PRIVACY POLICY

PROTECTION AND RETENTION OF YOUR PERSONAL DATA

Crangasu Legal is committed to respecting and protecting your privacy. This privacy policy explains how we collect, store and use your personal data in compliance with applicable data protection law including, where relevant the General Data Protection Regulation (EU) 2016/679, and any other Romanian relevant privacy rules, as amended from time to time. For the avoidance of doubt, this privacy policy is not a contract and does not itself create any legal rights or obligations.

If you have any questions about us processing your personal data, contact us via our website form.

Crangasu Legal is a law office with its headquarters in Bucharest, Romania and controls the collection and processing of any personal data that you provide to us in relation to this website.

Terms used here have the meanings given to them in the EU GDPR unless otherwise stated. Any reference to “we”, “us” or “our” should be understood as a reference to Crangasu Legal, and any reference to “you” or “your” should be understood as a reference to a data subject whose personal data we process for the purposes described in this privacy policy.

DATA COLLECTION

We may collect personal data (i) directly from you when you engage with us, (ii) our clients, when we handle personal data for the purpose of providing our services; and (iii) indirectly from third-party sources including your organisation, your representatives, publicly available sources, our service providers; and (iv) regulatory bodies;

When we collect personal data directly from you it is your decision whether to provide data. If you do not provide data, it may hinder your use of, or make it not possible to use, our services or products, not allow you to remain in contact with us, to enter into contracts/agreements with us, to participate in our programmes, or to exercise your rights. If you provide information to us about another person, you must ensure that you comply with any legal obligations that may apply to your provision of the information to us, and allow us, where necessary, to share that information with our service providers.

THE PURPOSE OF COLLECTING AND USING THE DATA 

How we use your personal data depends on the nature of your relationship with us. How we use your personal data and our legal basis for doing so, including where applicable our legitimate interest is explained below.

We will only use your personal data when applicable law allows us to. Depending on the nature and purposes of processing being carried out, our basis for processing may include:

• pursuing our legitimate interest or those of a third party. Under the EU GDPR, the lawful basis of such processing is Article 6(1)(f) of the EU GDPR (i.e. the processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests, fundamental rights and freedoms which require protection of personal data);
• performance of a contract. Under the EU GDPR, the lawful basis of such processing is Article 6(1)(b) of the EU GDPR (i.e. the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract), and
• complying with legal obligations. Under the EU GDPR, the lawful basis of such processing is Article 6(1)(c) of the EU GDPR (i.e. the processing is necessary to discharge a relevant legal or regulatory obligation to which we are subject);

Generally, we do not rely on consent as a legal basis for processing your personal data, although we will obtain your consent before sending third party direct marketing communications to you, or where your consent is otherwise required under applicable law. You have the right to withdraw your consent at any time by contacting us using the details set out under “Contacting Us” below.

We do not sell your personal information. We do not envisage your personal data will undergo any automated decision making.

CLIENTS AND THOSE WHOSE PERSONAL DATA WE PROCESS IN CONNECTION WITH OUR PROFESSIONAL SERVICES

When our clients instruct us for legal advice and services, we may collect personal data, including name, contact information, financial information and other information relevant to these legal services provided by us. This information may be collected directly from you, supplied by your organisation or provided by another source. We use this information for the purposes of:

• due diligence, including on-boarding, compliance checks (including anti-money laundering and conflict checks) and other on-boarding processes;
• conducting client relationships and providing legal advice and services including working with counterparties, providers of related services (such as litigation support, translation and other specialist services);
• managing billing, payments and financial records; and
• responding to requests from regulators.

We use information about our clients (and their representatives) to fulfil our contractual, legal and regulatory obligations or because we have a legitimate interest in processing the information to provide our services and manage our business relationships.

When we provide legal advice and services to clients, we may also process the personal data of individuals whose information is relevant to the matter(s) on which we are instructed for example, when we advise on a business transaction, a regulatory investigation or we represent a client in a litigation or dispute. When we process personal data collected from or on behalf of our clients to provide legal advice and services, we process this data subject to obligations of client confidentiality and legal professional privilege, as well as the terms of our engagement with our client.

We only process special category data where processing is necessary where we are subject to a legal obligation to do so or where it is necessary to do so to establish, exercise or defend legal claims.

COOKIES ABOUT THE VISITORS TO OUR WEBSITE

When you visit our website, we automatically collect, store and use technical information about your equipment and your interaction with our website. This information is sent from your computer to us using cookies. Read more about in our cookies notice.

NEWSLETTERS, PODCASTS AND EVENTS

We collect personal data which is provided by you when you sign up to receive newsletters or briefings, attend an event or interact with us as a client. This includes contact information including name, surname, email, telephone number and address; professional information including marketing preferences and other relevant information including meal preferences, feedback and survey responses. This information is stored in our systems.

We process information in connection with our newsletters, podcasts and events:

• to send you newsletters, email news and other information that may be of interest to you;
• to invite you to our organised events and of our partners, to operate our events and to facilitate networking opportunities; and
• to manage your communication preferences, including, if you opt out, to operate lists to ensure that you do not receive marketing communications from us.

Depending on our relationship with you, our legal basis for processing may be:

• you have consented to receiving marketing communications from us,
• we have a business relationship with you, or your organisation and we have a legitimate interest in communicating with you; or
• to respect your rights (which are explained below) and to comply with our legal obligations.

APPLICANTS, WORK EXPERIENCE

When you apply for a job, for work experience or an internship we will ask you for information relevant to your application. We ask all applicants to apply via our recruitment system where a specific privacy statement is available.

VISITORS TO OUR PREMISES

If you visit our premises, we may collect information that we need to identify you, to create a record of your visit and for visitor pass use (if issued) and to complete necessary security checks. We may also collect your image on CCTV. We use this information to maintain physical security and manage access to our office. If you use our guest Wi-Fi, we will collect relevant information to maintain the security of the Wi-Fi service. We process information about visitors to our premises to comply with legal obligations and because we have a legitimate interest in maintaining the security of our network and buildings.

COMPANIES AND INDIVIDUALS WHO CONTACT US

We collect contact and related information when you contact us via our website, by email or by telephone. We process this information because we have a legitimate interest in responding to enquiries.

SUPPLIERS AND OTHER THIRD PARTIES

If you provide goods or services to us, we maintain contact information, information regarding the goods or services provided to us and billing and financial information, such as billing address, bank account and payment information. We use this information to manage our supplier relationships and to comply with our contractual and legal obligations. We may also use this information to establish, exercise or defend legal claims.

FORMER MEMBERS OF OUR TEAM

If you have previously been a member of Crangasu Legal team, we may continue to process personal data that was collected before and during your working/collaborating relationship with us. This data includes contact and biographical information, financial information, compensation and benefits information, employment/personnel records (including job title, contract information, expertise, compensation, performance information), photographs.

We may process this data because we have a legitimate interest in maintaining records, to provide you with references, to publicise our activities, and to conduct reviews to better understand our team members experience. We may also use this information to establish, exercise or defend legal claims and to comply with our regulatory and legal obligations (including in relation to applicable tax and employment law).

We may continue to process special category data, including race, ethnicity and health-related information, where necessary and permitted by applicable law, to fulfil our legal obligations or exercise rights in connection with employment, social security or social protection law; to establish, exercise or defend legal claims or where it is in the public interest to do so.
We do not share personal data with third parties following your employment, contractual relationship or partnership with us except as necessary to fulfil ongoing legal or contractual obligations.

SHARING AND TRANSFERRING YOUR PERSONAL DATA

We treat your personal data with respect and do not share it with third parties except as follows:

• We may share personal data with our collaborators, suppliers and service providers located around the world who process personal data on our behalf to provide or support the services described in this Privacy statement and with other legal specialists, including barristers, mediators, arbitrators, consultants, experts and other law firms.
• We may share personal information, where necessary, with courts, regulatory authorities and government officials, where it is necessary to provide legal services, as permitted by applicable law or as required under applicable law (in which case we will notify you, unless we are prohibited from doing so or it is not possible or reasonable to do so).
• We may also share your personal data where you have consented to us doing so.

Any such transfers will comply with our obligations under applicable data protection laws. Some of these parties may process your personal data in accordance with our instructions and others will themselves be responsible for their use of your personal data.

PROTECTION AND RETENTION OF YOUR PERSONAL DATA

We are committed to protecting your personal data and have implemented appropriate technical, physical and organisational security measures.
We do not keep your personal data for any longer than is necessary for the purpose for which we collected it, to comply with any legal, regulatory or reporting obligations or to assert or defend against legal claims.

YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

To the extent that our processing of your personal data is subject to the GDPR or other data protection legislation with data subject rights, you may have rights which are explained below. To exercise these rights, please contact us at dataprivacy@crangasu-legal.eu.

You have the following rights:

• The right to ask us for a copy of your personal data. This right is subject to applicable law and relevant exemptions.
• The right to ask us to correct or complete any inaccurate or incomplete personal data.
• The right to (in certain circumstances) ask us to delete your personal data. We may be unable to delete your data if we are legally obliged to retain it.
• The right to (in certain circumstances) object to our processing of your personal data or ask us to “restrict” our use of it.
• If you have consented to our processing of your personal data, you can withdraw your consent.
• The right to ask that personal data which you have provided to us be provided to you in machine readable format if we process that data using automated means, you have consented to its use or so that we can enter into a contract with you.

We aim to respond to all legitimate rights requests within the relevant statutory time limits; however, where permitted by law, we may take longer if the request is complex.

COMPLAINTS

We respect your rights and want you to know about our usage of your personal data. If you have a complaint or concern about how we use your personal data, we would like to resolve it. You can report a concern or ask us a question by contacting the Data Privacy responsible. You also have the right to make a complaint to your local data protection authority using their website. If you are unsure as to who is your local data protection authority, please contact us.

HOW TO CONTACT US

If you have any queries regarding this Privacy statement or want to exercise any of the rights mentioned, please contact us at:
Email: dataprivacy@crangasu-legal.eu