NOTICE ON PERSONAL DATA PROTECTION
NOTICE ON PERSONAL DATA PROTECTION
Starting with May 25, 2018, the new European Regulation on personal data protection, GDPR (“General Data Protection Regulation”) has entered into force.
Protecting private life of natural persons that entrust us with their personal data is a very important matter for our Law office to the same extent we value and protect the private life of individuals whose personal data is entrusted to us, in accordance with the provisions of the Regulation EU 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”).
GRUIA DUFAUT Law Office Data Protection Policy is consistent with the provisions of the European Regulation on GDPR and observes the rights you are entitled to with respect to our processing of your data.
WHO ARE WE?
We are GRUIA DUFAUT Law Office, with registered headquarters in Romania, 28 Hristo Botev Boulevard, 3rd District, Bucharest and secondary office registered in France, 6 Avenue George V, Paris, and we provide legal counselling and advice to Romanian and foreign companies during their setting up in Romania or their expansion projects locally. The holder of the Office is Mrs. Dana Andrée DUFAUT, registered lawyer with both Bucharest and Paris Bars.
WHAT IS PERSONAL DATA?
“Personal data” means any piece of information or information identifying or likely to identify, directly or indirectly a person. This means that personal data include information such as: name, surname identification number, email address, domicile, mobile number, user name, profile pictures, localisation data, etc. It can also include unique identifying numbers such as your computer’s IP or MAC address of your portable device, as well as cookies modules.
WHAT IS PERSONAL DATA PROCESSING?
“Processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
PRINCIPLES REGARDING DATA PROCESSING
GRUIA DUFAUT Law Office abides by the principles related to personal data protection (hereinafter referred to as „the Principles” as provided for under GDPR, in order to ensure that all data is:
1. Lawfully, transparently and fairly processed;
2. Collected for specified, explicit and legitimate purposes;
3. Adequate, relevant and limited with respect to the purpose of the processing („data minimization”);
4. Correct and updated;
5. Kept in a form that does not allow identifying the concerned persons for a longer period than necessary with respect to the purpose of the processing;
6. Processed in accordance with the rights of the concerned person and in a manner ensuring adequate protection against unauthorized or illegal processing and against data loss.
It also goes without saying that we have been keeping accordingly and we shall continue to keep professional secrecy as well as the confidentiality of the data and information entrusted to GRUIA DUFAUT Law Office, in accordance with the legal provisions applicable to our profession.
CATEGORIES OF PERSONAL DATA WE PROCESS
The categories of personal data we process are strongly related to the activity we perform as lawyers, they can be very diverse and are likely to include data regarding private or professional life or sensitive data.
Our profession as lawyers is aimed at promoting and defending the rights, the freedoms and legitimate interests of natural and legal persons, public or private, and while performing their profession, lawyers are indispensable partners for justice.
The lawyer’s activity is pursued by means of any of the methods provided for by the specific legislation governing the profession (consultancy and legal requests, representation or advising before courts or other public authorities or jurisdictional bodies, drawing up legal deeds, etc.).
Therefore the categories of data that we process are:
- Personal information (such as: name, surname, date and place of birth, personal and/or professional address, personal and/or professional phone number, fax number, email address, the position held, your professional experience, data from your CV, etc.);
- Categories of special data such as: health data, diagnosis, affiliation to unions, national identification numbers (such as PIN, series and number of the ID cards), criminal records, felonies);
- Data collected from sources and / or public data bases (Trade Register, the portal of the Courts, webpages of different authorities, etc.);
- Localization data; - Online identifiers, IP address;
These categories of data or some of it are collected:
- Either directly from you when you request for our legal services, when you visit our website or you interact with us thereby, when you offer your services or provide them for us, when you voluntarily convey such data to our Law Office, in any way as well as in any other similar situations;
- Either indirectly, for example, in certain circumstances in pursuing our activity and in fulfilling certain legal obligations we may be brought to collect certain personal data about you from your employer, from other companies, entities, authorities or natural persons.
PERSONAL DATA PROCESSOR
The personal data processor (hereinafter referred to as “the operator”) is GRUIA DUFAUT Law Office.
GROUNDS AND PURPOSES OF PERSONAL DATA PROCESSING
We process personal data to the extent allowed or requested by the legislation in force, for the following purposes:
1. For the purpose of concluding, executing and monitoring of the different agreements we are party thereto in pursuing our activity;
2. For the purpose of the performance of our professional activity (legal counselling, representation before courts, drawing up legal deeds, enforcement of legal decisions, etc.);
3. For the purpose of fulfilling the obligations incumbent to us (including those resulting from the legislation applicable to the lawyer’s profession, the accounting and storage legislation, financial and fiscal legislation, including the legislation on prevention and sanctioning of money laundering, tax evasion, etc.);
4. For the purpose of doing justice, thus serving a public interest (art. 38 paragraph 1, the Law 51/1995);
5. For the purpose of communicating with you and your information about the Office’s activity, for marketing proposes (newsletter and legal publications issued by the Office, invitation to events organized individually or in collaboration with other entities, promotion, etc.).
GROUNDS FOR DATA PROCESSING
Data processing operations are carried out by GRUIA DUFAUT Law Office on one of the following grounds:
- Processing is necessary for concluding or executing an agreement to which you are party thereto;
- Processing is carried out on grounds of your consent;
- Processing is necessary for the purpose of the legitimate interests of our Office or those of a third party (when processing is necessary for the execution of a contract your organization is party thereto), except for the cases when your fundamental rights and freedoms prevail thereover;
- Processing is necessary for ascertaining, exercising or defending a right in the court of law;
- Processing is necessary for carrying out a task serving public interest.
On GRUIA DUFAUT Law Office’s website there is a specific form, available on the page Contacts, for processing your requests.
By contacting GRUIA DUFAUT Law Office, by any of the available means (email, phone, the contact form available on the website www.gruiadufaut.com) which presupposes a direct or a mediate communication between you and GRUIA DUFAUT Law Office, you understand and agree that your personal data shall be processed by our Law office. GRUIA DUFAUT Law Office hereby undertakes not to process such data for other purposes than that of answering your request, except for the cases when you have already consented to their being used for other purposes as well.
DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES
We may be lead to disclose your personal data also to other persons that are directly or indirectly involved in the performance of the agreements we execute or that we whish to execute with you, including the legal assistance contract, to the extent that such disclosure is required for the performance of our own activities.
Thus, we may be brought to disclose your personal data to other lawyers or forms of performance of our profession (including other forms of performance of our profession with which we collaborate in providing our services) and / or other specialists in the legal field (including bailiffs, mediators, notaries, different specialized advisers), consultants or experts involved in the file case we are processing and the services we provide, arbitrary and judicial courts as well as other public authorities, entities indicated by you, parties involved in your file.
We could also be brought to disclose your data to other entities within the context of the activity of our Law office (such as insurers, network administrators, cloud and phone service providers, partners in the organization of certain events, etc.) In such situations, the Office shall undertake all necessary measures, as provided for under the Regulation, to make sure that your data is processed by such persons in accordance with the purpose and by the means indicated by the Office.
Any data disclosure shall be made in observance of the principles and rules that apply to us pursuant to the Regulation.
DATA TRANSFER ABROAD
We may be brought to transfer your personal data in States belonging to the European Economic Space or in States that have been ascertained by the European Commission as ensuring an adequate level of protection of personal data, if such transfer is necessary for processing in accordance with the purposes hereinabove described.
The Office does not intend to transfer data to third party States. Nonetheless, in exceptional circumstances, if such a transfer had been necessary for the Allowed Purposes, we shall make sure that such international transfers are carried out under adequate protection measures (i.e. under Standard Contractual Clauses approved by the European Commission) as provided for under the General Data Protection Regulation (UE) 2016/679 or by other applicable legal provisions.
DATA STORAGE DURATION
GRUIA DUFAUT Law Office is allowed to store data processed for different periods of time, deemed as reasonable within the context of the purposes hereinbefore. We store your data only during the time necessary to achieve the objectives for which we have the data, to meet your needs or to accomplish the obligations falling to us under the law.
If you want to determine for how long your data is likely to be stored, here are the criteria we use:
1. When you use our services we keep your personal data during the contractual relationship and for a subsequent period necessary for ascertaining, exercising or defending a right before a court or other private or public authority or jurisdictional bodies;
2. When setting up the duration for the storage of data we consider mandatory legal delays (pursuant to the accounting, fiscal, storage legislation, etc.)
3. In the event that data processing is performed based on your consent, we keep your data until you unsubscribe or you request us o delete them or after a period of inactivity (no active interaction) defined according to the local regulations and guidelines.
THE RIGHTS OF THE CONCERNED PERSONS
Conditional upon certain legal provisions that are likely to limit such rights or that may entitle our Law Office to a certain type of response, you enjoy a series of rights in connexion with the personal data that GRUIA DUFAUT Law Office processes:
1. The right to access to the data processed – You are entitled to access your personal data we hold and obtain copies thereof. Any claim obviously ungrounded, excessive or repeated may not be answered to.
2. The right to rectification of data – You have the right to request that your Data is rectified if inaccurate or not up to date and/or complete it if incomplete.
3. The right to data erasure (the right to be forgotten) - There are cases when you are entitled to ask your data being erased or destroyed, e.g. when you withdraw your consent, when processing is no longer necessary or is contrary to the legal provisions.
4. The right to the restriction of the processing – You are entitled to request the restriction of the processing of your data. This means that the processing of your data is limited so that we can keep the data but we are not allowed to use or process it. Such right can be exercised only in specific circumstances provided for by the General Data Protection regulation, i.e.:
- when the accuracy of data is challenged by the concerned person (i.e. yourself), in this case processing is restricted for a period allowing the data processor (meaning GRUIA DUFAT Law Office) to check the accuracy of data;
- processing is illegal and the concerned person (i.e. yourself) opposes to data erasure and requires restriction of data use;
- the processor (i.e. GRUIA DUFAT Law Office) no longer needs the data to be processed but it is requested buy the concerned person (i.e. yourself) for setting, exercising or defending some legal claims;
- the concerned person (i.e. yourself) has raised objections to legitimate processing by the operator (in this case GRUIA DUFAUT Law Office) on grounds of checking whether the operator’s legitimate reasons override those of the concerned person (i.e. yourself).
5. The opposition right - You may oppose at any time to the processing of your data when such processing is based on your consent or on the processor’s legitimate interest.
6. The right to withdraw the consent at any time – You may withdraw your consent on the processing of your data when such processing is consent based. Withdrawal of your consent does not impair the legality of the processing before its being withdrawn.
7. The right to file a complaint with the competent supervisory authority – You are entitled to file a complaint before the competent authority on data protection, i.e. the National Supervisory Authority for Personal Data Processing, headquartered in Bucharest, Romania, 28-30 Gheorghe Magheru Bulevard.
You can also exercise any of these rights on personal data that GRUIA DUFAUT Law Office process by means of a simple request to the email address firstname.lastname@example.org or by fax at 00 40 21 305 57 57 or by mail at the following address: 28 Bulevard Hristo Botev, 3rd District, Bucharest. In this situation, it is very likely that we ask for a proof on your identity.
SECURITY OF THE PROCESSING
GRUIA DUFAUT Law Office has adopted technical and organizational measures for data processing, subject to update pursuant to the requirements of the Regulation, aimed at protecting personal data against any unauthorized access, misuse or disclosure, unauthorized alteration, destruction or accidental loss. All employees and collaborators of the Office as well as any third parties acting in the name and on behalf of GRUIA DUFAUT Law Office must comply with confidentiality requirements and those set under the Regulation.
PROCESSING IN THE CONTEXT OF THE PANDEMIC
The SARS-CoV-2 pandemic binds us to take some safety and health measures at the work place aimed to prevent and fight against the spread of the disease.
Therefore, during the state of alert, or for as long as the legal obligations apply, we collect data regarding:
- The existence of certain symptoms of the infection with SARS-CoV-2, data on the body temperature or other similar health data, both with respect to our lawyers / employees or to the persons coming to our headquarters; such data is processed to ensure compliance with the legal provisions on the prevention of the spread of the virus SARS-CoV-2, but also safety and health working conditions at the workplace.
- The travelling to some regions deemed of high epidemiological risk in the context of the SARS-CoV-2 pandemic or data regarding contact with persons infected with the SARS-CoV-2 virus; such data is processed for public interest reasons in the field of public health and are necessary for taking the measures aimed at preventing the spread of the virus SARS-CoV-2 and ensure health and safety at the workplace.
The length of the processing is limited to the duration state of alert or to as long as the legal obligations imposing the prevention measures against the spread of the virus SARS-CoV-2 are in force.
Data on the health status and the body temperature are neither stored nor registered on any kind of media, physical or digital. The data on the regions travelled to and the persons one came in contact with are stored physically, on the form filled in by the person visiting our headquarters, but also digitally, scanned, on our server, on a restricted access partition. Such data is deleted after one month and it is stored for contract tracing purposes only.
EXONERATION OF LIABILITY
GRUIA DUFAUT Law Office’s website may contain links towards other websites and/or web pages that are not property of the Office. The Office takes no liability with respect to the content of such websites and, therefore, can not be held accountable for the content, advertising, goods, services, software, information or other material made available on or by these webpages. GRUIA DUFAUT Law Office shall not be liable for the loss of personal data, by any negative effects on the visitor’s personal data or for any other moral and/or patrimonial damages that access to such sites may trigger.
UPDATE OF THE POLICY OF PERSONAL DATA PROTECTION AND PROCESSING
Please keep in mind that the content of this Policy may be subject to periodic amending, by update of the website of GRUIA DUFAUT Law Office.
Should you not agree with such amending, be advised not to use GRUIA DUFAUT Law Office’s website. Moreover, we strongly advise you to check this page for any update.
For any enquiry or concern on the use and processing of your personal data or for exercising any of your rights, please contact us at email@example.com.