Privacy Policy

Last updated: 6 September 2026

1. About this Privacy Policy

Dincescu A. Christofor – Cabinet de avocat (the “Law office”, “we”, “us” or “our”) is an individual law office established and operating in accordance with Romanian law governing the legal profession and registered with the Bucharest Bar.

The law office has its registered address at 48 Arad St., ground floor, Sector 1, Bucharest, Romania and fiscal identification number 48570537.

For the purposes of Regulation (EU) 2016/679 (the “GDPR”), the law office acts as a data controller in respect of the personal data described in this Privacy Policy.

This Privacy Policy explains how we collect, use, disclose, retain and otherwise process personal data in connection with our website (the “Website”), our professional activities, communications with clients and other business contacts, recruitment and marketing activities.

Our processing of personal data is carried out in accordance with the GDPR, Romanian Law no. 190/2018 on measures for the implementation of the GDPR, Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, as amended, and other applicable legislation.

2. Whose personal data we may process

Depending on your relationship with the law office, we may process personal data relating to:

visitors to the Website;
existing, former and prospective clients;
directors, officers, employees, representatives, beneficial owners and other persons associated with corporate clients or prospective clients;
counterparties and other persons involved in matters on which we provide legal assistance;
lawyers, consultants, experts, service providers and other professional contacts;
representatives of public authorities, regulatory bodies, courts and other institutions;
persons who attend or are invited to professional or business events;
persons who receive or have expressed an interest in receiving information from us; and
job applicants and prospective collaborators.

3. Personal data we may collect

The categories of personal data we process depend upon the nature of our relationship with you and may include:

identification data, such as your name, surname, position or professional capacity;
contact information, such as your postal address, email address and telephone number;
professional information, including your employer, position, professional qualifications and professional experience;
client and matter information, including information supplied to us in connection with a request for legal assistance or the performance of legal services;
billing and financial information, where relevant to our relationship with you;
communications, including correspondence by email, telephone, contact forms or other means;
marketing and communication preferences, including any consent, objection or unsubscribe request;
event information, such as invitations, registrations, attendance confirmations and relevant preferences;
recruitment information, such as information contained in CVs, applications, cover letters and related correspondence;
technical and Website usage data, such as IP address, browser type, device information, operating system, access date and time, referring pages and other information contained in technical or security logs; and
information collected through cookies and similar technologies, where applicable.

We seek to collect only personal data that is adequate, relevant and reasonably necessary for the purposes for which it is processed.

4. How we obtain personal data

We may obtain personal data:

directly from you, including where you contact us, submit a form, instruct us, attend an event or apply for a position;
from our clients, prospective clients or other persons involved in a legal matter;
from counterparties, advisers, courts, public authorities or regulatory bodies;
from publicly accessible sources, including public registers, professional directories and publicly available professional information;
from business contacts or professional networks; and
automatically through the Website and its underlying technical infrastructure.

Where personal data has not been obtained directly from you, we will provide the information required under Article 14 GDPR where and to the extent required by applicable law.

5. Why we process your personal data

We process personal data only where we have a lawful basis for doing so.

Website operation and security

We may process technical information relating to your access to and use of the Website for the purposes of:

operating and maintaining the Website;
ensuring its security and integrity;
preventing misuse, fraud or malicious activity;
diagnosing technical problems; and
obtaining aggregated information concerning the operation and use of the Website.

Where such processing involves personal data, it is generally based on our legitimate interest in operating and protecting the Website, pursuant to Article 6(1)(f) GDPR.

Where cookies or similar technologies require your prior consent, they will be used only in accordance with the applicable consent requirements described below.

Enquiries and requests for legal services

Where you contact us regarding possible legal assistance, we may process your identification, contact and matter-related information in order to:

respond to your enquiry;
assess whether and how we may assist you;
conduct any necessary conflict-of-interest checks;
prepare a proposal or engagement documentation; and
take other steps requested by you before entering into a professional relationship.

Depending on the circumstances, such processing is based on the taking of steps at your request prior to entering into a contract, pursuant to Article 6(1)(b) GDPR, compliance with applicable legal or professional obligations pursuant to Article 6(1)(c) GDPR, and/or our legitimate interests, pursuant to Article 6(1)(f) GDPR.

Where you contact us on behalf of a company or other organisation, processing of your professional contact information will generally be based on our legitimate interest in communicating with and providing services to that organisation.

Provision of legal services and client administration

Where the law office is engaged to provide legal services, we may process personal data insofar as necessary to:

provide legal advice and representation;
communicate with clients and other persons involved in a matter;
manage and administer client matters;
conduct conflict-of-interest and compliance checks;
issue invoices and administer payments;
maintain our professional records;
establish, exercise or defend legal claims; and
comply with legal, regulatory, accounting, tax and professional obligations applicable to the Firm.

Depending on the circumstances, processing is based on Article 6(1)(b), (c) and/or (f) GDPR.

Professional and business relationship management

We may maintain contact information relating to clients, former clients, prospective clients and other professional contacts in our contact-management or CRM systems in order to maintain professional relationships, manage communications and organise business-development activities.

Where appropriate, such processing is based on our legitimate interests under Article 6(1)(f) GDPR in maintaining professional and business relationships.

Events and professional communications

We may process your contact details and event-related information in order to invite you to, organise or administer professional events, seminars or similar activities.

Depending on the circumstances, such processing may be based on your consent, our legitimate interests or the steps necessary to provide an event or service requested by you.

Compliance with legal and professional obligations

We may process personal data where necessary to comply with obligations imposed upon us by law or by the rules governing the legal profession, including, where applicable:

professional conflict-of-interest requirements;
tax and accounting obligations;
anti-money laundering and client-identification requirements;
obligations imposed by competent courts, public authorities or regulatory bodies; and
requirements relating to the establishment, exercise or defence of legal claims.

Such processing is generally based on Article 6(1)(c) GDPR and, where appropriate, Article 6(1)(f) GDPR.

6. Special categories of personal data and criminal-offence data

Certain information is afforded additional protection under the GDPR. This includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, as well as genetic data, biometric data used for identification, health data and data concerning a person's sex life or sexual orientation.

We do not seek to collect such information through the Website unless it is relevant and necessary for a specific purpose.

However, given the nature of legal services, clients or other persons may provide us with special-category personal data where such information is relevant to a legal matter.

Where such information is processed in connection with legal services or legal proceedings, we may process it where necessary for the establishment, exercise or defence of legal claims, in accordance with Article 9(2)(f) GDPR, or on another applicable legal basis under Article 9 GDPR.

We may likewise process personal data relating to criminal convictions and offences where this is necessary and lawful in connection with the provision of legal services, compliance with legal obligations or the establishment, exercise or defence of legal claims, in accordance with Article 10 GDPR and applicable Romanian law.

Please avoid submitting sensitive personal information through general Website contact forms unless it is absolutely necessary for us to understand or respond to your enquiry.

7. Direct marketing

We may occasionally provide clients and professional contacts with information concerning legal developments, office activities, publications, events or services which we believe may be professionally relevant to them.

Electronic commercial communications, including marketing emails or similar electronic communications, will only be sent where permitted under applicable law.

Where prior consent is required under art. 12 of Romanian Law no. 506/2004, we will request such consent before sending the relevant communications.

Where we have obtained your email address directly in connection with services previously supplied to you, we may, to the extent permitted by Article 12(2) of Law no. 506/2004, send communications concerning our own similar services, provided that you were given a clear and free opportunity to object when your email address was collected and in each subsequent communication.

Where personal data is processed for direct marketing on the basis of our legitimate interests, you have the absolute right to object at any time to the processing of your personal data for direct-marketing purposes.

You may withdraw your consent or unsubscribe from marketing communications at any time by using the unsubscribe facility contained in the relevant communication, where available, or by contacting us at christofor@dincescu-law.eu.

Following an opt-out request, we may retain limited information on a suppression list insofar as necessary to ensure that your preference continues to be respected.

8. Cookies and similar technologies

The Website may use cookies and similar technologies.

Some cookies may be strictly necessary for the proper technical operation or security of the Website. Other cookies, including certain analytics, functionality or advertising technologies, may not be necessary for the provision of the Website.

Where Romanian Law no. 506/2004 requires consent for the storage of information on, or access to information stored on, your device, such technologies will not be activated until the required consent has been obtained.

Where consent is required, you may accept, refuse or manage the relevant categories of cookies through the Website's cookie-management mechanism. Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.

Further details regarding the cookies and similar technologies actually used by the Website, their providers, purposes and duration should be provided in our Cookie Policy and/or cookie-preference centre.

9. Who may receive your personal data

Access to personal data within the law office is limited to persons who require such access for legitimate professional or administrative purposes.

Depending on the circumstances, we may disclose personal data to:

lawyers, employees, collaborators and other persons working with or on behalf of the Firm;
providers of hosting, email, information technology, cybersecurity, document-management, CRM or other technical services;
accountants, auditors, banks, insurers and other professional or administrative service providers;
couriers, translators, experts, consultants, co-counsel or other providers engaged where necessary in connection with a legal matter;
event or communication service providers;
courts, arbitral tribunals, public authorities, regulatory authorities or other competent bodies;
counterparties, their advisers and other persons where disclosure is necessary in connection with legal services; and
other recipients where disclosure has been requested or authorised by you or is otherwise permitted or required by law.

Where a third party processes personal data on our behalf as a processor, we require the processing to be governed by appropriate contractual and data-protection safeguards in accordance with Article 28 GDPR.

Certain recipients may act as independent data controllers in respect of the information disclosed to them.

The Law Office does not disclose personal data to third parties for purposes unrelated to those described in this Privacy Policy unless such disclosure is authorised by you or otherwise permitted or required by law.

10. International transfers

Some of the technical or professional service providers used by the Law Office may process personal data in countries outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we take appropriate measures to ensure that the transfer complies with Chapter V of the GDPR.

Depending on the circumstances, such transfers may be based on:

an adequacy decision adopted by the European Commission;
standard contractual clauses approved by the European Commission;
another legally recognised transfer mechanism; or
a specific derogation permitted by the GDPR.

Where required, supplementary technical, contractual or organisational safeguards may also be implemented.

You may contact us if you require further information concerning the safeguards applicable to a particular international transfer.

11. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and thereafter only insofar as necessary to comply with applicable legal or professional obligations, resolve disputes or establish, exercise or defend legal claims.

The relevant retention period therefore depends on the nature of the information and the purpose of the processing.

In particular:

information relating to client matters will be retained in accordance with applicable legal, tax, accounting and professional record-retention requirements;
information relating to enquiries that do not result in an engagement will be retained only for so long as reasonably necessary for handling the enquiry, conflict management and the protection of legitimate legal interests;
personal data maintained exclusively for CRM or professional-marketing purposes will be periodically reviewed and, as a general rule, contact records that have not been meaningfully used or updated for 18 months will be deleted or anonymised unless there is a valid reason for their continued retention;
records necessary to document consent, objections or marketing opt-outs may be retained for so long as necessary to demonstrate compliance and respect the relevant preference;
recruitment information will be retained in accordance with Section 15 below; and
cookies and similar technologies will be retained for the periods specified in the relevant Cookie Policy or cookie-preference centre.

Where information is no longer required, it will be deleted, anonymised or otherwise securely disposed of, subject to any applicable retention obligation.

12. Security and professional confidentiality

We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures are selected taking account of the nature of the data, the purposes of processing and the risks associated with the processing.

Persons working within or on behalf of the Firm who have access to personal data are subject to appropriate duties of confidentiality.

In addition to data-protection obligations, information received by lawyers in the exercise of their profession is subject, where applicable, to the statutory and professional rules concerning professional secrecy and lawyer-client confidentiality.

No electronic system can, however, be guaranteed to be completely secure. We therefore continually assess and adapt our measures as appropriate to the nature and risks of our processing activities.

13. Your rights

Subject to the conditions and limitations established by the GDPR and applicable law, you may have the following rights in relation to your personal data:

Right of access – to obtain confirmation as to whether we process personal data concerning you and, where applicable, access to that data and the information required by Article 15 GDPR;
Right to rectification – to have inaccurate personal data corrected and incomplete information completed;
Right to erasure – to request deletion of personal data in the circumstances set out in Article 17 GDPR;
Right to restriction of processing – to request that processing be restricted in the circumstances set out in Article 18 GDPR;
Right to data portability – where processing is based on consent or contract and carried out by automated means, to receive relevant personal data in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller;
Right to object – to object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR;
Right to object to direct marketing – to object at any time to processing of your personal data for direct-marketing purposes;
Right to withdraw consent – where processing is based on consent, to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal; and
Rights concerning automated decision-making – to the extent applicable, not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, subject to the exceptions provided by Article 22 GDPR.

The Office does not currently undertake solely automated decision-making of this nature in connection with the Website or its ordinary provision of legal services.

These rights are not absolute and may be subject to statutory exemptions, restrictions, the rights and freedoms of other persons and applicable obligations of professional secrecy.

To exercise any of these rights, please contact us at christofor@dincescu-law.eu or at our registered office.

We may request information reasonably necessary to verify your identity before acting upon a request.

14. Complaints

If you have any concerns regarding the manner in which we process your personal data, we encourage you to contact us first so that we may investigate and respond to your concerns.

This does not affect your right under Article 77 GDPR to lodge a complaint with the competent supervisory authority.

In Romania, the competent authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal – ANSPDCP
28–30 General Gheorghe Magheru Boulevard Sector 1, 010336 Bucharest Romania

You also have the right, where applicable, to seek a judicial remedy in accordance with Articles 78 and 79 GDPR.

15. Recruitment

Where you submit a CV, cover letter or other information in connection with an application for employment, traineeship or professional collaboration with the Office, we may process information including:

your name and contact details;
educational and professional qualifications;
employment and professional history;
language skills and other qualifications;
information contained in your CV, cover letter or application;
correspondence concerning the recruitment process; and
other information which you voluntarily provide and which is relevant to the recruitment process.

Such information is processed principally for the purpose of considering your application, communicating with you and taking steps at your request before potentially entering into an employment or professional relationship, pursuant to Article 6(1)(b) GDPR.

We may also process limited recruitment information where necessary for our legitimate interests in administering and documenting the recruitment process and establishing, exercising or defending legal claims, pursuant to Article 6(1)(f) GDPR.

Please do not include special-category personal data or other sensitive information in your application unless it is genuinely relevant and necessary.

Information relating to an unsuccessful application will be retained only for a reasonable period after completion of the relevant recruitment process, taking into account applicable legal requirements and the need to establish, exercise or defend potential legal claims.

If we wish to retain your application for consideration in connection with future recruitment opportunities beyond the relevant recruitment process, we may request your consent for a specified additional retention period. You may withdraw that consent at any time.

16. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time to reflect changes in our processing activities, the Website, applicable law or regulatory guidance.

The current version will be made available on the Website and the date of the most recent revision will appear at the beginning of the Policy.

Where changes materially affect the manner in which we process personal data, we will take appropriate steps to bring those changes to the attention of affected persons where required by law.

17. Contact

If you have any questions concerning this Privacy Policy, the manner in which we process personal data or the exercise of your data-protection rights, you may contact us at the address further below.