Privacy Policy

Grigorescu, Ștefănică și Asociații SPARL ("bpv Grigorescu Ștefănică", the "Company", or "we") is a limited liability law firm, organised and operating in accordance with applicable Romanian legislation and registered with the Bucharest Bar Association.

This Privacy policy on the processing of personal data (the "Privacy policy") is intended to inform data subjects about the manner in which bpv Grigorescu Ștefănică collects, uses, discloses, stores and protects personal data in connection with the activities carried out through its website, as well as in the course of providing the services described in this document.

As part of its activities, bpv Grigorescu Ștefănică processes personal data in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), as well as any other applicable legal provisions in this area.

In the course of its data processing activities, as well as for the purposes set forth below, the Company does not use automated individual decision-making, including profiling, within the meaning of Article 22 of the GDPR. The Company will not process your personal data for purposes incompatible with those described in this Privacy policy, except where such processing is required or permitted by law or is carried out with your prior consent, where required under applicable legal provisions.

bpv Grigorescu Ștefănică is the data controller within the meaning of the GDPR and the owner of the website accessible at the following web address: www.bpv-grigorescu.com (the "Website").

As part of our activities, we provide legal assistance and representation services and carry out professional information and communication activities for our clients, business partners and business contacts. These activities include sending newsletters, legal alerts and other informational materials ("Professional communications"), as well as the organisation of events, conferences, seminars, webinars and other professional meetings.

A. Personal data processed

In the context of the contractual relationship with our clients, we may collect the following categories of personal data:

• identification data, such as first name, surname, academic title, professional title or position, place of employment;
• a copy of your identity document, where applicable;
• contact details, such as your business or, where applicable, personal residential address, e-mail address, telephone number;
• bank account details and other financial information necessary for the performance of the contractual relationship, where applicable;
• tax identification number, and, in the case of natural persons, the personal identification number (CNP);
• data that you provide to us or that we collect as part of our client due diligence process and in order to comply with our legal obligations relating to anti-money laundering and counter-terrorist financing;
• IP address, log-in details and other technical information indicating how you use our Website;
• any other data and information you provide to us in the context of our professional interactions, including in connection with the performance of the mandate entrusted to us, the legal services requested or the scope of work set forth in our engagement documents, through correspondence, telephone calls, e-mail or any other means of communication used in the relationship with us.

B. How we collect personal data

We collect, directly from you, only the personal data that you voluntarily provide to us (in physical, verbal, or electronic format), as follows:

• during client-lawyer interactions conducted under a legal services agreement;
• through the systems and applications used by bpv Grigorescu Ștefănică, including by completing the Client Data Form and subscribing to our newsletter;
• when you contact us by e-mail, telephone or post, if you express your interest in our services;
• in the context of meeting at business events or similar occasions (e.g. through the exchange of business cards).

We may also collect your data indirectly, to the extent permitted by law and only when necessary for the conduct of our professional activities, as follows:

• from publicly available sources, such as public registers, public authority portals, official databases, official publications, professional platforms or websites of relevant companies and organisations, or professional networking platforms (e.g. LinkedIn);
• in connection with your use of our Website, including through cookies and similar technologies, in accordance with our Cookie Policy;
• through referrals or introductions made by clients, business partners, professional collaborators or other individuals with whom we maintain professional relationships, including your employees;
• in the context of conducting compliance checks, client due diligence, anti-money laundering verifications, conflict of interest verifications or fulfilling other applicable legal and professional obligations.

C. Legal grounds and purposes of processing

The processing of personal data is carried out for the purpose of performing the legal services agreement entered into with you or with the organisation you represent, to fulfil the legal obligations applicable to bpv Grigorescu Ștefănică, and, where applicable, based on our legitimate interest in practising law and providing the requested legal services. In this context, we process the data necessary to carry out our professional activities and fulfill the mandate entrusted to us, in accordance with the contractual provisions and the legal provisions applicable to the organization and practice of the legal profession, including Law No. 51/1995 on the organization and practice of the legal profession and the Statute of the legal profession approved by the National Union of Bar Associations of Romania.

The processing of personal data in this context is carried out, as appropriate, for the purpose of:

• entering into and performing the legal services agreement;
• providing the legal services requested;
• fulfilling the legal and professional obligations applicable to bpv Grigorescu Ștefănică, such as conducting conflict of interest verifications, client due diligence and anti-money laundering verifications;
• the establishment, exercise or defence of legal claims;
• managing the contractual and administrative relationship with our clients.

The same principles apply to personal data collected in the period leading up to the conclusion of a contract with us, including through our online form (Client Data Form), regardless of whether the discussions and negotiations led to the conclusion of a contract or not. Please note that the information you have provided to us, as well as your personal data, remains protected by the confidentiality applicable to client-attorney communications, even if you have not entered into a contract with us.

A. Personal data processed

In order to manage our contractual relationship with our suppliers and/or business partners, we may collect the following categories of data:

• identification data, such as your first name, surname, academic title, professional title or position, place of employment;
• a copy of your identity document, where applicable;
• contact details, such as your business or, where applicable, personal residential address, e-mail address, telephone number;
• bank account details and other financial information necessary for the performance of the contractual relationship, where applicable;
• any other data you provide to us during our interactions, both verbally and through written correspondence.

B. How we collect personal data

We collect, directly from you, only those personal data that you voluntarily provide to us (in physical, verbal, or electronic format), as follows:

• when you contact us by email, phone, or mail, if you are interested in becoming our supplier or business partner;
• in the context of meeting at business events or similar occasions (e.g. through the exchange of business cards).

We may also collect your data indirectly, to the extent permitted by law and only when necessary for the conduct of the professional relationship, as follows:

• from publicly available sources, such as public registers, public authority portals, official databases, official publications, professional platforms or websites of relevant companies and organisations, or professional networking platforms (e.g. LinkedIn);
• through referrals or introductions made by clients, business partners, professional collaborators or other individuals with whom we maintain professional relationships, including your employees;
• in connection with your use of our Website, including through cookies and similar technologies, in accordance with our Cookie Policy.

C. Legal grounds and purposes of processing

The processing of personal data is carried out for the purpose of performing the agreement entered into with you or with the organisation you represent, to fulfill the legal obligations applicable to bpv Grigorescu Ștefănică and, where applicable, based on our legitimate interest in managing the contractual relationship and ensuring the exercise of rights and fulfilment of obligations arising from the agreements concluded with you, in your capacity as supplier and/or business partner.

Furthermore, with regard to the conduct of financial and accounting operations, we process your personal data on the basis of our legal obligations to ensure compliance with the applicable financial and tax legislation.

A. Personal data processed

In this context, the personal data processed may include:

• identification data, such as your first name, surname, place of employment, practice area or field of activity, employer;
• contact details, such as e-mail address and telephone number;
• data regarding participation in events organised by us, including confirmation of attendance, attendance history and preferences expressed in connection with conferences, seminars, webinars, workshops or other professional events;
• technical data and information regarding your interaction with our Professional communications, such as confirmation of e-mail opens, access to shared materials and communication preferences;
• data regarding interactions, including your responses generated by selecting from predefined answers to any question or by providing feedback in the forms we send you, as well as those resulting from any other comments and messages addressed to us;
• photographs and/or video recordings taken during events organised by us, in accordance with applicable legislation;
• voice (where applicable, in the case of a recorded webinar/event);
• data regarding special requirements and preferences;
• any other data you provide to us during our interactions, regardless of the channel or means by which the interaction takes place.

B. How we collect personal data

We collect only the personal data that you voluntarily provide to us, either verbally or in writing (in physical or electronic format), including by e-mail, telephone, post, registration forms, meetings and other professional interactions, in the context of your relationship with bpv Grigorescu Ștefănică, your access to the Website, your subscription to our Professional communications, your expression of interest in the services, publications or events organised or hosted by us (including conferences, seminars, webinars and other professional events), as well as during your participation in these, including through feedback, requests, observations or other information communicated during our professional interactions or available from relevant public sources, for the purpose of managing the professional relationship and continuously evaluating and improving our professional services and activities.

C. Legal grounds and purposes of processing

We process personal data for the following purposes and on the basis of the following legal grounds:

(i) Providing Professional communications

We process your personal data to send newsletters, legal alerts, publications, event invitations and other Professional communications relevant to your field of activity. This processing is carried out:

• based on your consent, when you subscribe directly to our communications through the Website or through other direct requests (for example, by filling out the registration form for an event organised by us); or
• based on our legitimate interests in maintaining and developing professional relationships with clients, business partners and other professional contacts, when you are our client, have contacted us for professional purposes or have expressed interest in our activities and events.

You may withdraw your consent or opt out of receiving these Professional communications at any time, by using the unsubscribe option or by contacting us.

(ii) Organising and conducting professional events

We process your personal data to organise, manage and conduct conferences, seminars, workshops, webinars and other professional events that we organise or host, including to manage registrations, communicate with participants and handle the logistics of the events. This processing is carried out:

• based on our legitimate interests in organising and promoting professional events and managing relationships with our participants and our professional partners.

(iii) Taking and using photo and video materials at events

During events organised or hosted by us, we may take photographs and/or video materials which may be used by us for promotional purposes, including publication on our Website and the Company’s official social media pages (e.g. LinkedIn, Facebook). The photographs and/or video materials are processed on the basis of our legitimate interest in documenting and promoting the professional activities and events organised.

If you do not wish to appear in visual materials produced, please inform us in advance at news@bpv-grigorescu.com or inform the organising team before the event begins.

(iv) Management of webinar participation and security

For webinars organised or hosted by us, we process certain personal data to manage participation, maintain records of participants and ensure the security and integrity of the platforms used. This processing is based on our legitimate interest in organising and conducting online events under appropriate conditions and in preventing security incidents.

(v) Recording of webinars and processing participants’ voice or image

If a webinar is recorded, we may process the voice and/or image of participants who use the audio or video functions of the platform. This processing is carried out exclusively based on your consent, which you express by enabling the audio and/or video features during the webinar. You have the option to participate with these features disabled if you do not wish for this data to be processed.

(vi) Evaluation and improvement of services and professional interactions

We may process data resulting from feedback, requests, observations, responses to questionnaires or other professional interactions with you, for the purpose of evaluating and continuously improving our legal services, professional standards and the experience we provide to our clients and partners. This processing is carried out based on our legitimate interests in improving the quality of our services, internal processes and the manner in which professional relationships are managed.

A. Personal data processed

You may apply for a position at bpv Grigorescu Ștefănică through our Website, by accessing the "Careers" section and submitting your CV to the indicated e-mail address. In this context, we will process exclusively the personal data necessary to conduct the recruitment process and evaluate your application, namely:

• identification data, such as your first name, surname, e-mail address, telephone number and postal address, any other data you provide to us through your application documents;
• data included in the CV and cover letter submitted by you (including education, professional experience, hobbies);
• any other data you voluntarily provide to us during our interactions.

B. How we collect personal data

We collect, directly from you, only the personal data that you voluntarily provide to us, as well as information available from public sources (for example, professional networks such as LinkedIn), when you contact us by e-mail, telephone or post, if you express your interest in being hired by us or in collaborating with us.

C. Legal grounds and purposes of processing

We collect the information necessary as part of the recruitment process, in order to assess whether you are suitable for a position at bpv Grigorescu Ștefănică, as well as to take the necessary steps to enter into a contract with you. Specifically, your data is processed for the following specific purposes:

• to assess whether you are suitable for a position at bpv Grigorescu Ștefănică or for an internship;
• to contact you regarding your application;
• to manage the recruitment process or the selection process for the internship;
• to contact you regarding positions that become available in the future or for future internships for which we believe you have the appropriate professional profile; and
• to keep records of any previous recruitment or selection processes for an internship in which you participated and the reasons why you were not offered a position or why the offer was declined, including the reasons why you were rejected for the internship.

If your application is not selected during the recruitment process or the internship evaluation, we may contact you at a later date to inform you about other career opportunities and/or internships available at bpv Grigorescu Ștefănică and to invite you to participate in other interviews or evaluation processes, solely based on your consent expressed for this purpose.

We may also keep records regarding candidates' participation in the recruitment and selection process, including information regarding the outcome of the application evaluation or the reasons why an offer was not made or accepted, based on our legitimate interest in documenting the conduct of the recruitment process and in being able to manage any requests, complaints, or legal disputes related to it.

A. Personal data processed

If you visit our office, we may collect the following personal data:

• identification data, such as your full name;
• details regarding the purpose of the visit, time of arrival and time of departure;
• video footage of access to our premises;
• any other data you provide to us during our interactions.

B. How we collect personal data

We collect your personal data directly from you upon your arrival at our premises. In addition, you may be recorded by our video surveillance system installed in the monitored areas (e.g. entry-exit access area), which are appropriately marked.

C. Legal grounds and purposes of processing

The collection of your personal data is strictly limited to what is necessary to ensure security at bpv Grigorescu Ștefănică, by maintaining visitor records and through video surveillance of the areas that are appropriately marked. Any processing of your data for the aforementioned purpose is based, as the legal ground, on the legitimate interest in ensuring the security of our property and personnel.

Your personal data will be retained only for the period necessary to fulfil the purposes for which it was collected. Data processed for the purpose of sending Professional communications will generally be retained for a period of 2 years from the date of subscription or from the last relevant interaction with us, after which we may request you to reconfirm your interest or renew your consent to continue receiving them. If you withdraw your consent or exercise your right to object, we will cease processing your data for this purpose.

Data regarding candidates participating in recruitment or selection processes for internships may be retained for up to 1 year after the completion of the recruitment process, including for the purpose of managing future career opportunities, provided that the data subject has given their consent to this effect.

Images captured through video surveillance systems are generally retained for a maximum period of 30 days, except in cases where the law or justified circumstances require a longer retention period.

Upon expiration of the applicable retention periods or when the data is no longer necessary for the purposes for which it was collected, it will be deleted or anonymized, except in cases where its retention is necessary to comply with legal obligations or to exercise or defend legitimate rights.

As a general rule, we do not share with or transfer your personal data to third parties, except where this is necessary to fulfil our professional or legal obligations or to provide our services. In such circumstances, disclosure is carried out in accordance with applicable legislation and in compliance with confidentiality and professional secrecy obligations. Your personal data may also be accessed within bpv Grigorescu Ștefănică exclusively by individuals who need this information to perform their professional duties and for the purposes described in this Privacy policy.

For certain activities, we may use service providers acting as data processors, such as providers of IT services, contact management solutions, accounting or event planning services. These providers will process the data exclusively based on our instructions and pursuant to agreements that ensure an adequate level of personal data protection.

bpv Grigorescu Ștefănică places great importance on the security, integrity and confidentiality of your personal data and implements appropriate technical and organisational measures, in accordance with Article 32 of the GDPR, to protect it against unauthorised access, use, loss, disclosure or destruction.

In accordance with the applicable provisions regarding personal data, we inform you that you have the following rights, which may be exercised by submitting a request using the contact details provided below:

• the right to be informed about the personal data stored and the right to access the data being processed (Articles 14 and 15 of the GDPR);
• the right to request the rectification of your personal data (Article 16 of the GDPR);
• the right to request the erasure of personal data (Article 17 of the GDPR);
• the right to request the restriction of processing (Article 18 of the GDPR);
• the right to object to the processing of your personal data, including automated decisions based on such processing (Article 21 of the GDPR);
• the right not to be subject to automated individual decision-making, including profiling (Article 22 of the GDPR);
• the right to data portability (Article 20 of the GDPR);
• the right to file a complaint with the National Supervisory Authority for Personal Data Processing - located at 28-30 Blvd. Gheorghe Magheru, Bucharest, Romania, or via the website www.dataprotection.ro, and to refer the competent courts.

The exercise of certain rights provided for by the GDPR may be limited when data processing is necessary to comply with legal obligations applicable to the Company. In this regard, the right to erasure, the right to data portability and the right to object may not be applicable in the case of processing carried out pursuant to a legal obligation or requirements specific to the Company's business.

Should you have any questions related to the processing of your personal data or if you would like to submit a request, as well as to exercise any of the rights on the processing of personal data, please contact us at:

• e-mail address: data.protection@bpv-grigorescu.com
• telephone: +40212641650
• registered office: 33 Dionisie Lupu Street, District 2, Bucharest, Romania.

We will review each request and notify you with regard to the undertaken actions in the shortest possible time, but no later than 1 (one) month since the registration of your request. Should we require more information from you or experience difficulties in the settlement of your request, we shall notify you without delay with regard to the fact that we need additional time to perform a proper review of your request.

Should you consider that we have failed to settle all your requests or are discontent with our answers, you may file a petition with the National Supervisory Authority for Personal Data Processing. You may also refer to the courts of law.

If we decide to amend this Privacy policy, we will publish the new version on our website, which will supersede the current version.

Thank you for trusting us with your personal data and for finding the necessary time to read our Privacy policy. Please feel free to contact us if you have any questions related to your personal data and our processing of your personal data.