PERSONAL DATA PROCESSING POLICY

The new European Data Protection Regulation (GDPR) will enter into force on 25 May 2018..
Protecting the privacy of individuals who entrust us with their personal data is important to us, as we pay the same attention to protecting the privacy of individuals whose data has been made available to us from other sources, in accordance with Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”).
The Data Protection Policy (DPP) of the GRUIA DUFAUT Law Office is in line with the European GDPR Regulation and takes into consideration the rights you enjoy with regard to how your data is processed by us.

WHO WE ARE
We are the GRUIA DUFAUT Law Office, having its registered office in Romania, 28 Hristo Botev Boulevard, 3rd District, Bucharest, and its secondary office in France, 6 Avenue George V, Paris, specializing in business law. We provide legal advice and assistance to Romanian and foreign companies during the development of their projects on the Romanian market or during the local extension of their business. The owner of the Law Office is Dana Andrée DUFAUT, a lawyer member of the Bucharest and the Paris Bar Associations.

WHAT IS PERSONAL DATA?
“Personal data" means any information that identifies or may identify an individual, whether directly or indirectly. This means that personal data includes information such as: name, surname, identification number, e-mail address, home address, mobile phone number, username, profile photos, location data etc. Personal data may also include unique numeric identifiers, such as your computer's IP address or the MAC address of your mobile device, as well as cookies.

WHAT DOES PERSONAL DATA PROCESSING MEAN?
"Processing" means any operation or set of operations performed on personal data or on personal data sets, with or without the use of automated means, such as the collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or other such communication, the alignment or combination, restriction, deletion or destruction.

PRINCIPLES GOVERNING DATA PROCESSING
The GRUIA DUFAUT Law Office adheres to the principles of personal data protection (hereafter referred to as the "Principles") provided by GDPR, in order to make sure that all data are:
1.Processed fairly, legally and transparently;
2.Collected for specified, explicit and legitimate purposes;
3.Adequate, relevant and limited in relation to the purposes for which they are processed ("data minimisation");
4.Correct and up-to-date;
5.Stored in a form that does not allow identification of the data subjects longer than necessary in relation to the purpose of the processing;
6.Processed in accordance with the rights of the data subject and in a way that ensures adequate security and protection against unauthorized or unlawful processing and loss.
It is also obvious that we have complied with and will continue to comply with professional secrecy and the confidentiality of the data and information provided to the GRUIA DUFAUT Law Office, in accordance with the legal provisions specific to our profession.

CATEGORIES OF PERSONAL DATA THAT WE PROCESS
The categories of personal data we process are closely linked our activity as lawyers. The purpose of the lawyer profession is to promote and defend the legitimate rights, freedoms and interests of natural and legal persons, whether public or private.

A lawyer’s activity is performed through any of the methods detailed in the specific legislation governing this profession (consultancy and legal requests, representation or assistance before the courts or other public authorities or judicial bodies, drafting legal documents etc.).

Thus, the categories of data we process are:

  • Personal information (such as: name, surname, date and place of birth, professional and/or personal address, personal and/or professional telephone number, fax number, e-mail address, position, CVs etc.);
  • Location data;
  • Online identifiers, IP addresses;
  • Data collected from public sources and/or databases (Trade Register, court portals, websites of various authorities etc.);
  • Special categories of data, such as health data, diagnosis, trade union membership, national identification numbers (PIN, series and numbers of ID cards), criminal convictions, offenses).

    Such data or part thereof is collected:
    either directly from you when you request legal services, when navigating or interacting with our website, when you offer us or provide us with your services, when you voluntarily submit this data to us in any form, as well as in other similar situations;
    or indirectly, e.g. in certain circumstances, in the exercise of our activity and in fulfilling certain legal obligations, we may collect certain personal data about you from your employer, from other companies, entities, authorities or individuals.

    DATA CONTROLLER
    The Data Controller is the GRUIA DUFAUT Law Office.

    GROUNDS AND OBJECTIVES OF PERSONAL DATA PROCESSING
    We process personal data to the extent permitted or required by the applicable law in force, for the following purposes:
    1.For the purpose of concluding, executing and monitoring the various contracts that we conclude in the conduct of our business;
    2.For the purpose of carrying out our professional activity (legal advice, representation in court, drafting legal documents, enforcement of court rulings etc.);
    3.In order to meet our legal obligations (including those resulting from legislation specific to the lawyer's profession, accounting, archiving, financial and fiscal legislation, including the legislation on the prevention and sanctioning of money laundering, tax evasion etc.);
    4.In order to communicate with you and to inform you about the our activities, for marketing purposes (newsletters and legal publications edited by us, invitations to events organized individually or in collaboration with other entities, promotion etc.).

    PROCESSING GROUNDS
    We process data on one of the following grounds:
  • Processing is required for the conclusion or performance of a contract to which you are a party;
  • Processing is done on the basis of your consent;
  • Processing is necessary in order to protect your vital interests;
  • Processing is necessary for the legitimate interest of our Law Office or of a third party (when processing is required for the performance of a contract to which your organization is a party), unless your interests or fundamental rights and freedoms prevail over those interests;
  • Processing is necessary for the establishment, exercise or defence of a right in court.
    On our website, at the “Contact” section, we have implemented a form for processing your requests.
    By contacting the GRUIA DUFAUT Law Office in any way (by e-mail, by phone, through the contact form on www.gruiadufaut.com) which involves a mediated or direct communication between you and the GRUIA DUFAUT Law Office, you understand and agree that your data will be processed by our Law Office. We undertake not to process such data for any purpose other than to respond to your request, unless we have your consent to use such data for other purposes as well.

    DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES
    We may disclose your personal data to other persons directly or indirectly involved in the execution of the contracts we sign or which we wish to sign with you, including legal assistance contracts.
    Thus, we may disclose the data to other lawyers or legal professionals with which we collaborate when supplying our services and/or other legal specialists (including bailiffs, mediators, notaries, various specialized consultants), consultants or experts involved in the files we manage and the services we provide, the courts or arbitration courts, as well as other public authorities, entities designated by you, parties involved in your case.
    We can also disclose your data to other entities in the context of our activities (such as insurance providers, network administrators, cloud service providers, phone service providers, event organizers etc.). In such cases, we will take the necessary steps in accordance with the Regulation to ensure that your data is processed by such persons in accordance with the purpose and through the means indicated by us.
    Any disclosure of data will be made in accordance with the principles and rules set forth in the Regulation under our responsibility.

    TRANSFER OF DATA TO FOREIGN COUNTRIES

    We may transfer your personal data to States that are part of the European Economic Area or to States that have been recognized by the European Commission as ensuring an adequate level of protection of personal data, if such transfer is necessary for processing under the Permitted Purposes described above.
    The Law Office does not intend to transfer data to third countries. However, in exceptional circumstances, if such a transfer would be necessary for the Permitted Purposes, we will ensure that such international transfers are made subject to appropriate protection measures (such as on the basis of Standard Contractual Clauses approved by the European Commission), as required by the General Data Protection Regulation (EU) 2016/679 or other applicable legal provisions.

    DURATION OF DATA STORAGE
    The GRUIA DUFAUT Law Office may keep the data processed for different periods of time, considered reasonable, for the purposes indicated above. We retain your data only for the period necessary to achieve the purpose for which we hold the data, to meet your needs or to fulfil our obligations under the law.
    In order for you to know how long your data can be stored, please note that we use the following criteria:
    1.When you use our services, we retain your personal data during our contractual relationship and for a further period of time necessary to establish, exercise or defend a right in court or before other public or private authorities or jurisdictions;
    2.In determining how long we retain your data, we take into account the mandatory legal deadlines (stipulated by accounting, tax, archiving legislation etc.);
    3.If data processing is based on consent, we retain your personal data until you unsubscribe or ask us to delete it or after a period of inactivity (no active interaction), defined in accordance with local regulations and guidelines.
    RIGHTS OF DATA SUBJECTS
    Subject to certain legal provisions that may limit these rights or justify a certain type of response from our Law Office, you have a series of rights with respect to personal data that the GRUIA DUFAUT Law Office processes:
    1.Right to access processed data - You have the right to access the personal data we hold and obtain copies thereof. The manifestly unreasonable, excessive or repeated requests may not be answered.
    2.Data rectification right - You have the right to have your data rectified if it is inexact or old and/or to supplement such data, if incomplete.
    3.The right to have data deleted (“right to be forgotten”) - In some cases, you have the right to obtain the deletion or destruction of your data, e.g. when you have withdrawn your consent, when processing is no longer required or is contrary to the law.
    4.The right to restrict processing - You may request the restriction of the processing of your data. This means that the processing of your data is limited, so we can keep the data, but not use or process it. This right applies in the specific circumstances set out in the General Data Protection Regulation, namely:
  • the accuracy of the personal data is contested by the data subject (i.e. you); in this case, processing is restricted for a period enabling the controller (i.e. GRUIA DUFAUT Law Office) to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject (i.e. you) opposes the erasure of the personal data and requests the restriction of their use instead;
  • the controller (i.e. GRUIA DUFAUT Law Office) no longer needs the personal data for the purposes of the processing, but they are required by the data subject (i.e. you) for the establishment, exercise or defence of legal claims;
  • the data subject (i.e. you) has objected to processing by the controller (i.e. GRUIA DUFAUT Law Office) on legitimate grounds, pending the verification of whether the legitimate grounds of the controller override those of the data subject (i.e. you).
    5.Right to object - You may at any time oppose the processing of your data when such processing is based on your consent or the legitimate interest of the controller.
    6.The right to withdraw consent at any time - You may withdraw your consent to the processing of your data when such processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing on the basis of such consent prior to its withdrawal.
    7.Right to file a complaint with the relevant supervisory authority - You have the right to file a complaint with the relevant data protection authority, namely the National Supervisory Authority for Personal Data Processing, headquartered at 28-30 Gheorghe Magheru Boulevard, Bucharest, Romania.
    You may exercise any of these rights in respect of personal data processed by the GRUIA DUFAUT Law Office by addressing a simple request to gdpr@gruiadufaut.com or by fax, to 004021305 57 57, or by post, to Bucharest, 3rd District, 28 Hristo Botev Boulevard. In such a situation, it is very likely that we ask for proof of your identity.

    PROCESSING SECURITY
    The GRUIA DUFAUT Law Office has adopted technical and organizational data processing measures, updated in accordance with the requirements of the Regulation, for the purpose of protecting personal data against any unauthorized access, misuse or disclosure, unauthorized modification, accidental destruction or loss. All employees and collaborators of the GRUIA DUFAUT Law Office, as well as any third parties acting in the name and on behalf of the GRUIA DUFAUT Law Office, are bound to keep confidentiality of the information and to comply with the requirements of the Regulation.

    EXEMPTION FROM LIABILITY
    The GRUIA DUFAUT Law Office website may contain links to other websites and/or other webpages that are not the property of the GRUIA DUFAUT Law Office. The GRUIA DUFAUT Law Office undertakes no liability for the content of such websites and therefore can not be held liable for the content, advertising, goods, services, software, information or other materials available on or through such websites. The GRUIA DUFAUT Law Office shall not be liable for the loss of personal data, any adverse effects on visitors' personal data, or other moral and/or patrimonial damage caused by access to those websites.

    UPDATE OF THE PERSONAL DATA PROTECTION AND PROCESSING POLICY
    Please note that this Policy may be subject to regular content changes by updating the GRUIA DUFAUT Law Office website.
    Please do not continue to use the GRUIA DUFAUT Law Office website if you do not agree to such changes. We also recommend that you check this page for any updates.


    CONTACT

    If you have any questions or concerns about how we process and use your personal data or want to exercise any of your rights, please contact us at gdpr@gruiadufaut.com.