Date of update: 04 May 2022
We are committed to respecting your privacy, by complying with all applicable data protection laws and regulations, including the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).
This policy (together with the Terms and Conditions of this website, the Cookies Policy and any other documents this policy refers to) is meant to inform you on the personal data that we collect from you or that you provide to us as part of our relationship, including through this website, and how they will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat them.
I. WHO WE ARE
The data controller is Filip SCA Law Firm, with its headquarters in 2 Gara Herastrau Str., 11th floor, district 2, Bucharest, registered with the Bucharest Bar under Decision no. 1981/1.08.2008, having fiscal registration code RO24346576 (“Filip & Company” or the “Law Firm”), having telephone number +40 21 527 2000, fax number +40 21 527 2001, e-mail address privacy@filipandcompany.com. For more information regarding the Law Firm, please visit www.filipandcompany.com.
During the activity carried out by Filip & Company, your personal data may be processed in a distinct manner depending on the capacity you have when interacting with the Law Firm. Below, you can find relevant details regarding the manner in which your personal data are processed by the Law Firm, taking into consideration the nature of your relationship with the Law Firm, such as user of the website, client or potential client, representative of a contractual partner or collaborator, participant to the events and webinars, person or representative of other entities with whom we interact in connection with the assistance to clients or in connection with the potential clients, candidate for the positions available within the Law Firm, employee, associate or collaborating lawyer, student participating in the programs and events organized by or in which Filip & Company participates as data controller. Please see below the section/information notice regarding the processing of personal data which is applicable to you.
II. THE PROCESSING OF YOUR PERSONAL DATA
In the sections below, you can find specific information for each category of data subjects, regarding the purpose of the processing of personal data, the legal ground of the processing for each applicable purpose, the categories of processed data, the duration of the processing, the recipients and the transfer of personal data (where applicable).
In the process of administering and operating this website, the Law Firm will collect certain information (“personal data”) relating to identified natural persons or which can identify natural persons, which are provided by the users of this website directly (e.g. name, surname, e-mail address, any other data provided in the context of the interaction with us) or indirectly (e.g. IP address).
1.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
1.1.1. Browsing the website. Use of cookies
When you are visiting our website, we are using cookies to automatically collect technical information that could identify the user, such as the IP address, the type of internet browser used for navigating our website, your operating system, data regarding the visits on the website (including the number of visits, the time spent on the website, the manner in which the website is accessed, the behaviour on the website), the organic traffic (representing the traffic generated on our website through search engines, excluding possible paid advertisements).
The main purpose of using cookies is, on the one hand, to ensure the proper functioning and operation of the website (in the case of strictly necessary cookies), or on the other hand, to help you have a better navigation experience, perform certain functions and allow the website to “remember” the actions or preferences of the user over a period of time (in the case of statistics cookies). With respect to the latter, we will only use statistics cookies to the extent you have agreed to their use.
For more information on the use of cookies on this website and the purposes for which they are used, as well as regarding your possibilities to control and/or disable the cookies, please see our Cookies Policy.
1.1.2. Answering your questions or requests
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Answer your queries or requests by electronic correspondence (e-mail), fax or telephone.
| The processing is based on a legitimate interest, allowing us to provide answers to your queries or requests. | 3 years from the settlement of your request |
1.2. Recipients of your personal data
For reaching the purposes described above, the Law Firm uses the services of partners, as follows: (i) for the purpose of browsing the website and the purposes related to the use of cookies, we may send personal data to analysis services and search engines providers, for them to perform website maintenance services for our website, or statistical information on the visitors of the website, as detailed in our Cookies Policy, mentioned above; (ii) to answer your questions or requests, we may grant access to your personal data to our e-mail service providers. The personal data we are disclosing are limited to the minimum personal data information which is necessary to perform the respective services and we are requesting these partners not to use the personal data for any other purposes. We make every effort to ensure that all the entities we are working with are storing your personal data in safe and secure conditions.
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data, but may have access to them upon fulfilling their tasks or interacting with the Law Firm): (i) to public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on the Law Firm’s business or assets, which request the Law Firm to provide information, by virtue of the latter’s legal obligations. Such public authorities or institutions may be the National Supervisory Authority for Personal Data Processing, the National Agency of Fiscal Administration; (ii) to comply with a legal requirement or to protect the rights and assets of our Law Firm or of other entities or people, such as courts of law, bailiffs; (iii) to third parties acquisitors, insofar the business of the Law Firm would be (totally or partially) transferred and the data subjects’ data would be part of the assets representing the object of the transaction.
This section refers to your capacity as representative, contact person, collaborator or employee of our existing or potential clients or contractual partners (e.g., service providers), including the representatives and lawyers of the international law firms we work with, when authorised by you to do so under the legal assistance agreement. In general, in order to achieve the purposes below, Filip & Company collects personal data from you directly or when you are indicated as the contact person by your employer, client or contractual partner of our Law Firm.
2.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Conclusion and performance of the agreement, application by the Law Firm of the legal requirements for the prevention of and fight against money laundering, know your customer and identification of the beneficial owner of clients, application of measures to prevent conflicts of interest (conflict checks).
| The legitimate interest represented by the common interest of the Law Firm and its client/contractual partner to have a commercial relationship. When the legal assistance agreement is concluded directly with a client natural person, the processing is necessary for conclusion and performance of the legal assistance agreement. Performance of the Law Firm’s legal obligations for the prevention of and fight against money laundering, know your customer and identification of the beneficial owner, application of measures to prevent conflicts of interest (conflict checks). | For the term of the agreement concluded and for the required period after termination of the agreement for the protection of the Law Firm’s rights, taking into consideration the law applicable to the agreement, including the statute of limitation period and the terms provided by the fiscal and accounting legislation. |
2. | Purpose: Organizing the recovery of debts and settlement of any legal situations related to the performance of the agreement.
| The Law Firm’s legitimate interest to protect its financial situation and assets. The legal obligation to provide data for the purpose of conducting legal, judicial and extrajudicial proceedings in relation to the performance of the agreement. | For the term of the agreement concluded and for the period required to protect the Law Firm’s rights taking into consideration the law applicable to the agreement, including the statute of limitation period and the terms provided by the fiscal and accounting legislation. |
3. | Purpose: Organization of events or webinars to which the representatives of clients are invited.
| The Law Firm’s legitimate interest to invite the representatives of clients to the events or webinars organized for them. | Throughout the relationship with the client. |
4. | Purpose: Information to clients regarding legislative changes, communications and materials regarding legal updates, as well as communications of interest for the client’s business area / communications in special situations.
| The consent for the commercial communications sent by the Law Firm or the legitimate interest for sending communications to the clients who have previously purchased services of the Law Firm, under art. 12 (2) of Law 506/2004. The common legitimate interest of the Law Firm and clients to send non-commercial communications concerning legislative changes or updates from the client’s area of interest. The unsubscribe option is offered in all communications sent, irrespective of their nature. | Throughout the relationship with the client or until withdrawal of consent/ unsubscribe. |
5. | Purpose: Ensuring the security and safety of the goods and individuals inside the Law Firm’s headquarters, by implementing rules regarding the access to the premises by keeping the visitor access record. Categories of data: last name, first name, series and number of the identity card, destination, time of arrival and departure. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, valuables and protection of individuals. | 2 years |
6. | Purpose: Ensuring the security and safety of goods and individuals by implementing certain rules for the access in the parking area of Equilibrium building.
| The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, valuables and protection of individuals. The Law Firm’s legitimate interest to take efficient measures to ensure the safety and security of goods and individuals. | At least 2 years and for the term of the lease agreement concluded by the Law Firm with the landlord, at the most. |
2.2. Recipients of your personal data
For reaching the purposes described above, Filip & Company uses the services of several contractual partners. Some of them are data processors, such as companies providing services for hosting and maintenance of our apps, software and databases or through which activities for the management of contractual documents and financial and accounting documents are carried out, providers of archiving services, the marketing agency or the event organization agency, which carry out their activity in Romania. At the same time, the Law Firm uses the services of a provider of emailing services (currently MailChimp – the company The Rocket Science Group LLC), which carries out its activity in the United States of America. They may be provided with your personal data to be used within the limits of the obligations assumed towards Filip & Company. The personal data we are disclosing to our data processors are limited to the minimum personal data information which is necessary to perform the respective services and we are requesting them not to use the personal data for any other purposes. We make every effort to ensure that all the entities we are working with are storing your personal data in safe and secure conditions.
Other companies we use are, in their turn, data controllers, namely companies providing transport and courier services and conducting their business in Romania, or the owner of the Equilibrium building where the Law Firm has its registered office and which organizes and implements the security systems in the building.
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data, but may have access to them upon fulfilling their tasks or interacting with the Law Firm): (i) to public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on Filip & Company’s business or assets, which request Filip & Company to provide information, by virtue of the latter’s legal obligations. Such public authorities or institutions may be the National Supervisory Authority for Personal Data Processing, the Bucharest Bar, the National Agency of Fiscal Administration or other authorities competent to check our databases; (ii) to comply with a legal requirement or to protect the rights and assets of our Law Firm or of other entities or people, such as courts of law (iii) technical maintenance companies; (iv) third parties acquisitors, insofar the business of the Law Firm would be (totally or partially) transferred and the data subjects’ data would be part of the assets representing the object of the transaction.
2.3. Transfer of personal data abroad
To the extent that, in the context of the operations described above, your personal data may be transferred abroad to states in the European Union (“EU”) or European Economic Area (the “EEA”) (for example, in the context of granting legal assistance requested by the client in transactions involving several jurisdictions), any transfer performed by Filip & Company in a EU or EEA member state will observe the legal requirements laid down by the GDPR.
As regards the collaboration with our emailing service provider, MailChimp is headquartered in the United States of America, being applicable between the parties the standard contractual clauses adopted by the European Commission, complying thus with the principles of protection of privacy and personal data processing.
This section refers to your capacity as participant, including as speaker, during the events and webinars organised by Filip & Company or together with Filip & Company. These can be collected directly from you when you register in the ways made available by us, or from your employer/the entity with which you collaborate when it registers you to the event/webinar, or it provides the data for participation, as well as from the organiser of the event/webinar.
3.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Organization of events or webinars organised by Filip & Company or together with Filip & Company, including online public communication regarding them. Categories of data: last name, first name, e-mail address, telephone number, position held, the company/entity or authority in which they carry out their activity, image/voice for the speakers for preparing the invitations to the event/webinar, image/voice when the webinar is registered. | The Law Firm’s legitimate interest to bring to the participants’ attention legal topics of interest from the Law Firm’s area of expertise and to promote the Law Firm’s activity through events/webinars. The Law Firm’s legitimate interest to maintain a good relationship with them, which to allow us to provide answers to questions or requests addressed during or after the event/webinar. The Law Firm’s legitimate interest to have a record of the participants to the webinars, to provide access and to remedy difficulties in connection/participation. When the webinar is recorded, we rely on consent to process the image or voice. | Throughout the preparation and during the event/webinar and for a period of 3 years thereafter. |
2. | Purpose (applicable when the event/webinar is organised at the Law Firm’s headquarters): Ensuring the security and safety of the goods and individuals inside the Law Firm’s headquarters, by implementing rules regarding the access to the premises by keeping the visitor access record. Categories of data: last name, first name, series and number of the identity card, destination, time of arrival and departure. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, valuables and protection of individuals. | 2 years |
3. | Purpose (applicable when the event/webinar is organised at the Law Firm’s headquarters): Ensuring the security and safety of goods and individuals by implementing certain rules for the access in the parking area of Equilibrium building. Categories of data: last name, first name, license plate number of the car, time of entry/exit, number of the parking place assigned to the respective car/individual. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, valuables and protection of individuals. The Law Firm’s legitimate interest to take efficient measures to ensure the safety and security of goods and individuals.
| At least 2 years and for the term of the lease agreement concluded by the Law Firm with the landlord, at the most. |
3.2. Recipients of your personal data
For reaching the purposes described above, Filip & Company uses the services of several contractual partners. Some of them are data processors, such as companies providing services for hosting and maintenance of our apps, software and databases, the marketing agency or the event organization agency, which carry out their activity in Romania. They may be provided with your personal data to be used within the limits of the obligations assumed towards Filip & Company. The personal data we are disclosing to our data processors are limited to the minimum personal data information which is necessary to perform the respective services and we are requesting them not to use the personal data for any other purposes. We make every effort to ensure that all the entities we are working with are storing your personal data in safe and secure conditions. Your personal data can be provided, respectively collected following connection to the webinars by the providers of the online platforms thorough which the webinars are organised, with office in the United States of America (such as Zoom Video Communications, Inc).
Other companies we may use (if the case) are, in their turn, data controllers, namely companies providing transport and courier services and conducting their business in Romania, or the owner of the Equilibrium building where the Law Firm has its registered office and which organizes and implements the security systems in the building.
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data, but may have access to them upon fulfilling their tasks or interacting with the Law Firm): (i) to public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on Filip & Company’s business or assets, which request Filip & Company to provide information, by virtue of the latter’s legal obligations. Such public authorities or institutions may be the National Supervisory Authority for Personal Data Processing, the Bucharest Bar, the National Agency of Fiscal Administration or other authorities competent to check our databases; (ii) to comply with a legal requirement or to protect the rights and assets of our Law Firm or of other entities or people, such as courts of law (iii) technical maintenance companies; (iv) third parties acquisitors, insofar the business of the Law Firm would be (totally or partially) transferred and the data subjects’ data would be part of the assets representing the object of the transaction.
3.3. Transfer of personal data abroad
To the extent that, in the context of the operations described above, your personal data may be transferred abroad to states in the European Union (“EU”) or European Economic Area (the “EEA”), any transfer performed by Filip & Company in a EU or EEA member state will observe the legal requirements laid down by the GDPR.
In relation to the provider of the Zoom platform, the transfer to the United States of America is performed based on the standard contractual clauses adopted by the European Commission, complying thus with the principles of protection of privacy and personal data processing.
This section refers to your capacity as person that interacts with the Law Firm and whose data are provided by our clients/potential clients, or whose data we collect and process for our clients and potential clients from public sources or directly from you, such as for example, opponents in litigations, witnesses, experts, representatives of public authorities, representatives of organisations or of other entities.
4.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Providing our services to the clients and steps for initiation of the relationships with potential clients. Categories of data: last name, first name, signature, address, e-mail address, telephone number, position and/or any other data provided to the Law Firm by or for the clients and potential clients, including data related to and necessary for the procedures, litigations and arbitrations in which we assist our clients or other personal data which are included in the documentation made available to us by our clients or potential clients. | The legitimate interest to have a commercial relationship with the client/potential client. | For the term of the agreement concluded with clients and for the required period after termination of the agreement for the protection of the Law Firm’s rights, taking into consideration the law applicable to the agreement, including the statute of limitation period and the terms provided by the fiscal and accounting legislation. If the data are processed for potential clients with which we will not end up having a collaboration relationship, we will store them for a period of 3 years from the date of collection. |
2. | Purpose (applicable if we interact at our headquarters): Ensuring the security and safety of the goods and individuals inside the Law Firm’s headquarters, by implementing rules regarding the access to the premises by keeping the visitor access record. Categories of data: last name, first name, series and number of the identity card, destination, time of arrival and departure. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, valuables and protection of individuals. | 2 years |
3. | Purpose (applicable if we interact at our headquarters): Ensuring the security and safety of goods and individuals by implementing certain rules for the access in the parking area of Equilibrium building. Categories of data: last name, first name, license plate number of the car, time of entry/exit, number of the parking place assigned to the respective car/individual. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, valuables and protection of individuals. The Law Firm’s legitimate interest to take efficient measures to ensure the safety and security of goods and individuals. | At least 2 years and for the term of the lease agreement concluded by the Law Firm with the landlord, at the most. |
4.2. Recipients of your personal data
For reaching the purposes described above, Filip & Company uses the services of several contractual partners. Some of them are data processors, such as companies providing services for hosting and maintenance of our apps, software and databases, or providers of archiving services, which carry out their activity in Romania. They may be provided with your personal data to be used within the limits of the obligations assumed towards Filip & Company. The personal data we are disclosing to our data processors are limited to the minimum personal data information which is necessary to perform the respective services and we are requesting them not to use the personal data for any other purposes. We make every effort to ensure that all the entities we are working with are storing your personal data in safe and secure conditions.
Other companies we may use (if the case) are, in their turn, data controllers, namely companies providing transport and courier services and conducting their business in Romania, or the owner of the Equilibrium building where the Law Firm has its registered office and which organizes and implements the security systems in the building.
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data, but may have access to them upon fulfilling their tasks or interacting with the Law Firm): (i) to public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on Filip & Company’s business or assets, which request Filip & Company to provide information, by virtue of the latter’s legal obligations. Such public authorities or institutions may be the National Supervisory Authority for Personal Data Processing, the Bucharest Bar, the National Agency of Fiscal Administration or other authorities competent to check our databases; (ii) to comply with a legal requirement or to protect the rights and assets of our Law Firm or of other entities or people, such as courts of law (iii) technical maintenance companies; (iv) third parties acquisitors, insofar the business of the Law Firm would be (totally or partially) transferred and the data subjects’ data would be part of the assets representing the object of the transaction.
4.3. Transfer of personal data abroad
To the extent that, in the context of the operations described above, your personal data may be transferred abroad to states in the European Union or European Economic Area, or outside of these (for example, in the context of granting legal assistance requested by the client in transactions involving several jurisdictions), any transfer performed by Filip & Company in such a state will observe the legal requirements laid down by the GDPR.
This section refers to your capacity as candidate in the recruitment process carried out by the Law Firm, irrespective of the manner in which you apply for an available position.
5.1. During the recruitment process, Filip & Company processes your personal data, as potential employer / collaborator, for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Carrying out the selection / recruitment process and managing the candidates’ data, including requesting information from the former employer regarding the duration of employment and the activities carried out, with the prior notification of the candidate, under the conditions provided by the Labour Code. Categories of data: last name, first name, postal address, e-mail address, telephone number, age, gender, marital status, nationality, date and place of birth, image (photo); professional experience, data on education and qualifications, membership in various professional organizations, licenses, permits and authorizations or certifications held; language skills and other skills, hobbies and lifestyle; any other personal data voluntarily provided by you during the recruitment process; the data obtained during the recruitment process, resulting from the application of skills, competencies and knowledge tests. Others: data of the identity card, required for the conclusion of the agreement, when a job offer is made upon completion of the recruitment process. | During the recruitment process, the data are processed based on the Law Firm’s legitimate interest to hire personnel in order to carry out the activity If a job/collaboration offer is made upon completion of the recruitment process, from that moment your data will be processed in order to carry out the formalities for the conclusion of the agreement. | Throughout the recruitment process. |
2. | Purpose: Promoting future career opportunities. Categories of data: last name, first name, contact details specified by the candidate (e-mail address, telephone), data of the CVs, application, references. | Candidates’ CVs are kept by the Law Firm for the purpose of contacting them for future employment opportunities, only based on the consent expressed in advance for this purpose by the respective data subject. | For a period of 1 year from collecting the data (receiving the application/CV), or until withdrawal of consent, whichever occurs first. |
3. | Purpose: Ensuring the security and safety of the goods and individuals inside the Law Firm’s headquarters, by implementing rules regarding the access to the premises by keeping the visitor access record. Categories of data: last name, first name, series and number of the identity card, destination, time of arrival and departure. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, valuables and protection of individuals. | 2 years. |
5.2. Collection of personal data
In order to carry out the selection/recruitment process, the Law Firm collects the personal data of candidates from the following sources:
a) specialist recruitment websites, such as: www.linkedin.com; www.bestjobs.eu; www.hipo.ro; www.ejobs.ro;
b) directly from you, when you apply for the positions available within the Law Firm through the website www.filipandcompany.com or by sending an application to the dedicated e-mail addresses: join@filipandcompany.com, office@filipandcompany.com, through the “Join us” section of our website, as well as through the employees/collaborators of the Law Firm, when they recommend you.
5.3. Recipients of your personal data
For reaching the purposes described above, Filip & Company uses the services of various contractual partners, which are, in their turn, data controllers, namely recruitment agencies or platforms with which the Law Firm collaborates and which are responsible for the processing of data in accordance with the applicable law. Furthermore, the owner of the building where the Law Firm has its registered office is a data controller in relation to the purpose of keeping the visitor access record.
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data, but may have access to them upon fulfilling their tasks or interacting with the Law Firm): (i) to public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on the Law Firm’s business or assets, which request the Law Firm to provide information, by virtue of the latter’s legal obligations; (ii) to comply with a legal requirement or to protect the rights and assets of our Law Firm, such as courts of law, (iii) technical maintenance companies.
5.4. Refusal of the processing and consequences thereof
If the recruitment process leads to an employment offer, the transmission of personal data may be an obligation necessary for the conclusion of an agreement with the Law Firm, and the data subject must provide the personal data in order to be able to accept the employment/collaboration offer received and enter into the individual employment agreement or the collaboration agreement. If the data subject fails to provide the data for the purpose mentioned above, the individual employment agreement or the collaboration agreement may not be concluded.
This section refers to your capacity as associate and collaborating lawyers of the Law Firm as well as representatives of the individual law firms (in Ro cabinete individuale) with which the Law Firm collaborates now or at any time in the past.
6.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Managing the collaboration with its lawyers, including the payment of fees, bonuses, or other benefits. Categories of data:
| The invoices and other justifying documents are kept for a 10- year time period as of their issuance; The other documents are maintained throughout the duration of the collaboration and another 4 years after its termination. | |
2. | Purpose: The revision and analysis of the hours worked by the lawyers and the issuance of the invoices towards the clients containing a description of the hours worked by the lawyers (by means of a software/application). Categories of data: last name, first name, capacity/ position, number of hours worked, activity carried out. | The processing is necessary for the performance of an agreement to which you are a party, and serves as well the Law Firm’s legitimate interest of developing its relationship with its clients, of observing the Law Firm’s legal and contractual obligations and of protecting the Law Firm’s rights. | 10 years |
3. | Purpose: The elaboration of statistical reports, reports, and assessments by means of a software/application with respect to the lawyers’ and the Law Firm’s performance (number of hours worked, invoiced/received amounts, name of clients etc.). Categories of data: last name, first name, capacity/ position, number of hours worked, activity carried out. | The performance of an agreement to which you are a party and our legitimate interest to analyse the performance of the lawyers with which the Law Firm collaborates (from a financial perspective and client data base development perspective). | 10 years |
4. | Purpose: The use of magnetic cards to access the building as well as to allow access in the building’s parking area.
| The legal obligation and our legitimate interest to ensure the security of the goods and individuals in the office premises and parking area. | Throughout the collaboration and 4 years after its termination. |
5. | Purpose: The sending of Law Firm presentations and offers towards its clients/potential clients, the taking of photos, the making of videos, testimonials and articles, interviews and any other media articles with a purpose to promote the Law Firm’s legal activity and services, the organisation of webinars to which the Law Firm’s lawyers participate. Categories of data: last name, first name, capacity/ position, telephone number, e-mail address, activity conducted, photography, image and voice (in case of online webinars) | The processing is necessary for the performance of an agreement to which you are a party and also serves the Law Firm’s legitimate interest of developing its relationship with its clients/potential clients. Participating in the taking of photos, making of videos, testimonials and articles, interviews and any other media articles with a purpose to promote the Law Firm’s legal activity and services, and in the organisation of webinars is done on a voluntary basis. | 10 years |
6. | Purpose: The negotiation, conclusion, and performance of the relation with clients (including after the termination of the collaboration with the lawyers involved at a certain time in the project), potential clients, collaborators, contractual partners, as well as ensuring compliance with the obligations incumbent upon the Law Firm as per the specific legislation, and ensuring protection against unfair competition and of the Law Firm’s rights.
| The processing is necessary for the performance of an agreement to which you are a party and serves the legitimate interest of the Law Firm to develop its relations with the clients, to continue the activities /projects in which the data subject was involved throughout the duration of his/her collaboration with the Law Firm, to observe the Law Firm’s legal and contractual obligations and to protect the Law Firm’s rights. | 10 years (because they include the agreements with the clients) Professional correspondence is kept for a reasonable period of time after the termination of the collaboration with the Law Firm, depending on seniority. |
7. | Purpose: The sending of Law Firm presentations towards companies that put up rankings of and/or grant awards/honours to law firms. Categories of data: last name, first name, capacity/ position, telephone number, e-mail address. | Our legitimate interest to participate in such rankings in view of having our activity acknowledged. | 10 years as of the sending of the presentation. |
8. | Purpose: The granting of certificates and references for the former lawyers who collaborated with the Law Firm. Categories of data: last name, first name, position, activity carried out, the period over which you were our collaborator. | Consent. | 1 year as of granting of the consent |
9. | Purpose: Managing the Law Firm’s accounting records by recording the invoices issued by the lawyers. Categories of data: last name, first name, identity card series and number, personal numerical code, fiscal identification code, bank account number, headquarters, e-mail address, telephone number. | Legal obligation. | 10 years as of the end of the financial year during which they were prepared. |
10. | Purpose: Organising and carrying out financial and legal reporting, analyses and investigations and of the Law Firm’s internal audit. Categories of data: last name, first name, e-mail address, capacity/ position, fiscal identification code, activity carried out pursuant to the agreement concluded, including the correspondence exchanged by means of the Law Firm’s infrastructure. | Legal obligation and our legitimate interest to ensure a good financial and legal management of the Law Firm.10 years as of the end of the financial year during which they were prepared. | 10 years as of the end of the financial year during which they were prepared. |
11. | Purpose: Ensuring the IT infrastructure (maintenance and updating of IT systems). Categories of data: username/e-mail address, user’s password and first name and last name, provided equipment and devices, the code and series of the provided devices. | Our legitimate interest to ensure the maintenance and operation of the Law Firm’s IT infrastructure in view of properly conducting its activity. | Throughout the collaboration and 4 years after its termination |
12. | Purpose: The sending of newsletters with internal and external updates. Categories of data: last name, first name, image, and corporate e-mail address. | Our legitimate interest that the collaborating lawyers are up to date with the Law Firm’s relevant events. | Throughout the duration of the collaboration. |
13. | Purpose: Publishing on the Law Firm’s website (www.filipandcompany.com) the image and CV of the lawyers in view of presenting the team and the practice areas, associating the lawyers’ image (photo) to the office email account, each lawyer uploading his/her own photo. Categories of data: Image, name, surname, e-mail address, telephone number, position, practice areas. | The Law Firm’s legitimate interest to present its activity and the lawyers’ areas of expertise and to develop the relationship with the clients. | Throughout the duration of the collaboration. |
14. | Purpose: Publishing on the Law Firm’s website (www.filipandcompany.com), on the Facebook and LinkedIn pages, but also in the media, certain materials and articles signed by lawyers on various legal topics. Categories of data: image, last name, first name, e-mail address, telephone number, position, practice areas. | The Law Firm’s legitimate interest to present its activity and the lawyers’ areas of expertise for developing the relationship with existing and potential clients. | Throughout the time the Law Firms use such platforms. |
15. | Purpose: Organising certain events, trips, and workshops with a view to develop personal and professional skills. Categories of data: last name, first name, e-mail address, personal numerical code-ul, identity card series and number to perform the check-in formalities with the accommodation unit and/or for transport tickets. | Consent. | 5 years as of the date of the event, the travel or the workshops or as of the end of the financial year during which the documents are prepared, for documents such as traveling orders, travel expense report. In what invoices and substantiating documents are concerned, 10 years as of the end of the financial year during which they were issued. |
16. | Purpose: Conducting annual medical check-ups for determining the work capacity.
| Consent. | Throughout the duration of the collaboration and no more than 4 years after its termination. |
17. | Purpose: Conducting satisfaction surveys among the collaborating lawyers that concern the collaboration relation. Categories of data: last name, first name, e-mail address, capacity/ position. | Our legitimate interest to assess, develop and improve the collaboration relationship. | 5 years as of the date of the satisfaction survey. |
18. | Purpose: Ensuring the security and safety of goods and individuals by implementing certain rules for the access in the parking area of Equilibrium building, including by implementing an automated license plate recognition system. Categories of data: name, surname, license plate number of the car, time of entry/exit, number of the parking place assigned to the respective car/individual. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, values and protection of individuals. The Law Firm’s legitimate interest to take efficient measures to ensure the safety and security of goods and individuals. | At least 2 years and for the term of the lease agreement concluded by the Law Firm with the landlord, at the most . |
In addition to the above, the Law Firm may also process other personal data received from you or generated in connection with your collaboration with the Law Firm.
We may also ask you to provide us with certain personal data of others, such as family members or other affiliates, in which case you will be provided with a separate and specific consent form to be submitted to that person in order to give their consent to the processing of their personal data by the Law Firm, according to your instructions or, as the case may be, an information note will also be made available to those data subjects.
6.2. Collection of personal data
The Law Firm collects personal data from the following sources:
a) directly from you;
b) from other employees or collaborating lawyers of the Law Firm with whom you have collaborated, for example information regarding your performance within the Law Firm;
c) from various clients, potential clients, collaborators or contractual partners, information that arise from your interaction with these individuals.
6.3. Recipients of your personal data
For the purposes mentioned above, the Law Firm uses the services of several contractual partners. Some of them have the capacity as processor, such as, the provider of the time sheet and billing software, the provider of the software used for performance evaluation, the providers of training/induction services for collaborating lawyers (who carry out HR training and induction activities and are active in the HR consultancy industry/sector, carrying out their commercial activity in Romania), the document archiving service provider (which is active in the archival services industry/sector and carries out its commercial activity in Romania), the provider of IT maintenance and repair services – computer and communication equipment – maintenance of software and hardware applications (operating in Romania), companies that provide maintenance and hosting services for the Law Firm’s website and other software/applications (operating in Romania), the providers of photo/video material production services (active in the photo and video production industry and carrying out their commercial activity in Romania), the providers of medical services, and they may be provided with your personal data to be used within the limits of the obligations they assume towards the Law Firm. The personal data we are disclosing to our data processors are limited to the minimum personal data information which is necessary to perform the respective services and we are requesting them not to use the personal data for any other purposes. We make every effort to ensure that all the entities we are working with are storing your personal data in safe and secure conditions.
Other recipients are, in turn, data controllers, such as banks (operating in Romania), medical service providers acting as controllers themselves in connection with private healthcare subscriptions (carrying out service provision activities and are active in the medical industry/sector, carrying out their commercial activity in Romania), some of the providers of various personal benefits for collaborating lawyer, such as the sport subscription, the online library subscription, our providers of legislative programme services, such as Wolters Kluwer, the e-learning providers, as the case may be (operating in Romania), our distributors (carrying out product marketing activities and operating in Romania and abroad) as well as any other contractual partners with which the Law Firm has business relations, some of which being located within the country, within the European Union or outside it.
Also, the owner of the Equilibrium building where the Law Firm has its registered office is a data controller in what concerns the implementation of the access control system in the parking lot and inside the building by keeping the access record.
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data but may have access to them upon fulfilling their tasks or interacting with the Law Firm): (i) to public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on the activity and assets of the Law Firm, which request the Law Firm to provide information, by virtue of the latter’s legal obligations. These public authorities or institutions can be the National Agency of Fiscal Administration, the Local Police in case of certain incidents, the Environmental Authorities, etc.; (ii) for compliance with a legal requirement or for the protection of the rights and assets of our Law Firm or of other entities or persons, such as courts, bailiffs, bodies of the legal profession, legal advisers; (iii) technical maintenance companies. Also, some of your data may be disclosed to the Law Firm’s clients or potential clients, in view of conducting our contractual relation with them.
6.4. Transfer of personal data abroad
To the extent that, in the context of the operations described above, your personal data may be transferred abroad to states in the European Union (“EU”) or European Economic Area (the “EEA”) (for example, in the context of granting legal assistance requested by the client in transactions involving several jurisdictions), any transfer performed by Filip & Company in a EU or EEA member state will observe the legal requirements laid down by the GDPR.
In the context of providing references, some of the potential future beneficiaries requesting references regarding the period in which you were our associate may be located in non-EU and EEA countries that do not provide adequate protection for the processing of personal data. In this case, we will communicate to them some of the personal data mentioned in this information note, only on the basis of your express consent obtained prior to the communication, in order to ensure the guarantees required under the GDPR. Furthermore, some of your data may be transferred to clients or potential clients of the Law Firm, in view of conducting our contractual relation with them.
6.5. Refusal of the processing and consequences thereof
The personal data indicated above, which are processed under a legal obligation or for the performance of the contract to which you are a party represent a necessary obligation for the conclusion of a contract with the Law Firm, and you must provide personal data for the conclusion or performance of the collaboration agreement and to enable us to comply with our legal obligations towards you and towards the public authorities or bodies of the legal profession. If you do not provide us with the data for the purposes mentioned above, we will not be able to conclude the collaboration agreement, we will not be able to develop the contractual relationship based on the collaboration agreement, and you will not be able to benefit from certain personal benefits granted by the Law Firm or by its partners.
This section refers to your capacity as Law Firm employee held now or at any time in the past.
7.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: The management of the employment relationship with employees: fulfilment of work obligations, salary payment, Revisal, compensation, granting of benefits, fulfilment of unemployment formalities. Categories of data:
| Complying with certain legal obligations and as well as the performance of an agreement to which you are a party, for employment relationship purposes. | ·
|
2. | Purpose: The granting and managing of personal benefits for the employees (not included in the agreement or in the employment offer). Associating the employee’s image (photo) to the office email account, by uploading by the employee of his/her own photo (as an option, the employees may upload / modify / delete the photo, as they wish), Categories of data: last name, first name, personal numerical code, ID series, number and date of release, domicile address, signature, department where you conduct your activity, e-mail address, bank account number, telephone number, position, image (photo) – as an option. | The Law Firm’s legitimate interest in maintaining a good relationship with the employees. | Throughout the employment relationship plus another 4 years as of the termination thereof. For the duration of the employment relation, as regards the association of the photo to the office email account. |
3. | Purpose: Conducting investigations, labour discipline issues and providing support in conflictual situations or in case of underperformance by the employees. Categories of data: last name, first name, position, signature, activity carried out, including correspondence exchanged by means of the Law Firm’s infrastructure. | Our legitimate interest in ensuring an adequate work environment and a good relationship with the employees, in complying with the Law Firm’s legal and contractual obligations and in protecting the Law Firm’s rights. | Throughout the employment relationship plus another 4 years as of the termination thereof. |
4. | Purpose: The use of magnetic cards to access the building as well as in the building’s parking area. Categories of data: last name, first name, time of entry/exit, e-mail address, access card number, license plate number. | The legal obligation and our legitimate interest to ensure the security of the individuals and goods in the office premises. | At least 2 years and without exceeding the duration of the employment agreement. |
5. | Purpose: Ensuring the security and safety of goods and individuals by implementing certain rules for the access in the parking area of Equilibrium building. Categories of data: last name, first name, license plate number of the car, time of entry/exit, number of the parking place assigned to the respective car/individual. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, values, and protection of individuals. The Law Firm’s legitimate interest to take efficient measures to ensure the safety and security of goods and individuals. | At least 2 years and for the term of the lease agreement concluded by the Law Firm with the landlord, at the most. |
6. | Purpose: Ensuring labour health and safety: conducting labour protection trainings and occupational health check-ups. Categories of data:
. | Legal obligation to process labour health and safety related data (for all processing required under the relevant legislation). | Throughout the employment relationship plus another 4 years as of the termination thereof. |
7. | Purpose: Performance evaluation at Law Firm level through applications. Categories of data: last name, first name, e-mail address, position, performance indicators, activity conducted. | Our legitimate interest to centralise and assess the performance of employees at Law Firm level (from a financial and client data base development perspective). | Throughout the employment relationship plus another 4 years as of the termination thereof. |
8. | Purpose: Carrying out employee satisfaction surveys and salary surveys. Categories of data: last name, first name, position, e-mail address | Our legitimate interest to identify the employees’ level of satisfaction. | 2 years |
9. | Purpose: Marketing and advertising, delivery of newsletters with the latest internal news. Categories of data: last name, first name, image and corporate e-mail address. | Our legitimate interest that you be up to date with the services offered by Filip & Company and our corporate events. | Throughout the employment relationship |
10. | Purpose: Organising business trips. Categories of data: last name, first name, e-mail address, personal numerical code, ID series and number to perform the check-in formalities with the accommodation unit and/or for transport tickets. | Contractual obligation to perform the duties provided in your job description. | Throughout the employment relationship. |
11. | Purpose: Organising certain events and workshops with a view to develop technical and professional skills. Categories of data: last name, first name, ID series and number, date and signature | Our legitimate interest to develop the skills of the Law Firm’s employees. | 5 years |
In addition to the above, the Law Firm may also process other personal data received from you or generated in connection with your activity carried out within the Law Firm.
We may also ask you to provide us with certain personal data of others, such as family members or other affiliates, in which case you will be provided with a separate and specific consent form to be submitted to that person in order to give their consent to the processing of their personal data by the Law Firm, according to your instructions or, as the case may be, an information note will also be made available to those data subjects.
7.2. Collection of personal data
The Law Firm collects personal data from the following sources:
a) directly from you;
b) from other employees of the Law Firm with whom you have collaborated, for example information regarding your workplace performance;
c) from various clients, potential clients, collaborators or contractual partners, information that arise from your interaction with these individuals.
7.3. Recipients of your personal data
For the purposes mentioned above, the Law Firm uses the services of several contractual partners. Some of them have the capacity as processor, such as, the provider of payroll and employee satisfaction survey services, the time sheet and performance assessment software providers (which provide payroll and HR management services and act in the IT industry/sector, conducting their commercial activity in Romania), the providers of training/induction services for employees (who carry out HR training and induction activities and are active in the HR consultancy industry/sector, carrying out their commercial activity in Romania), the occupational health services provider that acts as processor with respect to the data related to the employees’ skills to work upon employment and during the annual occupational health check-ups (providing medical services and being active in the medical industry/sector and conducting its commercial activity in Romania), the document archiving service provider (which is active in the archival services industry/sector and carries out its commercial activity in Romania), the provider of IT maintenance and repair services – computer and communication equipment – maintenance of software and hardware applications (operating in Romania), the providers of photo/video material production services (active in the photo and video production industry and carrying out their commercial activity in Romania), and they may be provided with your personal data to be used within the limits of the obligations they assume towards the Law Firm. The personal data we are disclosing to our data processors are limited to the minimum personal data which is necessary to perform the respective services and we are requesting them not to use the personal data for any other purposes. We make every effort to ensure that all the entities we are working with are storing your personal data in safe and secure conditions.
Other recipients are, in turn, data controllers, such as banks (operating in Romania), medical service providers acting as controllers themselves in connection with private healthcare subscriptions (carrying out service provision activities and are active in the medical industry/sector, carrying out their commercial activity in Romania), some of the providers of various personal benefits for the employees, such as the lunch vouchers, the sport subscription, the online library subscription, the e-learning providers, as the case may be (conducting their commercial activity in Romania), our distributors (carrying out product marketing activities and operating in Romania and abroad), Wolters Kluwer, for the creation of the user account (which provides specialized information services, products and services dedicated to professionals, carrying out its commercial activity in Romania), the owner of the Equilibrium building which implements the necessary security systems and any other contractual partners with which the Law Firm has business relations, some of which may be located in the country, within the European Union, or outside it. Also, the companies that manage the Facebook, LinkedIn platforms are data controllers, therefore in order to determine how they process personal data, please consult their privacy policy.
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data but may have access to them upon fulfilling their tasks or interacting with the Law Firm): (i) to public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on the activity and assets of the Law Firm, which request the Law Firm to provide information, by virtue of the latter’s legal obligations. These public authorities or institutions can be the National Agency of Fiscal Administration, the Territorial Labour Inspectorate, the labour force agencies, the Local Police in case of certain incidents, the Environmental Authorities, etc.; (ii) for compliance with a legal requirement or for the protection of the rights and assets of our Law Firm or of other entities or persons, such as courts, bailiffs, bodies of the legal profession, legal advisers; (iii) technical maintenance companies.
Furthermore, some of your data may be disclosed to the Law Firm’s clients or potential clients, in view of conducting our contractual relation with them.
7.4. Transfer of personal data abroad
To the extent that, in the context of the operations described above, your personal data may be transferred abroad to states in the European Union (“EU”) or European Economic Area (the “EEA”), any transfer performed by Filip & Company in a EU or EEA member state will observe the legal requirements laid down by the GDPR.
In the context of providing references, some of the potential future employers requesting references regarding the period in which you were our employee may be located in non-EU and EEA countries that do not provide adequate protection for the processing of personal data. In this case, we will communicate to them some of the personal data mentioned in this information note, only on the basis of your express consent obtained prior to the communication, in order to ensure the guarantees required under the GDPR. Furthermore, some of your data may be transferred to clients or potential clients of the Law Firm, in view of conducting our contractual relation with them.
7.5. Refusal of the processing and consequences thereof
The personal data indicated above and processed under a legal/contractual obligation are necessary for the conclusion of a contract with the Law Firm, and you must provide personal data for the conclusion or execution of the employment agreement and to enable us to comply with our legal obligations towards you and towards the public authorities. If you do not provide us with the data for the purposes mentioned above, we will not be able to conclude the individual employment agreement, we will not be able to develop the contractual relationship based on the individual employment agreement, and you will not be able to benefit from certain personal benefits granted by the Law Firm or by its partners.
This section refers to your capacity as candidate student in the selection process for the practice programme and as selected student, beneficiary of the sponsorship agreement concluded with Filip & Company in the context of the participation in the practice programme.
8.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Carrying out the selection process of the students participating in the practice programme. Categories of data: the data contained in your CV, as well as other documents provided by you through the application you submit to the Law Firm, including your notes and media. | The Law Firm’s legitimate interest to select the students who will participate in the practice programme. | The time required to carry out the student selection process. In the event that you are selected, the data will be kept for the duration and for the purposes mentioned below. |
2. | Purpose: Management of the sponsorship relationship (in Ro: mecenat) – granting the financial support (making the payment under the sponsorship agreement), signing the non-disclosure agreement, fulfilling other legal obligations. Categories of data:
| Compliance with legal obligations and contractual obligations for the performance of the sponsorship agreement. | 10 years as of the end of the financial year during which they were concluded. |
3. | Purpose: Use of magnetic cards for access to the headquarters of Filip & Company. Categories of data: last name, first name, entry and exit time, e-mail address, access card number. | The Law Firm’s legal obligation and legitimate interest to ensure the security of the headquarters, goods and individuals. | Throughout the duration of the sponsorship agreement. |
4. | Purpose: Issuance of certificates and references for the beneficiaries, at their request. Categories of data: last name, first name, period during which the sponsorship agreement was performed, the performed activity | Beneficiary’s consent. | Throughout the duration of the sponsorship agreement, as well as 3 years after its termination. |
5. | Purpose: Provide the beneficiaries with health and safety training regarding their visits to the Law Firm’s headquarters. Categories of data: last name, first name, date and place of birth, studies, qualification, signature, details of route to/from Filip & Company’s headquarters, signature for the employee receiving the training. | Legitimate interest in ensuring the security of the beneficiaries operating at the Law Firm’s headquarters. | Throughout the duration of the sponsorship agreement. |
6. | Purpose: Creation of an e-mail account for the beneficiary and communication between the beneficiary and the Law Firm’s employees/collaborators, through such e-mail account created by the Law Firm.
| Our legitimate interest in communicating with the beneficiary, including for verifying the compliance with the obligations under the sponsorship agreement. | The data are kept throughout the duration of the sponsorship agreement. |
7. | Purpose: Marketing and advertising, sending newsletters containing the latest internal news – internal communication. Categories of data: last name, first name and corporate e-mail address | Legitimate interest to keep up-to-date with the events in Filip & Company’s life. | Throughout the duration of the sponsorship agreement. |
8. | Purpose: Writing testimonials and articles, conducting (written, photo-video) interviews and any other press materials in order to promote the practice programme, the activity and services of the Law Firm. Categories of data: image, voice, name, address, e-mail address, telephone number, role, signature. | Consent. | Until withdrawal of consent. |
9. | Purpose: Organising training sessions, knowledge enhancement and research activities in certain areas of law, as well as organising events and seminars for providing the beneficiaries with training and professional development. Categories of data: last name, first name and corporate e-mail addres | Performance of the sponsorship agreement. | Throughout the duration of the sponsorship agreement. |
10. | Purpose: Ensuring the security and protection of the goods and individuals inside the Law Firm’s headquarters, by implementing rules regarding the access to the premises by keeping the visitor access record. Categories of data: last name, first name, series and number of the identity document, destination, time of arrival and departure. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, values and protection of individuals. | 2 years |
11. | Purpose: Conducting an analysis of the participation of the candidates of the practice programme to other events organised by Filip & Company, in order to determine the success of the respective events. Categories of data: last name, first name, the name of the event to which the person participated. | Legitimate interest to assess the success of the events organised for students and to promote its activity in connection with the recruitment campaigns organised for students. | 2 years from the moment of participation to the event. |
In addition to the above, the Law Firm may also process other personal data received from you or generated in connection with your activity carried out with the support of the Law Firm.
8.2. Recipients of your personal data
For the purposes mentioned above, Filip & Company uses the services of several contractual partners, such as other data controllers, i.e. banks (carrying out financial activities and operating in the finance and banking industry/sector in Romania), and our legal software services providers, such as Wolters Kluwer, (which provides specialized information services, products and services dedicated to professionals, carrying out its business in Romania) for the creation of the user account, as well as the owner of the Equilibrium building, which implements the necessary security systems inside the building where the registered office of the Law Firm is located.
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data, but may have access to them upon fulfilling their tasks or interacting with the Law Firm): (i) public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on the Law Firm’s business or assets, which request the Law Firm to provide information, by virtue of the latter’s legal obligations; (ii) for compliance with a legal requirement or for the protection of the rights and assets of our Law Firm, such as courts of law; (iii) technical maintenance companies.
8.3. Transfer of personal data abroad
In the context of carrying out the operations described above, your personal data are not transferred abroad to countries within the European Union or the European Economic Area or outside them.
8.4. Refusal of the processing and consequences thereof
To the extent that the data processing is performed for the purpose of fulfilling the sponsorship agreement (where expressly provided herein above) or in order to enable us to fulfil our legal obligations towards you and towards the public authorities, if you do not provide us with the data for the purposes mentioned above, we will not be able to conclude the sponsorship agreement and carry out the contractual relationship under the sponsorship agreement.
This section refers to your capacity as participant in the Negotiation Contest organised by Filip & Company in collaboration with the Law Students Association (in Romanian, Asociatia Studentilor in Drept – ASD, hereinafter the “ASD”).
9.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Registration and participation in the competition, by filling in the registration form made available Categories of data: last name, first name, group to which the participant belongs within the Faculty of Law, telephone number, e-mail address, extract of grades and average grades from the academic transcript | Performing a contractual obligation or taking steps to conclude an agreement at the request of the participants. | Throughout the duration of the Negotiation Contest, as well for the period of time necessary to ensure protection of the Law Firm’s rights, according to the applicable law, including for the limitation period and during the time-limit laid down by the fiscal and accounting legislation. |
2. | Purpose: Award and management of prizes Categories of data: last name, first name, signature, personal identification number, number and series of the identity card, copy of the identity card | Contractual obligation Fulfilment of the legal obligations imposed by the applicable fiscal legislation | Throughout the duration of the Simulated Negotiation Competition, as well for the period of time necessary to ensure protection of the Law Firm’s rights, according to the applicable law, including for the limitation period and during the time-limit laid down by the fiscal and accounting legislation. |
3. | Purpose: Online public communication regarding the conduct of the Competition and the winners. Categories of data: last name, first name, image. | The Law Firm’s legitimate interest to inform the interested public regarding the conduct of the Competition and regarding its winners, in order to recognize their merits. | Throughout the duration of the organisation and conduct of the Competition, as well as 4 years after its completion. |
4. | Purpose: Writing testimonials and articles, (written, photo-video) interviews and any other press materials in order to promote the Competition, the Law Firm’s activity and services. Categories of data: image, voice, last name, first name, e-mail address, telephone number, signature. | Participant’s consent. | Until withdrawal of consent. |
5. | Purpose: Ensuring the security and protection of the goods and individuals inside the Law Firm’s headquarters, by implementing rules regarding the access to the premises and by keeping the visitor access record. Categories of data: last name, first name, series and number of the identity card, destination, time of arrival and departure. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, values and protection of individuals. | 2 years |
6. | Purpose: Conducting an analysis of the participation of the candidates of the practice programme to other events organised by Filip & Company, in order to determine the success of the respective events. Categories of data: last name, first name, the name of the event to which the person participated. | Legitimate interest to assess the success of the events organised for students and to promote its activity in connection with the recruitment campaigns organised for students. | 2 years from the moment of participation to the event. |
9.2. Recipients of your personal data
The personal data indicated above may also be made available or submitted to third parties in the following situations (in these cases, these are third parties who do not intend to process the data, but who may have access to such data when performing their tasks or during their interactions with the Law Firm): (i) to public authorities, financial or legal auditors or institutions competent to carry out inspections and checks on the Law Firm’s business or assets, which request the Law Firm to provide information, by virtue of the latter’s legal obligations; (ii) for compliance with a legal requirement or for the protection of the rights and assets of our Law Firm, such as courts of law; (iii) to companies providing technical maintenance and security systems.
Also, the Law Students Association (ASD) has access to your personal data, in its capacity as collaborator, in order to organise the Competition, acting as an independent controller.
9.3. Transfer of personal data abroad
In the context of carrying out the operations described above, your personal data are not transferred abroad to countries within the European Union or the European Economic Area or outside them.
9.4. Refusal of the processing and consequences thereof
To the extent that the data processing is performed for the purpose of fulfilling the agreement, respectively, for you to accept the terms and conditions of enrolment for the competition (where the performance of the agreement is expressly provided herein above as a basis for the data processing) or to enable us to fulfil our legal obligations to you and towards the public authorities, if you do not provide us with the data for the purposes mentioned above, we will not be able to carry out the contractual relationship and you will not be able to participate in the competition.
This section refers to your capacity as participant in the student events that we organize or in which we participate, including JobFest or The Perfect Candidate.
10.1. Filip & Company processes your personal data for the following purposes, based on the legal basis indicated for each of them:
Purpose and categories of data | Legal basis | Duration of the processing | |
1. | Purpose: Organising and carrying out events, including enrolment management Categories of data: last name, first name and e-mail address. | The Law Firm’s legitimate interest to promote its activity in connection with the recruitment campaigns organised for students. | Throughout the duration of the event, as well as 3 months from the date set for each event. |
2. | Purpose: Contacting for recruitment purposes, in order to invite the student to participate in the internship programme within the Law Firm. Categories of data: last name, first name, e-mail address, data contained in the CV, letter of intent, extract of the grades and averages obtained at the faculty. | The Law Firm’s legitimate interest to carry out student recruitment campaigns within the Law Firm. | Throughout the duration of the event, as well as 3 months from the date set for each event. |
3. | Purpose: Ensuring the security and protection of the goods and individuals inside the Law Firm’s headquarters, by implementing rules regarding the access to the premises and by keeping the visitor access record. Categories of data: last name, first name, series and number of the identity card, destination, time of arrival and departure. | The legal obligation provided by Law no. 333/2003, as subsequently amended, on the security of objectives, goods, values and protection of individuals. | 2 years. |
4. | Purpose: Conducting an analysis of the participation of the candidates of the practice programme to other events organised by Filip & Company, in order to determine the success of the respective events. Categories of data: last name, first name, the name of the event to which the person participated. | Legitimate interest to assess the success of the events organised for students and to promote its activity in connection with the recruitment campaigns organised for students. | 2 years from the moment of participation to the event. |
10.2. Recipients of your personal data
Filip & Company uses the services of several contractual partners. Some of them are processors, such as the companies providing hosting and maintenance services for our applications, software and databases, are active in the IT services industry and operate in Romania. They process personal data within the limits of the obligations they assume towards the Law Firm.
The personal data indicated above may be made available or submitted to third parties in the following situations: (i) to public authorities, auditors or institutions competent to carry out inspections and checks on the activity and assets of the Law Firm, which request the Law Firm to provide information by virtue of the latter’s legal obligations; (ii) to companies providing technical maintenance, including security systems; and (iii) to courts of law, for ensuring compliance with a legal requirement or protection of the Law Firm’s rights and assets.
10.3. Transfer of personal data abroad
In the context of carrying out the operations described above, your personal data are not transferred abroad to countries within the European Union or the European Economic Area or outside them
10.4. Refusal of the processing and consequences thereof
To the extent that the data processing is performed to enable us to fulfil our legal obligations to you and towards the public authorities, if you do not provide us with the data for the purposes mentioned above, we will not be able to give you access inside the Law Firm’s headquarters.
III. WHAT HAPPENS TO YOUR PERSONAL DATA AFTER THE CESSATION OF THE DATA PROCESSING
The Law Firm processes personal data only for the period necessary to achieve the data processing purposes explained in the above sections, for each category of data subjects, while complying with the legal requirements in force. If the Law Firm establishes that it has a legitimate interest or a legal obligation to further process your personal data for other purposes, you will be informed accordingly in this respect.
Once the processing period indicated above expires and the Law Firm no longer has legal or legitimate reasons to process your personal data, the data will be deleted in accordance with its procedures, which may involve archiving, anonymizing or destroying them.
IV. AUTOMATED DECISION MAKING AND AUTOMATED PROFILING
The personal data referred to in this Privacy Policy are not subject to automated decision making, including profiling.
V. SECURITY OF THE DATA PROCESSING
The Law Firm constantly evaluates and upgrades the security measures implemented as to ensure a secure and safe personal data processing.
VI. THE DATA SUBJECT’S RIGHTS IN RESPECT OF THE DATA PROCESSING
Within the context of the processing of your personal data, you have the following rights:
a) The right of access to the processed personal data: you have the right to obtain a confirmation whether or not your personal data are being processed, and, if affirmative, to have access to the type of personal data and to the conditions of processing, by addressing a request in this respect to the data controller indicated in Section VII below;
b) The right to request the rectification or erasure of personal data: you have the possibility to request, by sending a request in this respect to the data controller indicated in Section VII below, the rectification of inaccurate personal data, the supplementation of incomplete data or the erasure of your personal data in case (i) the data are no longer needed for their original purpose (and no new lawful purpose exists), (ii) the lawful basis for the processing is the data subject’s consent, the data subject withdraws that consent, and no other lawful ground exists, (iii) the data subject exercises the right to object and the controller has no overriding grounds for continuing the processing, (iv) the data have been processed unlawfully, (v) erasure is necessary for compliance with EU law or Romanian law, or (vi) the data were collected in connection with the informational society services offered to children (if the case), where specific requirements regarding consent are applicable;
c) The right to request the restriction of processing: you have the right to obtain the restriction of processing in cases where: (i) you consider that the processed personal data are inaccurate, for a period enabling the controller to verify the accuracy of the personal data; (ii) the processing is unlawful, however you don’t want us to erase your personal data, but to restrict the use of data; (iii) in case the data controller no longer needs your personal data for the above-mentioned purposes, but you are requiring the data for establishing, exercising or defending a legal claim or (iv) you have objected to processing pending the verification whether the legitimate grounds of the data controller override those of the data subject;
d) The right to withdraw your consent for processing, when the processing is based on consent, without affecting the lawfulness of processing undertaken until that moment;
e) The right to object to the data processing on grounds relating to your particular situation, when the processing is based on legitimate interest and to object at any moment to the data processing for direct marketing purposes, including profiling;
f) The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly affects the data subject in a significant manner;
g) The right to data portability, meaning the right to receive your personal data, which you provided to the data controller in a structured, commonly used and machine-readable format and the right to transfer those data to another controller, if the processing is based on your consent or the performance of a contract and is undertaken by using automatic means;
h) The right to file a complaint with the Data Protection Authority (ANSPDCP) and the right to address to the competent courts of law.
The above rights may be exercised at any time. For the purpose of exercising these rights, we encourage you to use the forms available on the Law Firm’s website or send a notice in writing, dated and signed or in electronic format, to the address indicated below. Also, if you wish to withdraw your consent, you may send an e-mail to the address indicated in Section VII, or submit a written request in physical format or by mail to the Law Firm’s headquarters.
VII. CONTACT DETAILS
You may address any question using the following contact details:
Societatea Civila de Avocati FILIP, postal address: 2 Gara Herastrau Street, Equilibrium Building, 11th Floor, District 2, Bucharest, Romania, telephone: Alexandra Tugui – +40 21 527 2085, e-mail address: privacy@filipandcompany.com .
VIII. CHANGES TO THIS PRIVACY POLICY
This Privacy Policy may be changed and updated from time to time by the Law Firm, as necessary. The Law Firm will notify you of any material or substantial changes to this Privacy Policy and will ensure that such notification is made in such a way as to enable you to become aware of such changes, for example by publishing on the Law Firm’s website or by any other appropriate means ensuring an effective communication.