Privacy Statement on personal data processing
Last update: September 2018
Grigorescu, Ştefănică şi Asociaţii SPARL (“bpv Grigorescu Stefanica” or “bpvGS“) is a limited liability law firm registered with the Bucharest Bar Association.
This Privacy Statement concerns the personal data processing carried out by bpv GS. The Privacy Statement is applicable to all personal data processing carried out by us, as well as to all interactions with our website hosted on the domains bpv-grigorescu.com, bpv-grigorescu.ro, or bpv-grigorescu.eu.
At bpvGS, we go to considerable lengths to provide our clients and partners with legal assistance and representation of the highest quality for their businesses.
In addition to our services, in order to further our current business relationships and develop future relationships, we support and contribute to a better understanding of the legal framework and we make relentless efforts to inform you with regard to legal, economic or industry matters relevant to you or your business. To that end, we also organise events for our clients, contacts and partners, and we produce alerts, notifications, newsletters, reviews, and other information materials, both in relation to matters in our areas of expertise and to our professional activity as a firm or as members of the firm (jointly referred to as the “Information Service”).
The collection of your personal data is strictly limited to what is necessary for providing you with an experience of the highest quality with regard to our services and to the use of our website.
Personal data processed by us may vary depending on the relationship we have established with you and may include:
- Basic data for identification purposes, such as surname, name, academic title, title or position, work-place, and relationship to another person with whom we have an established connection (e.g., employee, another contact or client, or person who facilitated our connection with you);
- Contact data, such as the physical work address or, as applicable, personal address, e-mail address, and/or phone number;
- Bank account and other financial information that allows us to perform contractual relationships of any kind, should such be the case;
- Data you make available to us or which we collect as part of the know-your-customer process and of the observance of legal obligations on the prevention of money laundering;
- Data you make available to us during registration, update of data or when unsubscribing from the Information Service, as well as during the registration and the attendance of events organised or supported by us, including, if available, data on special requirements or needs;
- Data received or collected during your visits to one of our offices (including video records of you accessing the office);
- Technical data (including the IP address) collected by cookies, such as information on your visits on our website or in applications developed by us or by accessing materials and communications that we may send you electronically;
- Any data made available to us by you during our interactions.
Furthermore, if you wish to join our team, we will process the personal data necessary for recruitment, such as your full name, e-mail address, phone number and mail address, together with any other data you make available to us via the application documents, which you provide to us whether by e-mail, through physical handing-over at our office, or via postal or courier services. Please see the dedicated section below “Information on the recruitment process”, for more details on personal data processing for recruitment purposes.
We only collect the personal data that you provide voluntarily (in physical or electronic format), as well as information and data available from public sources:
- During the client-attorney interactions, on the basis of an engagement letter or during preliminary discussions, as part of the negotiation and preparation of such an agreement;
- By means of our website, when subscribing to the Information Service or when accessing other available information based on registration;
- When you contact us via e-mail, phone or mail correspondence, if you are interested in our services or in becoming employed or contracted by our company or express desire to cooperate with us, and
- Upon meeting at business events and other functions (e.g., by the exchange of business cards).
You are entitled to know the purpose for which we process your personal data, and we will inform you prior to processing your personal data for any purposes other than that for which you originally disclosed your personal data to us.
1. Performance of contractual relationships with our clients
Based on the agreement concluded with you, as a client of bpvGS, we will process all personal data made available by you to us, in addition to any other data necessary for practicing our profession and providing you with our services, in accordance with the contractual provisions, with the applicable law, and with the regulations governing the legal profession (Law no. 51/1995 for the organisation and practice of the legal profession and the Statute of the Legal Profession approved by the National Bar Association of Romania). The same will apply to all personal data collected during the period leading up to your entering into an agreement with our firm, whether our discussions and negotiations will have led to the conclusion of an agreement or not. Please note that your personal data and information remains protected by client-attorney privilege even if you have not entered into an agreement with our firm.
2. Professional communications
When you subscribe to the Information Service directly, by means of either the website or other form of direct request, or you have registered for or shown up to attend an event organised or supported by our firm, we will request your consent for the processing of personal data in order to be able to (i) supply those services for which you have requested the subscription or (ii) ensure your admission to and participation in the event.
In the event you are our client or have contacted us for professional purposes, including having expressed an interest in, registered for or attended an event organised or supported by our firm, we will process your personal data based on legitimate interest in order to send you communications specific to the Information Service which is of interest to you and your business, including invitations to our events.
We collect information necessary for the recruitment process, in order to be able to evaluate whether you are suited to a position at bpvGS and for the purposes given below in the dedicated section, “Information on the recruitment process”. The processing of personal data during the recruitment process is legally based on the performance of the agreement to be concluded with you, this processing representing the pre-contractual phase.
Furthermore, when new career opportunities become available, we may contact you should we consider you fit for the position, based on our legitimate interest in continuing the recruitment process and, as the case may be, establishing a contractual relationship. We will keep records of all persons who have participated in the evaluation procedure and of the reasons for which they either did not receive an offer or rejected an offer made by us, based on our legitimate interest, for the purpose of developing and improving our employment offer and our recruitment process.
You may apply for a position at bpvGS via e-mail, by physical handing-in of your application at our offices, or via postal or courier services.
In order to review your application, we require a CV and a letter of application in the format and with the content of your choice, which must include your full name, e-mail address and phone number. This personal data, together with information on your academic achievements and qualifications, extra-curricular activities, and previous work experience are deemed necessary for a proper assessment of your application.
We may use your personal data related to the recruitment process for any or all of the following purposes:
- Evaluate whether you are suited to a position at bpvGS,
- Contact you with regard to your application,
- Manage the recruitment process,
- Contact you with regard to subsequently vacant positions which we deem suitable for you
- Maintain records of prior recruitment processes in our company in which you participated and of the reasons why you were not presented with an offer or why our offer was rejected.
If you have chosen to receive communications from the Information Service or if you receive such communications based on our legitimate interest as described in 6.2 above, we will store your personal data in order to provide this service for two years from your enrollment in the Information Service. Following the expiry of this period, we will again ask for your consent in order for you to keep benefiting from the Information Service.
If at any point in time you decide you do not wish to benefit from the Information Service and you withdraw your consent, we will respect your decision and we will stop processing your personal data for this purpose.
Personal data collected in the recruitment process is stored and used for the purpose of keeping records on past recruitment for a period of 10 years from the date when you last applied at bpvGS.
Your personal data will be deleted when it is no longer necessary for the purposes for which it has been collected, or when you withdraw your consent (if the processing of your data is based on consent), provided that we are not legally required or otherwise permitted to continue to hold such data. We may retain your personal data for an additional period to the extent that deletion would require us to overwrite our automated disaster recovery backup systems.
As a rule, we do not share with or transfer your personal data to third parties. However, if a disclosure or transfer is required or if we are obliged by law to do so, we will inform you in the shortest possible time with regard to such transfer, unless the applicable law, including the rules governing professional secrecy, prevents us from sending such notification.
In the event your personal data is disclosed to third parties, it shall be done so in accordance with the applicable laws, and all necessary measures reasonably available to us will be taken to ensure its integrity and protection.
For the processing of personal data, we may use data processors, e.g. providers of IT solutions necessary for business management (including financial accounting solutions), providers of contact management solutions, or conference organisers.
Agreements for the processing of personal data will be concluded with all data processors, which will include adequate clauses to ensure that data processors undertake obligations to process personal data (including deletion, where appropriate) in full agreement with applicable laws and which provide an adequate level of protection for your personal data.
Personal data is secured against threats and we make sure it is protected by the appropriate IT infrastructure and security measures. Moreover, we have implemented internal measures that allow us to discover, notify, and document personal data breaches in the shortest possible time.
Should any breach of personal data that poses a risk for your rights and freedoms be discovered, we shall immediately take steps to notify the National Supervisory Authority for Personal Data Processing. You will be informed of your personal data breach if it leads to a high risk for your rights and freedoms.
You have the following rights regarding the processing of your personal data:
1.The right to access your personal data.
2.The right to rectification or erasure of your personal data.
3.The right to restriction of processing of your personal data which right is available to you when:
i) you contest the accuracy of your personal data,
ii) the processing of your personal data is unlawful,
iii) we no longer need your personal data for the purposes of processing purposes, but it is required by you for the establishment, exercise or defense of legal claims, or
iv) you have objected to processing of your personal data, pending the verification of our legitimate grounds for such processing.
4.The right to object to the processing of your personal data.
5.The right to data portability.
Should you have any questions related to the processing of your personal data or if you would like to submit a request, or to exercise any of the rights on the processing of personal data, please contact us at:
E-mail address: firstname.lastname@example.org
Head office: 33 Dionisie Lupu Street, District 2, Bucharest, Romania.
We will review each request and notify you with regard to any actions undertaken in the shortest possible time, but no later than one month from the registration of your request. Should we require more information from you or experience difficulties in the settlement of your request, we will notify you without delay with regard to the fact that we need additional time to perform a proper review of your request.
Should you consider that we have failed to settle all your requests or are dissatisfied with our responses, you may file a petition with the National Supervisory Authority for Personal Data Processing. You may also refer to the courts of law.
In the event we decide to amend this Privacy Statement, we will publish the new version on our website, which will supersede the current version.
Thank you for trusting us with your personal data and for finding the necessary time to read through this Privacy Statement. Please feel free to contact us if you have any questions in relation to our processing of your personal data.