Privacy policy

PROCESSING OF PERSONAL DATA

Last update: August 2020.

DBCR respects the right to privacy of persons who visit the Site and who contact us electronically. When you interact with us, you may provide us with information to help us identify you (e.g., name, email, telephone number).  Also, certain information that helps us identify you is necessary for the performance of the legal assistance contracts that we conclude with you or the issuance of invoices/receipts.    In addition, DBCR collects some information about its co-workers and employees, according to the law.  This information is known as “personal data”.  This Privacy Policy complies with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”).

LEGAL GROUND FOR PROCESSING

1. Processing based on consent [art. 6(1)(a) of the GDPR]

In the activity of DBCR, the data processing based on the consent of the data subjects may be different, depending on the specific activities carried out and the purposes.  For example, the data of natural person clients for promotional purposes (legal alerts/newsletters by email) is processed on the basis of free, specific, informed and unambiguous consent, legally obtained from clients.

1. Processing necessary for concluding and performing a contract [art. 6(1)(b) of the GDPR]

This type of processing takes place, for example, when the initiative to conclude the legal assistance contract belongs to a new a natural person client.  DBCR will also process the contact details of a new collaborating lawyer to conclude the collaboration contract.

1. Processing necessary for compliance with a legal obligation [art. 6(1)(c) of the GDPR]

The processing of personal data on the basis of the need to comply with a legal obligation requires the existence of a mandatory legal rule applicable to DBCR.  In this case, the processing is necessary to comply with the legal obligation.

1. On the basis of the legislation on the prevention and sanctioning of money laundering and the prevention and combating of terrorist financing (Law no. 656/2002 on the prevention and sanctioning of money laundering, and on the establishment of measures to prevent and combat terrorist financing), lawyers have certain obligations to implement specific know-your-client measures and to report suspicious transactions. The processing of personal data necessary to comply with these obligations is based on the legal obligation.
2. Lawyers are required to keep certain specific records of their work, such as the electronic register of documents drawn up by a lawyer. The processing of personal data carried out for this purpose has as a legal ground the compliance with a legal obligation.
3. Certain data processing performed by the Financial-Accounting Department of DBCR, such as withholding and payment of social security contributions for auxiliary staff, employee leave records, are based on the legal obligations regulated by the labour law.
4. Processing necessary for the performance of a task carried out in the public interest [art. 6(1)(e) of the GDPR]

According to art. 39 of Law no. 51/1995, in the exercise of their profession, lawyers are indispensable partners of justice.  Therefore, the professional activity of a lawyer is exercised to serve justice, thus serving a public interest.  In this case, the basis for the processing of personal data by DBCR is art. 6(1)(e) of the GDPR.  In order to carry out their professional activity to serve justice, lawyers process the personal data of the adverse parties or of third parties.  The basis of this processing is not the consent of the data subjects or the legal assistance contract concluded with the client.  The legal ground is the performance of a task that serves a public interest.

Personal data of minors

DBCR does not intentionally request or collect personal data from minors.  If DBCR finds that it has accidentally collected personal data from a minor, it will erase that data as soon as possible.  However, DBCR will be able to collect personal data from minors when there is the express consent of parents or legal representatives to this end.

Newsletters and emails

If you provide us with your email address (because you request to receive our notifications and news by voluntary subscription to the newsletter, or because you are a client of our company, you are in our database as a result of previous correspondence, your email address has been selected from a database to which you have subscribed or your address can be found on public sites), the contact details you provide may be used to send you newsletters.

We may also use your email address to send notifications regarding certain advertisement-related services (e.g., announcements about updates to our Privacy Policy, interruptions or changes to our online services or technical support policies or other related changes).

RIGHTS OF DATA SUBJECTS

In accordance with the GDPR, you have the following rights:

1. The right of access, i.e. to obtain confirmation from DBCR that personal data concerning you are being processed or not and, if so, access to such data and the following information:

• the purposes of processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom personal data have been or are to be disclosed;
• where possible, the period for which personal data are expected to be stored or, if that is not possible, the criteria used to determine that period;
• the existence of the right to request from DBCR the rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to processing;
• the existence of the right to lodge a complaint with the Supervisory Authority;
• if personal data are not collected directly from the data subject, any available information on their source.

1. Right to rectification, i.e. the right to obtain from DBCR, without undue delay, the rectification of inaccurate personal data concerning you;

1. Right to erasure (“right to be forgotten”), i.e. the right to obtain from DBCR the erasure of personal data concerning you, without undue delay, and the obligation of DBCR to erase personal data without undue delay where one of the following grounds applies:

• the personal data are no longer necessary for the purposes for which they were collected or processed;
• you withdraw your consent on which the processing is based according to art. 6(1)(a) or art. 9(2)(a) of the GDPR, and where there is no other legal ground for the processing;

• you object to the processing pursuant to art.21(1) of the GDPR and there are no overriding legitimate grounds for the processing or you object to the processing pursuant to art. 21(2);
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in EU or domestic law to which DBCR is subject.

1. Right to restriction of processing, where one of the following applies:

• you contest the accuracy of the data, for a period enabling DBCR to verify the accuracy of the data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• DBCR no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defend of legal claims;
• you have objected to processing pursuant to art. 21(1) of the GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.

1. Right to data portability, i.e. the right to receive the personal data concerning you, which you have provided to DBCR in a structured, commonly used and machine-readable format and the right to transmit those data to another controller, without hindrance from DBCR, where: the processing is based on consent pursuant to art. 6(1)(a) or art. 9(2)(a) of the GDPR or on a contract pursuant to art. 6(1)(b) of the GDPR and the processing is carried out by automated means;
2. Right not to be subject to a decision based solely on automated processing, including profiling, which would have legal effects on you or would similarly affect you to a significant extent.

For the effective exercise of these rights, you can submit a written, dated and signed request to the e-mail address office@dbcr.ro or to DBCR registered office situated in  Bucharest, 3rd District  6 Mesterul Manole Street, building  D11, entrance 1, 1st floor, flat No. 4, Romania.

You also have the right to go to court.

The user is responsible for all activities that occur while on the Site as a result of the voluntary provision of his name, email and telephone number.  DBCR cannot be held responsible for errors that occur due to the user’s negligence regarding the security and privacy of his name, email and telephone number.  The user’s personal data may be used by DBCR and its co-workers only for the stated purpose of this Site.  However, personal data may be transmitted to the authorities entitled to verify commercial transactions or to other authorities entitled to carry out any justified verifications under the law, if this is required in accordance with the regulations in force.

Technologies used

The Site does not use “cookies” technologies and modules, server log files (does not monitor IP addresses or activity on your servers) and does not automatically place information on your computer (does not place “Pixel Tags”, “transparent GIFs” or other such technologies).

Transfer of personal data

DBCR will never disclose your personal data to a company or third party organisation that intends to use it for direct marketing purposes, unless you have given your express and prior consent to this end.

For strictly technical reasons, your data may be disclosed to external co-workers working in IT&C (e.g., a software solution provider for hosting the Site or for the delivery of newsletters from DBCR).  In these cases we will make sure that the mentioned partners observe the security and privacy of your information.

We may disclose your personal information if required to do so by law, or if, in our opinion, based on good faith, such action is reasonably necessary to comply with our legal procedures, to give effect to any requests and claims, or to protect the safety or rights of DBCR, its clients, or the general public.

Data security

DBCR takes all necessary organisational and technical measures to protect the privacy and security of your personal information collected from the Site, but also from other sources, including in the case of special categories of personal data and personal information collected from minors.  These efforts include, without limitation:

• storing your personal information in secure, encrypted operating environments which are not publicly available and which are accessible only by authorised DBCR employees or contractors;
• using “Microsoft OneDrive” cloud technologies provided by a reputable company which fully meets the compliance and security requirements required by the GDPR;
• verifying the identity of registered users of the Site before being able to access their personal information.

How to contact us?

Should you have any questions, complaints or comments regarding this privacy policy or our information collection practices, please send us an e-mail to office@dbcr.ro or post a mail to our registered office SCP BURUIAN, CARACAȘ ȘI ASOCIAȚII [Professional Partnership BURUIAN, CARACAS AND PARTNERS] situated in Bucharest, 3rd District, 6 Mesterul Manole Street, building  D11, entrance 1, 1st floor, flat No. 4, Romania.