Popescu & Asociații, Attorneys at Law, a limited liability partnership headquartered in Bucharest, 119 Miercani St., 1st District, Telephone: 0215897830, E-mail: office@popescu-asociatii.ro, (herein after referred to as the “Firm”, the “Undersigned” or “we/us”), as data controller, hereby undertakes to protect and to observe the confidentiality of your personal data.

The Firm treats with particular care the protection of your personal data. In that regard, whenever using your personal data, we abide by all regulations governing personal data protection and safeguarding, including, but not limited to, the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (herein after, the “GDPR”).

This information concerns any processing undertaken by the Firm, in connection with the personal data of data subjects.

Please find herein below a list of your personal data which we will process, the purposes for which your data are processed, the grounds for processing, the recipients of personal data, the storage period and the manner in which you may exercise your rights, in observance of the GDPR.

The Firm processes your data, being, in particular, the following: (i) data concerning your person (name, surname, date of birth, citizenship, personal identification number, series and number of identification card/passport, position held, etc.); (ii) contact data (telephone number, e-mail address, domicile/residing address, etc.); (iii) billing data (bank account); (iv) other data relevant for the contractual relationship; (vi) data relating to criminal sentences and criminal offences in the case of clients for which we undertake legal work in criminal matters; (vii) the signature.

The Firm processes your personal data for the following purposes: (i) to conclude, to execute, to amend or to terminate the engagement letter, including to undertake all activities performed by us for your interest, in reliance upon the agreement entered into between you and the Firm; (ii) to fill in and to submit the statements stipulated in the applicable laws; (iii) to fulfill the tax obligations relating to the payment of fees; (iv) to prepare the necessary financial and accounting documents, under the law; (v) to handle and to manage the IT and information processing system, and to maintain the IT applications and systems used by the Firm; (vi) for archiving purposes, as required under the law; (vii) to receive and/or to deliver correspondence; (viii) to protect the rights and lawful interests in reliance upon the power of attorney entrusted to us; (ix) to fulfill the obligations set out by law in charge of lawyers; (x) to inform and to communicate with you; (xi) to observe the provisions of GDPR and of the national law governing the protection of personal data.

The legal grounds underlying the processing of personal data consists, as the case may be, in: (i) Article 6 paragraph (1) letter a) of GDPR – in reliance upon your consent to the processing of your personal data for one or more specific purposes, as the case may be; (ii) Article 6 paragraph (1) letter b) of GDPR – processing is necessary for the performance of the engagement letter or in order to take steps at your request, prior to entering into the engagement letter; (iii) Article 6 paragraph (1) letter c) of GDPR – processing is necessary for compliance with a legal obligation, incumbent upon the Firm (mainly, obligations laid down in the following normative acts – Tax and Accounting Law, Law 51/1995 for the organization and undertaking of the lawyer profession, By-Laws of the Lawyer Profession, etc., such as the obligation to keep certain records specific for the lawyers’ work). Another example consists of the obligations set out in the applicable regulations in force on the prevention of money laundering; (iv) Article 6 paragraph (1) letter e) of GDPR – processing is necessary for the performance of a task carried out in the public interest, in consideration of the provisions of Article 39 of Law no. 51/1995 laying down the fact that, in exercising this profession, lawyers are indispensable partners of justice; (v) Article 6 paragraph (1) letter f) of GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Firm. The legitimate interest particularly consists of organizing the Firm’s business.

Insofar as special categories of personal data are required, they shall be processed, as the case may be, in reliance upon the following: (i) Article 9 paragraph (2) letter a) of GDPR – in reliance upon your consent to the processing of your personal data for one or more specific purposes; (ii) Article 9 paragraph (2) letter f) of GDPR – processing is necessary for the establishment, exercise or defence of a right in court.

As regards the processing of data concerning criminal sentences and criminal offences, the condition laid down in the GDPR, more specifically that processing be authorized by the domestic law, it is fulfilled, considering that the Firm’s authorization to process such data, in the course of its professional activity, derives from the role, duties and tasks incumbent upon lawyers in criminal proceedings, as stipulated in the criminal laws and the laws governing the lawyer profession.

The Firm processes your personal data for the purpose of assessing your application.

The legal ground underlying the processing of personal data consists of Article 6 paragraph (1) letter b) of GDPR – processing is necessary for the performance of the agreement concluded with you or in order to take steps at your request, prior to entering into the agreement.

The Firm processes your data, being, in particular, the following: (i) data concerning your person (name, surname, role as representative); (ii) contact data (telephone number, e-mail address); (iii) data on work experience; (iv) data concerning your education and training, (v) identification data; (vi) signature.

The Firm processes your personal data when you request us to take certain steps prior to entering into an agreement with you, and also for the purpose of implementing the agreement with you.

The legal ground underlying the processing of personal data consists of Article 6 paragraph (1) letter b) and letter c) of GDPR – processing is necessary for the performance of the agreement concluded with you or in order to take steps at your request, prior to entering into the agreement, processing is necessary for compliance with a legal obligation to which the controller is subject.

The Firm processes your personal data following your accessing of the Firm’s website, in particular the following: IP, country of access, date and time of latest visit, number of pages accessed, without the possibility of identification by specific IP.

The Firm processes your personal data with a view to improving the information content of our website.

The legal ground underlying the processing of personal data consists of Article 6 paragraph (1) letter f) of GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Firm, in particular our legitimate interest to ensure the efficient operation of our website www.popescu-asociatii.ro.

For the purpose of fulfilling such goals, the Firm uses cookie type modules. For more details, please consult our Cookie Policy.

The Firm has taken suitable technical and organizational measures in order to ensure the protection of your personal data.

The Firm uses updated data storage and security means to keep your data safe, both in hard copy and soft copy, with a view to protecting your personal information against unauthorized access, abusive use or against unauthorized disclosure, alteration and illegal destruction or accidental loss.

Nevertheless, the conveyance of information over the Internet is never fully secured. Although we take appropriate and commensurate steps to mitigate such risks, we cannot guarantee the security of information delivered to our online services.

Your personal data will be intended to be used by our Firm, as data controller, and are shared with the following recipients, in well-justified cases: (i) public authorities and institutions; (ii) other entities, such as: The National Trade Registry Office, the National Cadaster and Land Registration Agency, cadaster and land registration offices, courts of law, court enforcers, public notaries, banks, etc.; (iii) legal profession entities: The National Union of Romanian Bars, Bars; (iv) providers/suppliers of services, such as: accounting, tax, legal, courier/postal services, IT (Microsoft Corp.); (v) associates and partners of the Firm: substitute lawyers, experts, etc.

Data may only be disclosed to third parties in reliance upon the legal grounds for the processing of categories of recipients referred to herein above.

Your personal data shall be stored for as long as the purpose for their processing persists.

Your personal data shall be stored throughout the term of the engagement letter/ agreement concluded with you. It is further possible for the Firm to store your personal data after the termination of the agreement, with a view to complying with the legal obligations incumbent upon us.

The Firm is also held under the obligation to comply with the terms for storing / archiving/ keeping your personal data, in accordance with the applicable legal provisions, even after the termination of the contractual relationship. In that regard, we rely on the applicable laws in effect, laying down the obligation to store data collected for the purpose of money laundering prevention for a period of 5 years, but also to store personal data contained in financial and accounting documents for a period of 5, and 10 years, respectively, depending on the nature of the document.

If the personal data are processed in reliance upon the consent expressed by you, the processing shall take place until such consent is withdrawn, save where there are legitimate reasons for our continued processing of your data, such as a legal obligation in that respect.

In accordance with the relevant legal provisions, you benefit from a right to be informed, a right of data access, right to data rectification, right to erasure of data, right to restriction of data processing, right to data portability, right to object and the right not to be subject to a decision based solely on automated processing, including profiling, the right to lodge a complaint with a supervisory authority.

If the processing relies on the provisions of GDPR, Article 6 paragraph (1) letter a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” or in reliance upon the provisions of Article 9 paragraph (2) letter a) “the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or domestic law provide that the prohibition referred to in paragraph (1) may not be lifted by the data subject consent”, you are entitled to withdraw your consent at any time, without impairing the legality of processing performed in reliance upon such consent, before its withdrawal. Thus, you may withdraw your consent at any time.

Mention is to be made that any intervention on the data you have provided to us may result in precluding the performance of the engagement letter/agreement concluded with the Firm. In that case, the Firm is exonerated from liability.

In order to exercise any rights, please contact the Firm at the E-mail address: office@popescu-asociatii.ro or in writing, at the address in Bucharest, no. 75-77 Buzești St., 13th floor, 1 District.

Should you believe that your personal data have been processed in breach of the legal provisions, you are entitled to file a complaint with the competent National Supervisory Authority for the Processing of Personal Data.