Privacy and Data Protection Policy (GDPR)

Who the data controller is

The controller of your personal data is:

For any question about your data, you can write to us at [email protected] with the subject line “Data protection”.

The office has not appointed a data protection officer, as its activity does not fall within the cases where an appointment is mandatory under Article 37 GDPR. Recital 91 of the Regulation states that the processing of client data by an individual lawyer should not, in principle, be considered large-scale processing.

What data we process

a) When you contact us through the website form

Your full name, phone number and the short description of your situation that you submit.

b) When you contact us by phone, email or messaging apps

Your contact details (phone number, email address), the content of the communication and any documents you choose to send.

c) When you become a client of the office

Identification and contact details, the data needed to conclude and perform the legal services agreement and for invoicing, as well as the data contained in the case documents. Depending on the nature of the case, these may include special categories of data (for example, health data in personal injury claims) or data relating to criminal offenses in criminal cases.

d) Data about other people

In connection with a case, we may process data of other people (opposing parties, witnesses, heirs, representatives), strictly to the extent necessary to carry out the mandate. If you send us data about other people, please send only what is relevant.

e) Technical data when you visit the website

When you access the website, the hosting provider automatically processes technical data such as your IP address, browser type, date and time of access and the pages requested, in order to display the website and keep it secure. Details about cookies are available in the Cookie Policy.

Recommendation: through the website form, send only a short description, without sensitive details (medical data, information about criminal offenses, personal identification numbers). We will discuss the details during the consultation.

Purposes and legal bases for processing

We do not use your data for marketing and we do not sell it. We do not make decisions based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.

Professional secrecy

Under Article 11 of Romanian Law No. 51/1995 on the organization and practice of the legal profession, an attorney must keep professional secrecy regarding every aspect of the case entrusted to them, except where expressly provided by law. The information you share with us is treated as confidential, including when we do not end up working together.

Who your data may be shared with

Your data is accessed by the principal attorney and, where applicable, by the office's collaborators, who are bound by confidentiality obligations. It may be disclosed, strictly to the extent necessary, to:

• courts, prosecutors' offices, criminal investigation bodies, court bailiffs, notaries public, experts, translators and other authorities or institutions, in connection with the case entrusted to us;
• service providers that support our activity: website hosting, email, IT and storage services, accounting services. They act as processors under a contract, in accordance with Article 28 GDPR;
• public authorities, where the law requires us to do so.

Providers currently used: website hosting and security — Cloudflare, Inc. (Cloudflare Pages service); email — [email service provider].

Transfers outside the European Economic Area

Some service providers (for example, hosting, security or email providers) may process data outside the European Economic Area. In such cases, the transfer takes place only if there is an adequacy decision of the European Commission (Article 45 GDPR) or appropriate safeguards, such as the standard contractual clauses adopted by the Commission (Article 46 GDPR). On request, we can provide information about the applicable safeguards.

How long we keep your data

• Requests that do not result in an agreement: no longer than 6 months from the last communication, except for the minimum data needed to keep a conflict-of-interest record.
• Client files: for the duration of the mandate and, after it ends, for the period required by the rules of the legal profession and at least for the general 3-year limitation period under Article 2517 of the Romanian Civil Code, to protect the parties' rights.
• Accounting documents: 10 years from the end of the financial year, under Article 25 of Romanian Accounting Law No. 82/1991.
• Technical access data: for the period set by the hosting provider for security purposes, which is usually short.

When these periods expire, the data is deleted or anonymized.

Your rights

Under the GDPR, you have the following rights:

• the right of access to your data (Art. 15);
• the right to rectification of inaccurate data (Art. 16);
• the right to erasure (Art. 17);
• the right to restriction of processing (Art. 18);
• the right to data portability (Art. 20);
• the right to object to processing based on legitimate interest (Art. 21);
• the right to withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing (Art. 7(3));
• the right to lodge a complaint with the supervisory authority (Art. 77) and the right to an effective judicial remedy (Art. 79).

To exercise your rights, write to us at [email protected]. We respond without undue delay and in any event within one month. This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests (Art. 12(3) GDPR). To protect your data, we may ask you for additional identification information.

Some rights may be restricted where exercising them would breach professional secrecy, other legal obligations of the attorney or the rights of other people, or would affect the defense of a legal claim, within the limits permitted by Article 23 GDPR and national law.

Providing your data

Providing your data through the contact form is voluntary. However, without your name and phone number we cannot contact you to schedule the consultation. The data required by law is necessary to conclude the legal services agreement and for invoicing.

Data security

We apply appropriate technical and organizational measures in accordance with Article 32 GDPR: an encrypted connection (HTTPS) for the website, restricted access to case files and work accounts, passwords and secure authentication, storage of paper documents in secure premises and confidentiality obligations for collaborators.

Communication by email or messaging apps is not entirely risk-free. For particularly sensitive documents, we can suggest an appropriate way to send them.

Minors

This website is not directed at people under 16. In cases involving minors, their data is processed only in connection with the mandate received from the legal representative or as provided by law.

Changes to this policy

We may update this policy when the law, the office's activity or the technical services used change. The version in force is always the one published on this page. Last updated: October 12, 2026.