CONFIDENTIALITY POLICY

The operator that processes personal data

Olteanu & Partners Law Office, with head office in Bucharest, 6 Sapienței street, district 5, Bucharest – Romania, registered and authorized with the Bucharest Bar – Romanian National Bars’ Association, fiscal code RO15405835, telephone number +40213186740, e-mail address: office@olteanu-lawyers.ro

Definitions

CONSENT = means any manifestation of the free, specific, informed and unambiguous will of the data subject by which he or she consents, by an unequivocal statement or action, to the processing of his / her personal data;

PERSONAL DATA = means any information concerning an identified or identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifying element, such as a name, an identification number, location data, an online identifier, or one or more specific elements, related to one’s physical, physiological, genetic, mental, economic, cultural or social identity;

GDPR REGULATION = means the EU Regulation 2016/679 from April 27th 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which cancelled Directive 95/46 / EC (General Data Protection Regulation);

DATA PROCESSING = means any operation or set of operations performed on personal data or personal data sets, with or without the use of automated means, such as the collection, registration, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or otherwise made available, alignment or combination, restriction, deletion or destruction;

DATA PROCESSING SUBJECT = means any identified or identifiable natural person whose data is processed by us as an operator, such as potential customers or visitors of the website;

NEWSLETTER = means a periodic bulletin communicated to users who have given their consent to receive such communications. It includes news, information about the activities, projects and latest information of our company;

SPAM = = means any unsolicited commercial communication prohibited by the law.

What is your capacity under this confidentiality policy?

Any individual who uses the site, our social media channels is considered a data subject.

What kind of data do we process?

Depending on the features you want to benefit from, we will need to process certain personal data, which will generally be the following:

• Identification data (name, surname, e-mail address, telephone number). In case you provide us your telephone number, we may use this number to contact you via SMS, to confirm or modify meetings / appointments for legal consultancy you have set up with us.
• Invoicing data (name, surname, address, e-mail address, value of the services provided, payment method, services request, date of service request).
• Data for direct marketing: surname, name, e-mail address, website navigation history, your preferences on newsletter and promotional materials communication.
• Data related to connection, geo-localization, and geo-navigation (in case you interact with us via mobile phone, for example).
• Information and content provided by you (questions, requests);
• Information provided by you through social networks (name / alias used on the social network, profile picture, likes, location and any other information described on the social network when you use this network to contact us).

We may obtain your data from several sources, like the data provided through the website via contact form, through the social media pages you access, but also through Google Analytics, manner in which we are able to see how you interact with our website, in order to make your experience on our website better, but also to have a statistics of the users interested in our services or articles.

The purpose for which we process your personal data.

Based on the manner in which you interact with our website, we will process your personal data for the following purposes:

• In order to communicate with you,based on the type of service you have requested, to provide consultancy specific to your request
• To manage the collaboration relation for records keeping
• To comply with our legal obligations for records keeping
• To prevent or repel any cyber-attack or threat against our systems
• For marketing purposes, in case you registered to receive our newsletter, we will use your data to provide the newsletter system and also to make a profile analysis to determine what your preferences are based on your navigation history on our website and to establish what kind of free materials suit you, based on your interests and search history.
• To communicate with you via social networks
• To operate, evaluate and improve our services and your experience in relation to the website and social media channels (including developing new areas of services requested by you, improving the services we already offer, manage the communication relation with the users, analyze our services, perform data and audit analysis)
• To comply with the legal requirements.

What is the legal ground according to which we process your personal data?

We will process your personal data based on the following legal grounds:

• Based on your consent (in accordance with art. 6 paragraph (1) letter (a) from GDPR Regulation) – when you agree to receive relevant and customized content from us and also to receive our newsletter.
• For the conclusion and execution of an agreement (in accordance with art. 6 paragraph (1) letter (b) from the GDPR Regulation) – for example, in the pre-contractual phase, at your request, we might need to process certain personal data in order to conclude the agreement.
• To fulfill a task that serves a public interest (in accordance with art. 6 paragraph (1) letter (e) from the GDPR Regulation. In accordance with art. 39 from Law 51/1995, when exercising their profession, lawyers are indispensable partners of justice. Therefore, a lawyer’s professional activity is carried out for the purpose of justice, serving a public interest.
• For a legitimate interest (Art. 6 paragraph (1) letter (f) from the GDPR Regulation) – including when we have a legitimate interest in carrying out the marketing activities, research activities, data analysis, internal management, processing and responding to legal requests, carrying out our activity in compliance with the legislation in force.

How long do we keep your data?

Your data will be kept only for the period necessary to respond to your request, if we have a mandate from you to assist or represent you before the authorities or courts, we will keep the data until the final settlement of the proceedings, and then we will delete the data or archive them, depending on the provisions of the applicable law.

Data for invoicing purposes is deleted after 10 years, in accordance with applicable regulations.

As for the data processed for marketing purposes, it will be deleted once you express your option to unsubscribe.

After these retention periods expire and if there is no other legal basis for which we must keep / process your data, they will be deleted from our systems.

Data transfers to third parties

During our activity, we may transfer your data to:

• Lawyers, consultants, accountants, specialists involved in responding to your request, if they are unable to fulfill their mandate or cannot provide you with advice without this data;
• Courts, public authorities, institutions, bailiffs, notaries public, if this is necessary in order to establish, exercise or defend a right in court or to resolve a dispute in an alternative manner;
• Foreign lawyers or consultants, from outside Romania, when the settlement of your request includes the consultancy of other specialists from other States;

We will only transmit your data when we receive your instruction or permission or when the law or certain institutions or authorities require us to do so.

We may transfer your data outside Romania. If the recipients are established outside the European Economic Area, we will check for decisions, laws that recognize that these countries offer an adequate level of data protection.

Processing your data on social networks

We may have access to your profile and public profile data, as well as to the comments posted by you, if you choose to like, share or leave us comments on social media.

We will also have access to the content of the private messages you send us, in case you choose to write to us in private on social media pages.

We have access to general statistics about your interaction with our social media pages.

All this data is kept by us for the period necessary to promote our team and services, until the closing of the pages on social networks.

The purpose of processing this data is to promote our team, our services, to respond to the messages we receive through social media, to analyze statistics and your interaction with our social media pages, but also to personalize advertising campaigns.

The legal basis for this data processing is our legitimate interest in promoting our team and services, in maintaining interaction with users, in responding to messages received through these communication channels and to measure the results obtained from our social network pages.

Social media networks create certain user profiles using your data, and in terms of data transfer, some of the data on social media transmitted by you may reach outside the European Economic Area, in accordance with the Google Terms and Conditions, Facebook and / or LinkedIn.

Your rights regarding your personal data

In accordance with the GDPR Regulation you have the following rights, in respect to your personal data that we process:

• The right to be informed about the processing of your data.
• The right to access your data – You can request access to your personal data that we process.
• The right to rectify inaccurate or incomplete data – You can ask us to rectify your personal data that we already have.
• The right of deletion (“right to be forgotten”) – You may ask us to delete your personal data if we have no other legal basis for processing it.
• Right to restrict processing – You may ask us to suspend the processing of your personal data for a period of time.
• The right to transmit the data we have about you to another operator – You can ask us to transmit your personal data to another operator.
• Right to object to data processing – If we have consent to the processing of your data for any purpose, you have the right to withdraw it at any time.
• The right not to be subject to a decision based solely on automatic processing, including the creation of profiles with legal or similar significant effects on you.
• The right to go to court to defend your rights and interests.
• The right to register a complaint with a Supervisory Authority.

The National Authority for Supervising Personal Data Processing
Address: 28-30 G-ral. Gheorghe Magheru Bd., district 1, zip code 010336, Bucharest, Romania,
tel. +40.318.059.211; +40.318.059.212, fax: +40.318.059.220,
anspdcp@dataprotection.ro, www.dataprotection.ro

In case you wish to exercise any of these rights, please send a request in this respect to the e-mail address:office@olteanu-lawyers.ro