INFORMATION NOTICE REGARDING THE PROCESSING OF PERSONAL DATA BY MUSAT & ASSOCIATES S.C.A.
- Preamble
Musat & Associates S.C.A. (hereinafter: “Musat & Associates”, “we” or “us”) is legally obliged to protect your personal data and comply with all data protection regulations, including but not limited to the provisions of the EU General Data Protection Regulation (GDPR) No. 2016/679.
This document provides details regarding:
– the types of personal data we process concerning you;
– the purposes for which we process such data and the legal bases for those purposes;
– the duration of data processing;
– the persons or entities to whom we disclose personal data;
– how you can exercise your rights under applicable data protection legislation.
Personal data means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to identifiers or factors specific to their identity. Specifically, the personal data we process may include information such as name, surname, phone number, email address, professional address, position or job title, or other details about personal or material circumstances, such as date of birth, age, gender, national identification numbers, video recordings, correspondence, photographs, etc. Personal data may also include special categories of data, such as medical data or data relating to criminal proceedings.
This notice applies to the processing of personal data of our clients and business partners, their representatives, employees, and collaborators, our collaborators, individuals interested in becoming associate lawyers with Musat & Associates S.C.A., or individuals contacting us to exercise their rights under data protection law or for other purposes.
- Purposes and Legal Bases of Data Processing
We process the following personal data for the following purposes and on the following legal bases:
In relation to Musat & Associates S.C.A. clients and their representatives
If you are a client, potential client, or a representative (including legal representative, employee, or collaborator) of one of our clients, we will use your identification and contact data to prepare and/or provide our services, as well as to communicate with you, based on the legal relationship between us and you/our client. The legal basis for processing your data in this case is the performance of our legal assistance and representation contracts or steps taken to enter into such a contract (Art. 6(1)(b) GDPR) if you are or wish to become our client, or our legitimate interest in ensuring the proper execution of contracts in which we are a party or intend to enter (Art. 6(1)(f) GDPR) when you are a client representative.
We will process your contact details on the basis of our legitimate interest (Art. 6(1)(f) GDPR) to optimize management of our communication with you. Based on legitimate interest, we may also process your data for internal purposes, including billing and contract management within Musat & Associates S.C.A.
Additionally, under anti-money laundering regulations, we are legally required in certain situations to verify, monitor, report, and keep records regarding clients. We may request from you and, if applicable, your ultimate beneficiaries or representatives, satisfactory proof of identity and, where relevant, proof of authorization. Such processing is carried out only to comply with our legal obligations (Art. 6(1)(c) GDPR).
Please note that in certain situations, we may be unable to take on a mandate if you do not provide or provide incomplete personal data necessary for us to deliver our legal services.
If you provide us with personal data and/or disclose business or trade secrets belonging to you, your relatives, colleagues, or other third parties, we will generally assume that you are authorized to disclose such information. We will use such data only to the extent necessary to execute our mandate or contractual relationship with you or the entity you represent. You are encouraged to inform affected individuals, as much as possible, about the sharing of their data with Musat & Associates S.C.A. and how we process it, in accordance with this notice.
We may also use your personal data on the basis of our legitimate interest (Art. 6(1)(f) GDPR) to fulfill other obligations under applicable law or professional statutes, or where necessary to establish, exercise, or defend our rights. In some cases, anonymized data may be used for statistical purposes.
In relation to our business partners, service providers, collaborators, and their representatives
If you are a business partner, service provider, collaborator, or their representative, we process your personal data to ensure smooth management of our contractual relationship with you or the entity you represent.
We may collect your data (name, surname, national identification number, identity card data, email, phone, position, office address) directly from you or the entity you represent when entering into or performing contracts with us, and for communication purposes. Additionally, we may obtain such personal data from public sources (employer websites, trade registries, etc.) or from correspondence/notifications sent by you or your company.
When a contract is directly with you, we process your personal data to perform rights and obligations under the service/collaboration contract to which you are a party (Art. 6(1)(b) GDPR). When the contract is with your company, we rely on our legitimate interest (Art. 6(1)(f) GDPR) to execute or fulfill the contract. We may also process your data internally for billing and contract management purposes.
We may also process your data to comply with other legal or professional obligations or to establish, exercise, or defend our rights (Art. 6(1)(c) and (f) GDPR).
In relation to third parties
Depending on the nature and scope of our mandate, we may process personal data of third parties (adverse parties, their lawyers, employees/collaborators of clients or adversaries, government representatives). We may obtain such data from you, your company, our clients, or public sources.
Such processing is carried out only as necessary to perform our service contract, based on our legitimate interest (Art. 6(1)(f) GDPR) to fulfill the mandate. It may also serve to comply with legal obligations (Art. 6(1)(c) GDPR).
In our marketing activities
Marketing activities may target clients, employees/collaborators of clients, potential clients, other lawyers, partners, journalists, or event participants.
Newsletter – We may process your contact data to send newsletters about legal developments in Romania, based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
Events – We may process your data (contact details, name, company, position) to send invitations, manage attendance, and organize events. Event images may be used for promotion with your prior consent.
Social Media and Website – We may process your data for publishing on our social media pages or website. Consent is required, and you may withdraw it anytime.
Visitors to our offices
Wi-Fi – You may receive a dynamic, randomly generated IP address during Wi-Fi access, which cannot identify you and is stored only for the duration of the session.
Video surveillance – Cameras monitor our offices for security and confidentiality of client information. Recordings are encrypted and stored for up to 30 days. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Prospective associate lawyers
Personal data provided during recruitment will be processed for candidate evaluation and retained to document the selection process. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). If selected, data will also be used for executing the collaboration contract.
Exercising GDPR rights
Data (name, image, ID info, etc.) will be processed to manage requests. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Assertion, exercise, and defense of rights
We may process data for asserting or defending rights. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Communication via email
If you contact us outside of a contractual relationship, data will be processed for communication purposes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Your Rights Regarding Your Personal Data
You have rights of access, rectification, erasure, restriction, objection, and data portability. Consent may be withdrawn at any time without affecting prior processing. Requests can be made in writing to the contacts listed in Section 7.
- Data Security
We implement technical and organizational measures to protect personal data against unauthorized access, use, alteration, or loss. However, internet transmission cannot be fully guaranteed as secure. Security incidents will be reported promptly in accordance with applicable law.
- Recipients of Your Personal Data
Data may be disclosed to:
Client-related recipients: courts, arbitration committees, public authorities, adverse parties, lawyers, service providers, etc.
Service providers/collaborators involved in executing mandates.
Marketing service providers, event organizers, social media administrators, etc.
Recruitment-related recipients (hosting providers, email providers).
Recipients outside the EU/EEA only with adequate safeguards or consent.
- Data Retention
Data is retained only as long as necessary for contractual, legal, or legitimate purposes. Specific retention periods:
Contractual data: duration of the contract + 10 years.
AML and financial records: 5–10 years.
Marketing: newsletter data retained until consent withdrawal; event participation data for 12 months; unsubscribed users retained for 3 years; social media/website data retained while relevant or until deletion request.
Recruitment data retained until process completion + 3 years.
Email correspondence retained up to 3 years unless longer retention is necessary.
- Contact Details
Musat & Associates S.C.A.
Iulius Town Timișoara – United Business Center 3, Piața Consiliul Europei, nr. 2E, et. 1, U3.E1.04, Timiș, Romania
Email: gdpr@avocat-musat.ro