ZRP’S PERSONAL DATA PROCESSING POLICY
The requirements for the processing of personal data are observed by Zamfirescu Racoți Vasile & Partners Attorneys at Law and ZRP TAX SRL (hereinafter referred to as “ZRP”) in accordance with the security provisions on processing of personal data indicated in Regulation 679/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”).
Both at the moment when the processing means are established and during the processing itself, ZRP applies proper technical and organizational measures to guarantee and prove that processing is made by compliance with the applicable legal provisions.
ZRP has taken all necessary actions to ensure that, implicitly, only personal data strictly necessary for each specific purpose of the processing are processed.
Personal data means any information regarding an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Our personal data processing policy describes the modality in which we will collect and process our clients’, business partners’, prospective clients’, prospective employees’, prospective collaborators’ personal data and applies to all personal data collected on our website, www.zrp.ro, as well as to all personal data we collect by e-mail or by any other means of communication by which such data are going to be processed.
We can also collect information regarding your preferences by using the above-mentioned website, when you request information from us or when we are retained or of other nature or as a result of the relation you have with us or with one or more of our clients.
2. GDPR PRINCIPLES
Whenever we process personal data, we will consider the following principles:
- LAWFULNESS, FAIRNESS AND TRANSPARENCY – your personal data will be processed “lawfully, fairly and in a transparent manner”;
- PURPOSE LIMITATION – your data will be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
- DATA MINIMIZATION – any collection of personal data will be very well analyzed before the actual request for such data we are going to process, which shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- ACCURACY – every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay
- STORAGE LIMITATION – personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
- INTEGRITY AND CONFIDENTIALITY – personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.
ZRP ensures the observance of the rights granted to the data subjects under the GDPR, among which:
- RIGHT OF ACCESS – allows you to obtain the relevant details for the personal data processing;
- RIGHT TO RECTIFICATION – allows you to rectify your personal data, if inaccurately processed;
- RIGHT TO BE FORGOTTEN – allows you the erasure of your personal data in certain cases (for example if the data are no longer necessary for the purpose for which they have been collected);
- RIGHT TO RESTRICTION OF PROCESSING – allows you to obtain the restriction of the processing of your personal data in certain cases (for example, when you challenge the accuracy of your personal data, for a period allowing us to verify such accuracy);
- RIGHT TO OBJECT – allows you to object to the further processing of your personal data in the conditions and within the limits of the law;
- RIGHT TO DATA PORTABILITY – allows you to receive the personal data referring to you that you have provided to us, in a structured, commonly used and machine-readable format or to transmit those data to another controller.
4.1 PURPOSE AND PROCESSING OF PERSONAL DATA BASED ON THE OBTAINED CONSENT
ZRP will process your data lawfully, fairly and in a transparent manner, the purposes for which we will use these data being well-determined, more exactly for the preparation and offering of the services that you request from us. In addition, your personal data will be used in order to prepare the necessary materials in any dispute and arbitration proceedings.
In this case we rely on the legitimate interest in the provision of our services depending on our area of expertise, be it (legal or tax) advisory services or litigation, as well as in the management of the relation with our clients, collaborators, business partners, employees, prospective employees etc.
Your data will be processed, inter alia, for the communication by e-mail, correspondence, by phone, by video transmission or by any other means of communication by which the answers to your requests, the materials prepared during the disputes, negotiations, general assistance, as well as any other answer or request within the collaboration or possible collaboration with ZRP will be transmitted. In this case personal data processing will rely on the legitimate interest for the rendering of our services depending on the area of expertise or contractual relation.
We can process your personal data also in the context of provision of the services based on legal obligations or of the obligations imposed by the legal provisions governing the legal profession (the form that must be filled in for “know your customer”), in this case the legal obligation represents the ground for the personal data processing.
We can also use your contact data for providing you with our newsletters on the legislative novelties, case law and articles published by us, participation in conferences, only if you have given your express consent by filling in the “Consent Form”. In this case, the purpose of the processing of your personal data will be the marketing one.
Your consent may be withdrawn at any moment, by checking off the option “I no longer want to receive this news” when you receive such e-mail or to transmit an e-mail to the address firstname.lastname@example.org
In all cases, the data are provided directly by you as a result of our request and of the expression of your consent. The categories of processed data in this context are, in general, the last name, first name, position, e-mail, phone, fax, address, identification data, as well as other personal data provided to ZRP, usually by you, in order to achieve the above-mentioned purposes.
ZRP requests you to supply all categories of personal data, exclusively for the above-mentioned purposes, for the performance of our current business and for the provision of our services.
4.2 DISCLOSURE OF PERSONAL DATA
As a rule, your personal data shall not be disclosed to third parties. Nevertheless, if it is in your interest and if it is necessary, we shall disclose the relevant personal data to the courts of law and to the arbitration commissions or relevant authorities, in the context of provision of the services you have requested.
4.3 PERSONAL DATA STORAGE PERIOD
Your personal data shall be stored during the validity period of the legal assistance agreement and afterwards, in accordance with our internal policies and legal obligations. If the data are not stored based on a contractual relation, such data shall be kept as long as necessary in order to achieve the purpose of their processing.
This confidentiality policy is effective as of May 10, 2018.
This confidentiality policy may be updated from time to time. When updated, a pop-up window will appear on ZRP’s website and such pop-up window shall contain the link that will send to the amendments of ZRP’s data protection policy.
We also inform you that you have the right to submit a complaint to the National Supervisory Authority for Personal Data Processing, should you consider that the processing of your personal data violates the applicable laws.