter referred to as the ”Office”

The protection of confidentiality regarding the collection, processing and use of your personal data is an important concern for the Office, which processes your data through the Managing Partner and/or the Office’s collaborating lawyers, and, as such, we want to ensure the highest standards of confidentiality and transparency regarding the personal data we process in our current activity. Thus, the processing of personal data is carried out in accordance with the General Data Protection Regulation no. 679/2016 (GDPR), in force since May 15, 2018, and the legislation in force in Romania regarding the protection of personal data.

This Privacy Policy applies to clients, potential clients, consultants (including of the clients), collaborating lawyers and people who interact with us in the course of our professional activities.

1. Definitions

Personal data – any information regarding an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more specific elements of its physical, physiological, genetic, psychological, economic, cultural or social identity

Data subject – the natural person whose personal data are processed

Data controller – the natural or legal person who decides why (for what purpose) and how (by what means) personal data are processed. In relation to you, we are the data controller and you are the data subject.

Consent – any free, specific, informed and unambiguous manifestation of the users through which it accepts, through a statement or an unequivocal action, for its personal data to be processed

Processing – any operation or set of operations performed on personal data or sets of personal data, including but not limited to collection, recording, retention, modification, use, disclosure, access, transfer or destruction

Breach of personal data – means a breach of security that leads to the destruction, loss, alteration, unauthorized disclosure or access to personal data transmitted, stored or otherwise processed

Data Protection Authority – The National Supervisory Authority for the Processing of Personal Data or, as the case may be, the European Data Protection Authority

III. Principles of personal data processing

We undertake to consider the following principles of protection and processing of personal data:

• The processing of personal data is carried out in a legal, fair and transparent manner;
• The collection of personal data is carried out for specific, explicit and legitimate purposes, not being subsequently processed in a way incompatible with these purposes;
• Personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• Personal data is strictly accurate and updated where necessary;
• Personal data are kept in a form that allows identification only for the period necessary to fulfill the purposes for which the data are processed;
• The processing is carried out in a way that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, by taking appropriate technical or organizational measures.

1. Types of personal data processed. Purpose of processing. The legal basis of the processing

The following types of personal data may be collected by us:

• Contact information such as: name, surname, postal address, iincluding the domicile ot professional headquarters (country, city, county), telephone number, fax numer, e-mail address;
• Personal information such as: nationality, gender, date of birth;
• Additional information processed in the context of concluding some legal assistance contracts with the Office or voluntarily communicated by you, such as: instructions received, payments made, inormation related any legal issues, including transactions, disputes and/or litigation in which you are or may be involved in any capacit, as well as economic or financial information (credit or debit card no., IBAN, if the case);
• In case of providing legal assistance services, we can collect and process special categories of personal data, such as: data on trade union membership.

The personal data listed above are collected and processed for purposes that may include:

• Providing legal assistance and consultancy services, representation before the competent public and/or private authorities;
• Communication with you for constantly and adequately informing you about the evolution / status of the requested services;
• Administration and management of the professional and contractual relationship with our clients;
• Respecting and complying with our legal obligations (such as reporting to the tax authorities or those related to combating money laundering and terrorist financing), including those established by law for lawyers, including keeping professional records / registrations;
• For the exercise and/or defense of our rights and interests;
• For any other purpose auxiliary to the above, or for any other purpose for which personal data was provided to us, in compliance with the relevant legislation.

In situations where we will use your data for purposes other than those mentioned in this Privacy Policy, we undertake to obtain your consent, unless we are under a legal obligation or have another legal basis for processing the data.

Any processing of your data for the aforementioned purposes is based on one of the following grounds according to art. 6 GDPR:

• Conclusion or execution of a contract to which you are a party;
• Fulfillment of certain obligations stipulated by the legal provisions in Office’s charge;
• The processing is necessary for the legitimate interests pursued by the Office;
• Prelucrarea este necesara in scopul protectiei interesului dvs. legitim sau al altor persoane;
• The processing is necessary for the purpose of protecting the legitimate interest of the Office or of a third party
• Prelucrarea este necasara in scopul protectiei interesului legitim al Cabinetului sau al unei terte parti (for example, when the processing is necessary for the execution of a contract in which your organization is a party), unless your interests or fundamental rights and freedoms prevail over these interests;
• The data subject has given its consent to the processing of its personal data for one or more specific purposes,
• Persoana vizata si-a dat consimtamantul pentru prelucrarea datelor sale cu caracter personal pentru unul sau mai multe scopuri specifice, including regarding the special categories of personal data, when the processing will be carried out if, in addition to a general legal basis for data processing, your consent has been obtained or if the Office has a legal obligation to process these categories of data.

(*) When the applicable legal grounds require your prior and explicit consent for the processing of special categories of personal data, we will process the respective data only on the basis of your prior and explicit consent.

1. Method of collecting personal data

Your personal data is collected either directly, from you, or, as the case may be, from a third-party source such as: other companies or persons with whom you have connections with, government agencies, credit bureaus, information or service providers or from public registers / archives.

1. Storage of personal data. Personal data storage period

We assume and take seriously our responsibility to protect the personal data you entrust us. Thus, to avoid loss, improper use or unauthorized access, we use a variety of security technologies and organizational procedures to help protect personal data. The data are carefully protected against loss, destruction, falsification, manipulation and unauthorized access or disclosure. Collaborating lawyers and partners of the Office are obliged to maintain the confidentiality of personal data and are trained regarding the manner of processing data. The security of the IT systems used is regularly monitored

As a principle, your personal data will be kept strictly for the time necessary to achieve the purposes of the processing mentioned above or until you withdraw your consent (where applicable) and to the extent that there is no longer a legal obligation to continue the storage of personal data operation and there are no longer legitimate and compelling reasons that justify further processing by the Office (including the legal obligation of the Office to continue storing the data in question) and that prevail over your interests, rights and freedoms. Therefore, personal data will be stored only as long as necessary, for the duration of your relationship established with the Office and subsequently for the retention periods imposed by the applicable law

Upon expiration of the retention period or upon exercising one of your rights, in accordance with the law, we will remove / delete your personal data from our systems and records and / or take measures to anonymize them, so that you can no longer be identified based on them.

VII. Transfer of personal data

In order to fulfill the processing purposes, respectively for the optimal performance of the legal assistance and consultancy services, we may communicate your personal data to:

• collaborators, including collaborating lawyers, consulting partners or experts, accountants, auditors or other external advisors, mediators, notaries public if the transfer is necessary in view of the object of the services required by you;
• authorities, institutions and central / local public bodies, if there is a legal request from them or to the extent that there is a legal obligation on our part;
• any third party to whom we assign any rights or obligations, in accordance with the law.

Your data will not be transferred outside the European Economic Area.

If the Office transmits the data to third parties for the purpose of providing a service, the latter are obliged to comply with the provisions of the General Data Protection Regulation no. 679/2016 (GDPR) – article 28 – or other legal provisions regarding confidentiality.

In general, the Office does not transmit personal data to third parties, except in the case where the persons concerned have expressed their consent or if there is a legal obligation in this regard.

VIII. Rights of data subjects

As a data subject, you benefit from a series of specific rights guaranteed by the GDPR Regulation and the legislation in force in Romania regarding the protection of personal data, as follows:

• Right to information – which means that you have the right to receive information from us regarding the processing of your personal data
• Right of access – which means that you have the right to obtain confirmation that your personal data is being processed by us and, in addition, to access it and obtain a range of relevant additional information, as well as a copy of the said data, under the conditions provided for within art. 15 of GDPR Regulation
• Right to rectification – which means that you have the right to request the rectification or completion of your personal data, which is inaccurate or incomplete
• Right to delete (”Right to be forgotten”) – which means that, in certain circumstances, you have the right to have your personal data deleted without undue delay, respectively when: (i) the personal data are no longer necessary to fulfill the purposes for which they were collected; (ii) you object to processing for reasons related to your particular situation; (iii) personal data were processed illegally; (iv) personal data must be deleted in order to comply with a legal obligation incumbent to us, unless the data is necessary: a. for exercising the right to free expression and information, b. to comply with a legal obligation we have, c. for archival purposes in the public interest, for scientific or historical studies or for statistical purposes, d. for establishing, exercising or defending a right in court
• Right to restriction of processing – which means you have the right to request the restriction of processing when: (i) you dispute the accuracy of the data, for a period that allows us to verify the accuracy of the data; (ii) the processing is illegal, but you object to the deletion of your personal data, requesting instead the restriction of its use; (iii) we no longer need your personal data for the purpose of processing, but you request it to establish, exercise or defend a right in court; (iv) you have objected to the processing and request restriction while we check whether our legitimate interest for the processing prevails.

In this case, apart from storage, we will only be able to process your personal data in question if: (i) we have your consent.; (ii) are necessary to establish, exercise or defend a right in court or to protect the rights of another natural or legal person, or; (iii) for important reasons which aims the public interest.

• Right to data portability – which means that you have the right to obtain from us your personal data in a structured, current and machine-readable format, as well as the right to transmit the data in question to another controller
• Right to object – which means that, at any time, you have the right to object to the processing, for reasons related to the particular situation. In this case, we will no longer process the personal data, unless we demonstrate that we have legitimate and compelling reasons that justify the processing and which prevail over your interests, rights and freedoms, or that the purpose is to establish, exercise or defend a right in court. You can object at any time to the processing of your personal data for direct marketing purposes, whatever your reason
• Right not to be subject to a decision based solely on automated processing, including profiling – which means that this right is applicable where the automated individual decision-making process produces legal effects that concern or affect you to a significant extent
• Right to file a complaint – which means that if you have a complaint about the processing of your personal data, please contact us using the contact details listed in section X below, so that we can resolve your issue.

According to personal data protection legislation, the response period is of 30 days. If, depending on the complexity of the request, we cannot implement the requested measures in less than one month, this period can be extended by a maximum of 60 days. In this situation, you will receive an information within a maximum of 30 days after sending the request, regarding the reasons for the delay.

You also have, at any time, the right to register a complaint with the National Supervisory Authority for the Processing of Personal Data using the contact details listed in section XI below.

1. Update of the Privacy Policy

We reserve the right to amend the hereby Privacy Policy at any time in accordance with applicable law. Any revisions and, implicitly, the updated version of the Privacy Policy will be found on this webpage, which will come into force from the date of its posting, reason for which we recommend that you review it periodically.

In addition, we will provide a related notice within the website to notify you of the change made and we will indicate at the bottom of the policy the date on which the most recent update was made.

1. Our Contact Information

Address: Romania, Bucharest, 3^rd District, Camil Ressu Street, no. 29, bl. N2, entrance 5, 4^th floor, ap. 203, room 1

Telepfone: +40 760 688 873

E-mail: elisabeta.matei@legal-counsel.ro  

1. The National Authority for the Supervision of the Processing of Personal Data

Address: G-ral. Gheorghe Magheru Blvd. 28-30, postal code 010336, 1st District, Bucharest, Romania

Website: http://www.dataprotection.ro/

E-mail: anspdcp@dataprotection.ro

Telephone: +40.318.059.211; +40.318.059.212