Your privacy is one of our fundamental commitments at SPA-LEX (together referred to as “SPA-LEX” or “we”).
Therefore, we take outmost care to process your personal data in accordance with the principles set forth in the data protection legislation applicable in Romania, including (EU) Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”). Personal data represents any information relating to an identified or identifiable natural person, and an identifiable person is that person that may be identified directly or indirectly, particularly by reference to an identification number or to one or more factors specific to its physical, psychological, mental, economic, cultural or social identity.
- the purposes for which we collect and use your personal data;
- the processing grounds for such purposes;
- the categories of personal data we collect from you and process;
- the duration of processing of such data;
- your rights as data subjects and the manner in which you may exercise them;
- to whom we may disclose your personal data;
PROVIDING THE PERSONAL DATA
When the data are required directly from you, SPA-LEX kindly asks you to provide all categories of personal data we request in the aforementioned purposes, as otherwise we shall not be able to carry out our activity (including, among others, to provide you with our services).
We shall collect your Personal data directly from you, in certain circumstances, including:
-When you request legal, tax, insolvency related consultancy or representation from our behalf;
-When you navigate, request information or interact on our website;
-When you render or offer yourself to render services for us;
-When you willingly communicate us, for any reason, your Personal data.
-In certain circumstances, we collect your Personal data from a third party source. For example, we can collect Personal data from your employer, other companies or individuals with which/whom you are connected, governmental agencies, credit bureaus, information or services providers or from public archives.
DISCLOSURE OF YOUR PERSONAL DATA
While as a rule we shall not disclose your personal data to any third parties, we may:
- disclose your contact details to our affiliates within AV_SSE, to our contractual partners and to our service providers (including data processors);
- if in your interest and necessary, disclose relevant personal data to courts of law and arbitration panels or relevant authorities, in the context of providing the services you have requested from us;
- disclose relevant personal data to the clients who provided your personal data in the context of providing the services requested from us, if it is necessary to fulfill these purposes;
- in the context of organizing events (including webinars) by or with the involvement of SPA-LEX we may:
DURATION OF PROCESSING
We intend to keep your personal data for the duration of the assistance agreement, as well as afterwards, according to our internal policies and the legal obligations incumbent upon us.
Right of access
Allows you to obtain confirmation that your personal data are being processed by us and, if affirmative, the relevant details of such processing activities.
Right to rectification
Allows you to rectify your personal data if inaccurate.
Right to erasure
Allows you to obtain the erasure of your personal data in certain cases (e.g., if the data are no longer necessary in relation to the purposes for which it was collected). Important! We will not be able to act on such requests in all cases, such as where the law compels us to keep data for a certain period, or where the data are necessary for a legitimate interest such as the defense of a right in court.
Right to restriction
Allows you to request us not to use your personal data in any way except to store it until another request from you is resolved, namely: (i) you have requested the rectification of the data; (ii) you have opposed the erasure of the data in the case of unlawful processing; (iii) you have required us to provide you with certain data for the defense of a right; (iv) you have objected to the data processing.
Right to object
Allows you to object to further processing of your personal data within the conditions and limits set forth by law. Important! The law compels us to act on such requests only for direct marketing processing (for example, if you receive emails with our informative notes, you can unsubscribe). In the other cases, we will balance our interests and your particular situation in order to make a final decision. Therefore, please explain why you object to the processing when making such a request.
Right to portability
Allows you to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format or to transmit this data to another data controller. Important! The law compels us to act on such requests only for the data previously processed based on your consent or on the performance of the contract concluded with us and only if the processing is carried out by automated means.
PURPOSES OF PROCESSING
We process of your Personal data to the extent allowed or required by the applicable law for the following purposes:
Communication with you, in order to permanently inform you about the development of the requested service, analysis and improvement of your services and communications to you, provision of legal consultancy, including tax and insolvency related consultancy or of other services and other measures which you could have requested, including legal representation before the courts of law, arbitral tribunals or other competent authorities;
Management and administration of the business relationship between you and SPA-LEX lawyers, including payments processing, accounting, audit, invoicing and collection, assistance services;
Compliance with our legal obligations (such as the obligations to keep records), obligations to review the compliance or to record (such as pursuant to the commercial sanctioning and embargo laws, antitrust laws, for fighting money laundering purposes, financial review and compliance, for purposes of preventing and identifying fraud and crimes), which may include automated checks of your Personal data against the applicable lists of persons subject to sanctions and your contacting to confirm your identity, in the event of a possible positive result, or registration of the interaction we had with you, which could be relevant for compliance purposes;
Protection of safety and management of the access to our headquarters, IT and communication systems, online platforms, websites and other systems, prevention and detection of security threats, frauds or other criminal activities;
To provide assurance, monitoring and assessment of the compliance with our policies and standards, in order to identify the persons authorised to perform transactions on behalf of our clients, our services beneficiaries, suppliers and/or providers;
To provide compliance with the court judgements and application and/or defence of our legal rights; and For any purpose related and/or additional to any of the above.
In respect of the marketing related communications, we will make available to you, if required by the law, such information only after you select this option to receive such communications and we will provide you the possibility to unsubscribe at any time, if you no longer want to receive marketing related communications from us. We will not use your Personal data when making automated decisions which may affect you or create profiles, other than those described above.
GROUNDS FOR YOUR PERSONAL DATA PROCESSING
Any operation which is the equivalent of a Processing of your Personal data shall be carried out based on one or several of the legal grounds described below:
- The Processing is based on your consent as legal ground for collecting, storing and using your Personal data, as allowed by the applicable law;
- The Processing is required for the performance of an agreement to which you are a part, or, such Processing is required for entering into an agreement with you;
- The Processing is required for the compliance with a legal obligation;
- The Processing is required to protect your vital interests or those of another individual;
- The Processing is required for the legitimate interests of SPA-LEX or of a third party, unless your interests and rights and freedoms prevail over such interests. We use your Personal data for our legitimate interests,namely, to exercise our obligations and rights deriving from an agreement concluded with your company/entity, in order to improve our performance and the working method and for administrative and fraud detection purposes.
If the applicable legal provisions required your prior and explicit consent for the Processing of some Special categories of personal data, we shall process such data only based on your prior and explicit consent.
You may choose to withdraw your consent in respect of the marketing materials at any time, simply by accessing the “unsubscribe” link in the foot note of every newsletter or invite to events.
DATA TRANSFERS, RECIPIENTS AND LEGAL GROUNDS FOR SUCH TRANSFERS
While performing our activity, we may send your Personal data to:
- Lawyers, other legal professionals, including mediators, notaries, bailiffs, consultants or experts involved in your case, if such data transmission is required due to the subject matter of your case;
- Courts of law, law enforcement authorities, regulatory authorities or lawyers or other individuals, if this proves to be necessary in a justified manner, in order to establish, exercise or defend a right in court or a natural right, or for an alternative and confidential resolution of disputes;
- Foreign law firms with a view to obtaining foreign legal advice when such advice is required to resolve the mandate entrusted by you or your company;
- Companies providing services related to anti-money laundering controls, credit risk mitigation and for other purposes related to fraud and crime prevention and to companies rendering similar services, including financial institutions, credit reporting agencies and regulatory authorities that such data are shared with;
Any third party towards which we assign or novate any rights or obligations under the law. Furthermore, we may transfer your Personal data to our processors, mainly to the service providers within or outside SPA-LEX, with a view to the Processing of your Personal data for the authorised purposes, on our behalf and strictly based on our instructions. SPA-LEX will maintain the control over your Personal data and will use appropriate safeguards, as provided under the applicable law, to ensure the integrity and security of your Personal data in relation with those processors.
Otherwise, we will transmit your Personal data only when instructed or authorized by you in this respect or when this is required under the applicable law or by requests from the judicial or public authorities.
We may transfer your Personal data abroad. Certain recipients of your Personal data may be located in countries for which the European Commission has not issued a decision regarding the provision of an adequate level of data protection, namely: the United States of America or some of the countries outside Europe.
Certain recipients outside the European Economic Area (“EEA”) are certified under the privacy agreement concluded between Europe and USA called “EU-US Privacy Shield”, while others are located in countries for which the European Commission issued compliance decisions [Andorra, Argentina, Canada (for private organizations subject to the Personal information protection and electronic documents act), Switzerland, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey and New Zealand]. In each case, the transfer is recognized as providing an adequate level of data protection from the perspective of the European data protection law (Article 45 of GDPR).
We may conclude data transfer agreements based on the Standard Contractual Clauses (European Commission Decision 2010/87/EU and/or European Commission Decision 2004/915/EC) pursuant to Article 46 (5) GDPR or by using other appropriate means, making sure that all other recipients outside the EEA will provide an adequate level of data protection for Personal data and that there are adequate technical and organizational security measures to protect Personal data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access and against all other unlawful Processing methods.
SECURITY OF YOUR PERSONAL DATA
SPA-LEX has implemented appropriate technical and organizational measures in order to maintain the privacy and security of your Personal data in line with the internal procedures on storage, dissemination and access to Personal data. The Personal data may be kept either stored on our Personal data technological systems or on paper.
We are happy to ensure your exercise of these rights.
You may exercise your aforementioned rights and find out more about such rights by filing with us, as data controller, a written request at firstname.lastname@example.org or email@example.com
You also have the right to file a complaint with the data protection authority, having its headquarters at 28-30 G-ral Gheorghe Magheru Bld. District 1, Bucharest, 010336, Romania.
We are committed to always treat your requests with the utmost attention and address any queries you may have in the shortest time possible.