PThis Policy explains what personal data Cabinet de Avocat Csurulya Csongor processes, for what purposes, on what legal basis, how long the data is kept, and what rights you have. It is issued pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”), Law No. 190/2018 on measures implementing the GDPR, and Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

1. The Controller

The data controller is Cabinet de Avocat Csurulya Csongor (the “Law Office”), a sole-practitioner law office and member of the Covasna Bar, Tax Identification Number (CIF) 48214629, with its professional office at 1 Decembrie 1918 Street, No. 35, 2nd Floor, Sfântu Gheorghe, Covasna County, represented by Csurulya Csongor, attorney-at-law.

For any matter relating to data protection, you can contact us by email at csongorcsurulyalaw@gmail.com, by phone at +40 744 307 110, or by post at the address above.

2. Data Protection Officer (DPO)

The Law Office has not appointed a data protection officer, as the conditions set out in Article 37(1) GDPR are not met. According to Recital 91 GDPR, the processing of client data by an individual lawyer is not considered large-scale processing. Requests should be addressed directly to the lawyer, using the contact details above.

3. Scope

This Policy applies to:

• visitors to the website www.csurulyalaw.com (the “Website”) and anyone who contacts us via the contact form, email, phone, or social media;

• clients and prospective clients, as well as other persons whose data reaches the Law Office in the course of providing legal services (the “Services”).

All processing is carried out in compliance with the lawyer’s duty of professional secrecy, as governed by Law No. 51/1995 on the organization and practice of the legal profession, as republished, and by the Statute of the Legal Profession.

4. Principles

The Law Office processes data in accordance with the principles set out in Article 5 GDPR:

• lawfulness, fairness, and transparency;

• purpose limitation;

• data minimization;

• accuracy;

• storage limitation;

• integrity and confidentiality;

• accountability.

5. Whose Data We Process

• Website visitors;

• persons who contact us (prospective clients);

• clients who are natural persons, as well as the representatives, shareholders, directors, and employees of clients that are legal entities;

• opposing parties, witnesses, experts, and other persons involved in clients’ cases.

6. What Data We Process

a) Through the Website and at first contact: first and last name, email address, phone number, the content of your message, and any information you choose to send us. Please do not send documents or sensitive details about your case through the contact form until we have agreed with you on an appropriate communication channel.

Messages sent through the contact form are stored on the Squarespace platform and forwarded to the Law Office’s email address.

b) Technical data: IP address, browser and device type, operating system, pages accessed, date and time of access, and cookie information (see Section 9).

c) In the course of the Services, depending on the engagement:

• identification data: first and last name, date of birth, personal identification number (CNP), identity document series and number, copy of the identity document;

• contact data: address, email, phone number;

• financial data: billing details, bank account, payment information;

• professional and case data: documents, correspondence, notes, procedural documents, evidence;

• data required for customer due diligence and anti-money laundering checks, including politically exposed person status and beneficial ownership.

d) Special categories of data (Article 9 GDPR). This includes, for example, health data in compensation, insurance, or employment law cases. It is processed only to the extent strictly necessary for the establishment, exercise, or defense of legal claims.

e) Data relating to criminal convictions and offenses (Article 10 GDPR). This is processed mainly in criminal cases in which the Law Office provides assistance or representation. It is processed only within the limits of the exercise of the right of defense and of Law No. 51/1995.

f) Data of minors. The Website is not directed at minors. In the course of the Services, the Law Office may process minors’ data, for example in family, inheritance, or criminal cases. It does so only to the extent necessary for the engagement and, as a rule, through the minor’s legal representative.

7. Where the Data Comes From

The data comes mainly from you. It may also come from our clients, from courts and authorities, from other parties to the proceedings, or from public registers. These registers include the National Trade Register Office (ONRC), the courts’ web portal, the Insolvency Proceedings Bulletin, and the land register.

Sometimes a person’s data (for example, an opposing party’s or a witness’s) is obtained from the client. In that case, the Law Office does not inform that person separately where doing so would breach professional secrecy, in accordance with Article 14(5)(d) GDPR.

8. Purposes and Legal Bases

• Responding to requests received through the Website, email, or phone: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract), or Article 6(1)(f) GDPR for messages that do not concern an engagement.

• Providing legal services (advice, drafting, assistance, and representation): Article 6(1)(b) GDPR; Law No. 51/1995, the Code of Civil Procedure, and the Code of Criminal Procedure.

• Conflict of interest checks: Article 6(1)(c) GDPR; Law No. 51/1995 and the Statute of the Legal Profession.

• Customer due diligence and anti-money laundering: Article 6(1)(c) GDPR; Article 5(1)(f) of Law No. 129/2019, in the cases provided therein.

• Invoicing, accounting, and tax records: Article 6(1)(c) GDPR; Accounting Law No. 82/1991 and Law No. 227/2015 on the Tax Code.

• Archiving case files and defending the Law Office in any litigation or disciplinary proceedings: Article 6(1)(f) GDPR. The legitimate interest is proving the services provided.

• Website security and technical operation: Article 6(1)(f) GDPR. The legitimate interest is preventing fraud and attacks.

• Analytics cookies: Article 6(1)(a) GDPR (consent); Article 4(5) of Law No. 506/2004.

• Communication through the Law Office’s Facebook and LinkedIn pages: Article 6(1)(f) GDPR. The legitimate interest is communicating with the public.

The personal identification number (CNP) and copies of identity documents are processed only in two situations: when required by law (for example, Article 194(a) of the Code of Civil Procedure or Law No. 129/2019), or when necessary to perform the engagement. In both cases, processing complies with Article 4 of Law No. 190/2018.

Special categories of data are processed under Article 9(2)(f) GDPR (establishment, exercise, or defense of legal claims). Data relating to criminal convictions and offenses is processed under Article 10 GDPR. This processing stays within the limits of Law No. 51/1995 and the Code of Criminal Procedure, which govern the right of defense and the work of lawyers.

Are you required to provide your data? The data requested at first contact is optional, but without it we cannot respond to you. Some identification data is mandatory: the data required to conclude the legal assistance agreement and to meet legal obligations, including anti-money laundering obligations. Without it, the Law Office cannot accept the engagement.

The Law Office does not use automated individual decision-making and does not carry out profiling within the meaning of Article 22 GDPR.

Right to object. Where processing is based on legitimate interest (Article 6(1)(f) GDPR), you have the right to object to it under Article 21 GDPR. You may do so at any time, on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds, or unless the processing is necessary for the establishment, exercise, or defense of legal claims.

9. Cookies

The Website is hosted on the Squarespace platform and uses:

• strictly necessary cookies, without which the Website cannot function. These do not require consent, under Article 4(6) of Law No. 506/2004.

• analytics cookies (Squarespace Analytics), which show us how many visits the Website receives and which pages are read. These are placed only after you accept them, under Article 4(5) of Law No. 506/2004.

The cookies placed by Squarespace on the Website are:

• crumb: strictly necessary; protects against cross-site request forgery attacks; duration: session.

• test, ddcookie_test, ddsite_test: strictly necessary; check whether the browser accepts cookies; duration: session, or expire immediately.

• RecentRedirect: strictly necessary; prevents redirect loops; duration: 30 minutes.

• ss_cid, ss_cvr, ss_cpvisit: analytics; identify unique visitors and their sessions; duration: 2 years.

• ss_cvisit, ss_cvt: analytics; track the current session; duration: 30 minutes.

The Website does not use advertising cookies or third-party tracking tools such as Google Analytics or Meta Pixel. The Facebook and LinkedIn links on the Website are simple links and do not place cookies unless you click them.

You make your choice on your first visit, through the cookie banner. You can withdraw your consent at any time, as easily as you gave it. To do so, use the cookie settings link in the Website footer or your browser settings. The full list of cookies, including the duration of each, is available in the Cookie Policy.

10. Social Media

The Law Office has pages on Facebook and LinkedIn. When you interact with these pages, your data is also processed by the platform: Meta Platforms Ireland Limited for Facebook, and LinkedIn Ireland Unlimited Company for LinkedIn. Each processes your data under its own privacy policy.

For page statistics (Page Insights / Page Analytics), the Law Office and the platform are joint controllers within the meaning of Article 26 GDPR. The platform assumes primary responsibility for this data. We do not use social media data for advertising.

11. Recipients

Data may be disclosed only to the extent necessary and subject to professional secrecy. It may be disclosed to:

• courts, prosecutors’ offices, and other public authorities;

• notaries, bailiffs, experts, translators, and interpreters;

• other lawyers or correspondents, including in other jurisdictions, as independent recipients;

• the National Office for Prevention and Control of Money Laundering, only in the cases and within the limits provided by Law No. 129/2019;

• the professional bodies of the legal profession (the Covasna Bar and the National Association of Romanian Bars, UNBR), in proceedings provided by law;

• providers acting on our behalf as processors, under contracts compliant with Article 28 GDPR. These cover:

  • website hosting, the contact form, and traffic statistics (Squarespace, under the data processing agreement included in Squarespace’s contractual terms);

  • email;

  • cloud storage;

  • accounting;

  • IT services.

We do not sell data or use it for advertising.

12. Transfers Outside the European Economic Area

Some providers, such as Squarespace, Inc., may process data in the United States. Squarespace, Inc. is certified under the EU-U.S. Data Privacy Framework. The European Commission has adopted an adequacy decision for this framework (Commission Implementing Decision (EU) 2023/1795), so the transfer is based on Article 45 GDPR.

For other recipients in countries without an adequacy decision, we use the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR).

You can request a copy of the applicable safeguards using the contact details in Section 1.

13. How Long We Keep Data

• Contact messages and requests that do not result in an engagement: until the request is resolved, but no longer than 2 years from the last message (Article 5(1)(e) GDPR).

• Client file (agreement, correspondence, documents): for the duration of the engagement and 5 years after it ends, for the purpose of defense in any litigation. The general limitation period is 3 years, under Article 2517 of the Civil Code.

• Customer due diligence documents (anti-money laundering): 5 years from the end of the business relationship or from the date of the occasional transaction (Article 21 of Law No. 129/2019).

• Accounting and tax documents: the periods set by accounting legislation, between 5 and 10 years depending on the type of document (Law No. 82/1991 and its implementing regulations).

• Cookies: the duration indicated for each cookie in Section 9.

When these periods expire, the data is deleted or anonymized.

14. Data Security

The Law Office applies technical and organizational measures appropriate to the risk, in accordance with Article 32 GDPR. These include:

• restricted access to case files;

• strong passwords and two-factor authentication;

• device encryption;

• backups;

• storage of physical documents in locked premises.

In the event of a personal data breach, the Law Office notifies the supervisory authority (ANSPDCP) within 72 hours (Article 33 GDPR). It also informs the affected persons when the risk to them is high (Article 34 GDPR).

15. Your Rights

You have the following rights, under the conditions set out in Articles 15–22 GDPR:

• the right of access (Article 15);

• the right to rectification (Article 16);

• the right to erasure (Article 17);

• the right to restriction of processing (Article 18);

• the right to data portability (Article 20);

• the right to object (Article 21; see Section 8);

• the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3)).

How to exercise your rights. Send a request to csongorcsurulyalaw@gmail.com or by post. We respond free of charge, within one month of receipt. For complex or numerous requests, this period may be extended by two further months, in which case we will inform you (Article 12(3) GDPR). We may request additional information to confirm your identity (Article 12(6) GDPR).

Limitations. Some rights may be limited by the following:

• the obligation of professional secrecy and the protection of the rights of clients or other persons (Article 23(1)(i) and (j) GDPR; Law No. 51/1995);

• legal data retention obligations or the need to defend legal claims (Article 17(3)(b) and (e) GDPR).

An opposing party cannot use the right of access to obtain information covered by professional secrecy.

Complaints and judicial remedies. You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) (Article 77 GDPR). Its contact details are:

• address: 28–30 General Gheorghe Magheru Blvd., Sector 1, Bucharest 010336, Romania;

• email: anspdcp@dataprotection.ro;

• phone: +40 318 059 211;

• website: www.dataprotection.ro.

You may also bring proceedings before the competent court (Article 79 GDPR).

16. Changes to This Policy

This Policy may be updated. The current version and the date of the last update are displayed on the Website. Active clients will be informed by email of any significant changes.

17. Contact Details

Cabinet de Avocat Csurulya Csongor
1 Decembrie 1918 Street, No. 35, 2nd Floor
Sfântu Gheorghe, Covasna County, Romania
Email: csongorcsurulyalaw@gmail.com
Phone: +40 744 307 110