Privacy policy
INTRODUCTION
Buju Stanciu & Associates („Buju Stanciu & Associates”), namely SCA Buju Stanciu & Asociații, having tax identification number 38588731, with its registered office at Str. Belgrad 10, Sector 1, Postal Code 011804, Bucharest, Romania, acting as data controller, as the case may be, we hereby provide you with this Privacy policy of Buju Stanciu & Associates (hereinafter referred to as the “Privacy policy”), in order to give you an overview of our practices regarding the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data (hereinafter referred to as the “Processing”).
CATEGORIES OF PERSONAL DATA
For the purposes of the Processing set out below, we process your personal data, hereinafter referred to as “Personal data”.
Personal data will include, as the case may be, both your personal information and the special categories of personal data, as defined below. “Personal information” means: first name and surname, date and place of birth, job title and the name of the company/entity you belong to, postal address, including home address, business address, telephone number, mobile telephone number, fax number and e-mail address and other similar details about you, payments made, requests and matters, information collected from public sources and databases, information on relevant and material litigation or other court proceedings brought against you or by you, against a third party affiliated with you, IP address, other personal data concerning your preferences which may prove relevant for any purposes relating to the provision of our services, details and information about your visits to our offices, as well as other data relating to your interaction with us.
In addition, in the course of our activities, we may process the following special categories of personal data about you, such as: the series and number of your Identity Card, data concerning your political opinions, health data, data concerning trade union membership and data concerning criminal convictions and offences.
We collect your Personal data directly from you in certain circumstances, including:
· When you request legal, tax or insolvency advice or representation from us;
· When you browse, request information or interact on our website;
· When you provide or offer to provide services to us;
· When you voluntarily communicate your Personal data to us, for any reason.
In certain circumstances, we collect Personal data about you from a third-party source. For example, we may collect Personal data from your employer, other companies or individuals with whom you have connections, government agencies, credit bureaux, information or service providers or from public records.
PURPOSES OF THE PROCESSING
We process your Personal data to the extent permitted or required by applicable law for the following purposes:
· Communicating with you in order to keep you informed at all times of the progress of the service requested, analysing and improving our services and communications to you, providing legal advice, including tax and insolvency advice, or other services and any other steps you may have requested, including legal representation before the courts, arbitral tribunals or other competent authorities;
· Managing and administering the business relationship between you and Buju Stanciu & Associates, including payment processing, accounting, auditing, invoicing and collection, and support services;
· Complying with our legal obligations (such as record-keeping obligations), compliance verification or registration obligations (such as under trade sanctions and embargo legislation, antitrust legislation, for anti-money laundering purposes, financial screening and compliance, and for the purposes of preventing and detecting fraud and criminal offences), which may include automated screening of your Personal data against applicable sanctions lists and contacting you to confirm your identity in the event of a possible match, or recording our interaction with you where this may be relevant for compliance purposes;
· Protecting the security of and managing access to our premises, our IT and communications systems, online platforms, websites and other systems, and preventing and detecting security threats, fraud or other criminal activity;
· For the purposes of ensuring, monitoring and assessing compliance with our policies and standards, and identifying the persons authorised to transact on behalf of our clients, beneficiaries, suppliers and/or service providers;
· For the purpose of complying with court judgments and exercising and/or defending our legal rights; and
· For any purpose related and/or ancillary to any of the above.
As regards marketing communications, we will provide you with the relevant information, where legally required, only after you have opted in to receive such communications, and we will give you the opportunity to unsubscribe at any time should you no longer wish to receive marketing communications from us. We will not use your Personal Data to take automated decisions affecting you, nor to create profiles other than those described above.
THE BASIS FOR PROCESSING YOUR PERSONAL DATA
Any operation amounting to Processing of your Personal Data will be carried out on one or more of the following legal bases:
· Processing is based on your consent as the legal basis for collecting, storing and using your Personal Data, as permitted by applicable law;
· Processing is necessary for the performance of a contract to which you are a party, or such Processing is necessary in order to enter into a contract with you;
· Processing is necessary for compliance with a legal obligation;
· Processing is necessary in order to protect your vital interests or those of another natural person;
· Processing is necessary for the purposes of the legitimate interests of Buju Stanciu & Associates or of a third party, except where your fundamental interests, rights and freedoms override those interests. We use your Personal Data for our legitimate interests, namely to exercise our obligations and rights arising from a contract concluded with the company/entity you belong to, to improve our performance and working methods, and for administrative and fraud detection purposes.
Where applicable legal provisions require your prior, explicit consent for the Processing of special categories of personal data, we will process such data only on the basis of your prior, explicit consent.
You may choose to withdraw your consent to marketing materials at any time, simply by clicking the “unsubscribe” link at the foot of each newsletter or event invitation.
DATA TRANSFERS, RECIPIENTS AND THE LEGAL BASIS FOR SUCH TRANSFERS
In the course of our business, we may disclose your Personal Data to:
· Barristers and other legal professionals, including mediators, notaries public, bailiffs, consultants or experts involved in your matter, where disclosure of the data is required by the scope of work relating to your matter;
· Courts, law enforcement authorities, regulators, lawyers or other persons where reasonably necessary for the establishment, exercise or defence of a legal right, or for the purposes of an alternative dispute resolution procedure;
· Foreign law firms for the purpose of obtaining foreign legal advice, where such advice is required in order to handle the mandate entrusted to us by you or by the company you belong to;
· Companies providing anti-money laundering screening services, credit risk reduction services and other fraud and crime prevention services, and companies providing similar services, including financial institutions, credit bureaux and regulators with which such data is shared;
· Any third party to which we assign or novate any rights or obligations, in accordance with the law;
We may also disclose your Personal Data to our processors, mainly service providers within or outside Buju Stanciu & Associates, for the purpose of Processing Personal Data for the permitted purposes, on our behalf and strictly in accordance with our instructions. Buju Stanciu & Associates will retain control over your Personal Data and will apply appropriate safeguards, in accordance with applicable law, to ensure the integrity and security of your Personal Data in its dealings with such processors.
Otherwise, we will disclose your Personal Data only where you instruct or permit us to do so, or where we are required to do so by applicable law or by requests from judicial or official bodies..
We may transfer your Personal Data outside the country. Some recipients of your Personal Data may be located in countries for which the European Commission has not issued an adequacy decision on the level of data protection, namely: the United States of America or certain locations outside Europe.
Some recipients located outside the European Economic Area (“EEA”) are certified under the EU-US Privacy Shield framework, while others are located in countries for which the European Commission has issued adequacy decisions [Andorra, Argentina, Canada (for private organisations subject to the Canadian Personal Information Protection and Electronic Documents Act), Switzerland, the Faroe Islands, Guernsey, Israel, the Isle of Man, Jersey and New Zealand]. In each case, the transfer is recognised as affording an adequate level of data protection for the purposes of European data protection legislation (Art. 45 GDPR).
We may enter into data transfer agreements based on the Standard Contractual Clauses (European Commission Decision 2010/87/EU and/or European Commission Decision 2004/915/EC), pursuant to Art. 46 (5) GDPR, or by using other appropriate means, thereby ensuring that all other recipients located outside the EEA will provide an adequate level of data protection for the Personal Data, and that appropriate technical and organisational security measures are in place to protect the Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorised disclosure or access, and against all other unlawful forms of Processing.
THE SECURITY OF YOUR PERSONAL DATA
Buju Stanciu & Associates has implemented appropriate technical and organisational measures to preserve the confidentiality and security of your Personal Data, in accordance with our internal procedures on the storage, transfer and access of Personal Data. Personal Data may be held on our Personal Data technology systems or in printed form.
RETENTION PERIODS
The Personal Data processed for the purposes set out herein will be kept only for as long as necessary, for the duration of your relationship with Buju Stanciu & Associates as well as thereafter for the retention periods required by applicable law. Should legal proceedings be commenced, the Personal Data may be retained until the conclusion of those proceedings, including any appeal periods, and will then be deleted or archived in accordance with the provisions of applicable law.
As a rule, we will keep your Personal Data for as long as required or permitted by applicable law. Thereafter, upon expiry of those periods or upon your exercise of any of your rights in accordance with the law, we will remove/delete your Personal Data from our systems and records and/or take steps to anonymise it, so that you can no longer be identified from it.
YOUR LEGAL RIGHTS
If you have given your consent to the Processing activities, you may withdraw that consent at any time with future effect. Such withdrawal will not affect the lawfulness of the Processing carried out prior to the withdrawal of consent. As a general rule, where you withdraw your consent, Buju Stanciu & Associates will no longer allow the Processing of your Personal Data and will take the appropriate steps to delete any records containing your Personal Data. However, where the Processing is strictly necessary for the provision of the services of Buju Stanciu & Associates, and the Processing may be based on other legitimate grounds provided for by the applicable legal provisions, Buju Stanciu & Associates will carry out that Processing and will inform you accordingly.
Subject to the conditions laid down by applicable law, you have the following rights:
1. Right of access: You have the right to be informed, upon request, whether your Personal Data is being processed and, if so, to request access to it. The information includes, among other things, the purposes of the Processing, the categories of Personal Data concerned and the recipients or categories of recipients to whom your Personal Data has been or will be disclosed.
You have the right to obtain a copy of the Personal Data being processed. For further copies, we may charge you a reasonable fee based on administrative costs.
2. Right to rectification: You have the right to obtain from us the rectification of inaccurate Personal Data concerning you. Depending on the purpose of the Processing, you have the right to have incomplete Personal Data completed, including by means of a supplementary statement.
3. Right to erasure („the right to be forgotten”): You have the right to ask us to erase your Personal Data.
4. Right to restriction: You have the right to request the restriction of the Processing of your Personal Data. In that case, the data concerned will be marked and may be processed by us for certain purposes only.
5. Right to data portability: You have the right to receive the Personal Data you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit that data to another entity without objection from us.
6. Right to object:
You have the right to object, on grounds relating to your particular situation, at any time, to the Processing of your Personal Data by us, and we may be asked to stop processing your Personal Data. If you have the right to object and you exercise it, we will no longer process your Personal Data for that purpose. There is no cost for exercising this right.
This right may be overridden in particular where the Processing of your Personal Data is necessary for the formalities relating to the conclusion of a contract or for the performance of a contract already concluded.
You may exercise the rights set out above and find out more about those rights by submitting to us, as data controller, a written request to Buju Stanciu & Associates, at Str. Belgrad 10, Sector 1, Postal Code 011804, Bucharest, Romania, or by e-mail to office@bsa.ro.
You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing.
VERSIONS OF THIS PRIVACY POLICY
This Privacy Policy takes effect on 17 June 2024.
This Privacy Policy may be updated from time to time. Any update will become applicable as soon as the new version is published on the website of Buju Stanciu & Associates or as soon as it has been communicated to you in any other manner.