NOTICE ON PERSONAL DATA PROTECTION

NOTICE ON PERSONAL DATA PROTECTION

Starting with May 25, 2018, the new European Regulation on personal data protection, GDPR (“General Data Protection Regulation”) has entered into force.

Protecting private life of natural persons that entrust us with their personal data is a very important matter for our Law firm to the same extent we value and protect the private life of individuals whose personal data is entrusted to us, in accordance with the provisions of the Regulation EU 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”).

GRUIA DUFAUT & PARTNERS Data Protection Policy is consistent with the provisions of the European Regulation on GDPR and observes the rights you are entitled to with respect to our processing of your data.

WHO ARE WE?

We areGRUIA DUFAUT & PARTNERS law firm, with registered headquarters in Romania, 28 Hristo Botev Boulevard, 3rd District, Bucharest, and we provide legal counselling and advice to Romanian and foreign companies during their setting up in Romania or their expansion projects locally. The Managing Partner of the law firm is Mrs. Dana Andrée DUFAUT.

WHAT IS PERSONAL DATA?

“Personal data” means any piece of information or information identifying or likely to identify, directly or indirectly a person. This means that personal data include information such as: name, surname identification number, email address, domicile, mobile number, user name, profile pictures, localisation data, etc. It can also include unique identifying numbers such as your computer’s IP or MAC address of your portable device, as well as cookies modules.

WHAT IS PERSONAL DATA PROCESSING?

“Processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

PRINCIPLES REGARDING DATA PROCESSING

GRUIA DUFAUT & PARTNERS abides by the principles related to personal data protection (hereinafter referred to as „the Principles” as provided for under GDPR, in order to ensure that all data is:

1. Lawfully, transparently and fairly processed;

2. Collected for specified, explicit and legitimate purposes;

3. Adequate, relevant and limited with respect to the purpose of the processing („data minimization”);

4. Correct and updated;

5. Kept in a form that does not allow identifying the concerned persons for a longer period than necessary with respect to the purpose of the processing;

6. Processed in accordance with the rights of the concerned person and in a manner ensuring adequate protection against unauthorized or illegal processing and against data loss.

It also goes without saying that we have been keeping accordingly and we shall continue to keep professional secrecy as well as the confidentiality of the data and information entrusted to GRUIA DUFAUT & PARTNERS , in accordance with the legal provisions applicable to our profession.

CATEGORIES OF PERSONAL DATA WE PROCESS

The categories of personal data we process are strongly related to the activity we perform as lawyers, they can be very diverse and are likely to include data regarding private or professional life or sensitive data.

Our profession as lawyers is aimed at promoting and defending the rights, the freedoms and legitimate interests of natural and legal persons, public or private, and while performing their profession, lawyers are indispensable partners for justice.

The lawyer’s activity is pursued by means of any of the methods provided for by the specific legislation governing the profession (consultancy and legal requests, representation or advising before courts or other public authorities or jurisdictional bodies, drawing up legal deeds, etc.).

Therefore the categories of data that we process are:

• Personal information (such as: name, surname, date and place of birth, personal and/or professional address, personal and/or professional phone number, fax number, email address, the position held, your professional experience, data from your CV, etc.);
• Categories of special data such as: health data, diagnosis, affiliation to unions, national identification numbers (such as PIN, series and number of the ID cards), criminal records, felonies);
• Data collected from sources and / or public data bases (Trade Register, the portal of the Courts, webpages of different authorities, etc.);
• Localization data; - Online identifiers, IP address;
  

These categories of data or some of it are collected:

• Either directly from you when you request for our legal services, when you visit our website or you interact with us thereby, when you offer your services or provide them for us, when you voluntarily convey such data to our Law firm, in any way as well as in any other similar situations;
• Either indirectly, for example, in certain circumstances in pursuing our activity and in fulfilling certain legal obligations we may be brought to collect certain personal data about you from your employer, from other companies, entities, authorities or natural persons.

PERSONAL DATA PROCESSOR

The personal data processor (hereinafter referred to as “the operator”) is GRUIA DUFAUT & PARTNERS.

GROUNDS AND PURPOSES OF PERSONAL DATA PROCESSING

We process personal data to the extent allowed or requested by the legislation in force, for the following purposes:

1. For the purpose of concluding, executing and monitoring of the different agreements we are party thereto in pursuing our activity;

2. For the purpose of the performance of our professional activity (legal counselling, representation before courts, drawing up legal deeds, enforcement of legal decisions, etc.);

3. For the purpose of fulfilling the obligations incumbent to us (including those resulting from the legislation applicable to the lawyer’s profession, the accounting and storage legislation, financial and fiscal legislation, including the legislation on prevention and sanctioning of money laundering, tax evasion, etc.);

4. For the purpose of doing justice, thus serving a public interest (art. 38 paragraph 1, the Law 51/1995);

5. For the purpose of communicating with you and your information about the Firm’s activity, for marketing proposes (newsletter and legal publications issued by the Law Firm, invitation to events organized individually or in collaboration with other entities, promotion, etc.).

GROUNDS FOR DATA PROCESSING

Data processing operations are carried out by GRUIA DUFAUT & PARTNERS on one of the following grounds:

• Processing is necessary for concluding or executing an agreement to which you are party thereto;
• Processing is carried out on grounds of your consent;
• Processing is necessary for the purpose of the legitimate interests of our Law Firm or those of a third party (when processing is necessary for the execution of a contract your organization is party thereto), except for the cases when your fundamental rights and freedoms prevail thereover;
• Processing is necessary for ascertaining, exercising or defending a right in the court of law;
• Processing is necessary for carrying out a task serving public interest.

On GRUIA DUFAUT & PARTNERS ’s website there is a specific form, available on the page Contacts, for processing your requests.

By contacting GRUIA DUFAUT & PARTNERS , by any of the available means (e-mail, phone, the contact form available on the website www.gruiadufaut.com) which presupposes a direct or a mediate communication between you and GRUIA DUFAUT & PARTNERS, you understand and agree that your personal data shall be processed by our Law firm. GRUIA DUFAUT & PARTNERS hereby undertakes not to process such data for other purposes than that of answering your request, except for the cases when you have already consented to their being used for other purposes as well.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

We may be lead to disclose your personal data also to other persons that are directly or indirectly involved in the performance of the agreements we execute or that we whish to execute with you, including the legal assistance contract, to the extent that such disclosure is required for the performance of our own activities.

Thus, we may be brought to disclose your personal data to other lawyers or forms of performance of our profession (including other forms of performance of our profession with which we collaborate in providing our services) and / or other specialists in the legal field (including bailiffs, mediators, notaries, different specialized advisers), consultants or experts involved in the file case we are processing and the services we provide, arbitrary and judicial courts as well as other public authorities, entities indicated by you, parties involved in your file.

We could also be brought to disclose your data to other entities within the context of the activity of our Law firm (such as insurers, network administrators, cloud and phone service providers, partners in the organization of certain events, etc.) In such situations, the Law Firm shall undertake all necessary measures, as provided for under the Regulation, to make sure that your data is processed by such persons in accordance with the purpose and by the means indicated by the Law Firm.

Any data disclosure shall be made in observance of the principles and rules that apply to us pursuant to the Regulation.

DATA TRANSFER ABROAD

We may be brought to transfer your personal data in States belonging to the European Economic Space or in States that have been ascertained by the European Commission as ensuring an adequate level of protection of personal data, if such transfer is necessary for processing in accordance with the purposes hereinabove described.

The Law Firm does not intend to transfer data to third party States. Nonetheless, in exceptional circumstances, if such a transfer had been necessary for the Allowed Purposes, we shall make sure that such international transfers are carried out under adequate protection measures (i.e. under Standard Contractual Clauses approved by the European Commission) as provided for under the General Data Protection Regulation (UE) 2016/679 or by other applicable legal provisions.

DATA STORAGE DURATION

GRUIA DUFAUT & PARTNERS is allowed to store data processed for different periods of time, deemed as reasonable within the context of the purposes hereinbefore. We store your data only during the time necessary to achieve the objectives for which we have the data, to meet your needs or to accomplish the obligations falling to us under the law.

If you want to determine for how long your data is likely to be stored, here are the criteria we use:

1. When you use our services we keep your personal data during the contractual relationship and for a subsequent period necessary for ascertaining, exercising or defending a right before a court or other private or public authority or jurisdictional bodies;

2. When setting up the duration for the storage of data we consider mandatory legal delays (pursuant to the accounting, fiscal, storage legislation, etc.)

3. In the event that data processing is performed based on your consent, we keep your data until you unsubscribe or you request us o delete them or after a period of inactivity (no active interaction) defined according to the local regulations and guidelines.

THE RIGHTS OF THE CONCERNED PERSONS

Conditional upon certain legal provisions that are likely to limit such rights or that may entitle our Law Firm to a certain type of response, you enjoy a series of rights in connexion with the personal data that GRUIA DUFAUT & PARTNERS processes:

1. The right to access to the data processed – You are entitled to access your personal data we hold and obtain copies thereof. Any claim obviously ungrounded, excessive or repeated may not be answered to.

2. The right to rectification of data – You have the right to request that your Data is rectified if inaccurate or not up to date and/or complete it if incomplete.

3. The right to data erasure (the right to be forgotten) - There are cases when you are entitled to ask your data being erased or destroyed, e.g. when you withdraw your consent, when processing is no longer necessary or is contrary to the legal provisions.

4. The right to the restriction of the processing – You are entitled to request the restriction of the processing of your data. This means that the processing of your data is limited so that we can keep the data but we are not allowed to use or process it. Such right can be exercised only in specific circumstances provided for by the General Data Protection regulation, i.e.:

• when the accuracy of data is challenged by the concerned person (i.e. yourself), in this case processing is restricted for a period allowing the data processor (meaning GRUIA DUFAUT & PARTNERS ) to check the accuracy of data;
• processing is illegal and the concerned person (i.e. yourself) opposes to data erasure and requires restriction of data use;
• the processor (i.e. GRUIA DUFAUT & PARTNERS ) no longer needs the data to be processed but it is requested buy the concerned person (i.e. yourself) for setting, exercising or defending some legal claims;
• the concerned person (i.e. yourself) has raised objections to legitimate processing by the operator (in this case GRUIA DUFAUT & PARTNERS ) on grounds of checking whether the operator’s legitimate reasons override those of the concerned person (i.e. yourself).

5. The opposition right - You may oppose at any time to the processing of your data when such processing is based on your consent or on the processor’s legitimate interest.

6. The right to withdraw the consent at any time – You may withdraw your consent on the processing of your data when such processing is consent based. Withdrawal of your consent does not impair the legality of the processing before its being withdrawn.

7. The right to file a complaint with the competent supervisory authority – You are entitled to file a complaint before the competent authority on data protection, i.e. the National Supervisory Authority for Personal Data Processing, headquartered in Bucharest, Romania, 28-30 Gheorghe Magheru Bulevard.

You can also exercise any of these rights on personal data that GRUIA DUFAUT & PARTNERS process by means of a simple request to the email address gdpr at gruiadufaut . com or by mail at the following address: 28 Bulevard Hristo Botev, 3rd District, Bucharest. In this situation, it is very likely that we ask for a proof on your identity.

SECURITY OF THE PROCESSING

GRUIA DUFAUT & PARTNERS has adopted technical and organizational measures for data processing, subject to update pursuant to the requirements of the Regulation, aimed at protecting personal data against any unauthorized access, misuse or disclosure, unauthorized alteration, destruction or accidental loss. All employees and collaborators of the Law Firm as well as any third parties acting in the name and on behalf of GRUIA DUFAUT & PARTNERS must comply with confidentiality requirements and those set under the Regulation.

EXONERATION OF LIABILITY

GRUIA DUFAUT & PARTNERS ’s website may contain links towards other websites and/or web pages that are not property of the Law Firm. We take no liability with respect to the content of such websites and, therefore, can not be held accountable for the content, advertising, goods, services, software, information or other material made available on or by these webpages. GRUIA DUFAUT & PARTNERS shall not be liable for the loss of personal data, by any negative effects on the visitor’s personal data or for any other moral and/or patrimonial damages that access to such sites may trigger.

UPDATE OF THE POLICY OF PERSONAL DATA PROTECTION AND PROCESSING

Please keep in mind that the content of this Policy may be subject to periodic amending, by update of the website of GRUIA DUFAUT & PARTNERS .

Should you not agree with such amending, be advised not to use GRUIA DUFAUT & PARTNERS ’s website. Moreover, we strongly advise you to check this page for any update.

CONTACT

For any enquiry or concern on the use and processing of your personal data or for exercising any of your rights, please contact us at gdpr at gruiadufaut . com.