Data controller
The controller of your personal data is the Law Office of Andreea Chelaru ([email protected]).
Data we collect
- Contact details: name, email address and phone number (submitted through the form).
- Your message or request: the information you choose to share with us.
- Minimal technical data: IP address and user agent, needed for the security and operation of the website.
Providing data
Providing form data is voluntary, not a legal duty. Name, email, message and agreement to contact are required to submit the form; phone is optional. Without required fields the form cannot be sent. You may also contact us by phone or email. Include only information needed for the initial enquiry.
Do not send identity-document copies, identification numbers, health, children’s or conviction data unless needed for the initial enquiry. Where a case requires sensitive data, processing is assessed separately: Article 9 data also require an applicable exception, for example necessity for legal claims under Article 9(2)(f); criminal data are subject to Article 10 and applicable law with appropriate safeguards. The general contact checkbox does not authorise all such processing.
Purposes of processing
- Replying to enquiries and booking appointments.
- Communication relating to legal services.
- Website security and the prevention of misuse.
Legal bases
- For responding to a general enquiry and the contact requested through the form: consent given through the checkbox (GDPR Article 6(1)(a)). This does not authorise newsletters or advertising.
- For necessary steps towards a legal services contract at your request, and performance of that contract: Article 6(1)(b). The basis depends on the actual purpose, not simply on the checkbox.
- For security and abuse prevention: the office’s legitimate interest (Article 6(1)(f)); for legal duties applying to the profession and records: Article 6(1)(c), within the relevant duty.
Storage and retention
Contact-form messages are retained for no more than one year. If the enquiry leads to a legal services relationship, necessary case documents and mandatory records have their own statutory retention periods, explained within that relationship. Withdrawing consent does not override legal retention duties or other applicable bases.
Recipients
We do not sell your data. OVHcloud provides website hosting and email. Hosting, email and security providers may access data necessary for their services. Cloudflare services are present on the website; Google analytics and advertising tools and the Meta Pixel relate to banner choices. Authorities and other recipients may receive data only when necessary and legally justified.
Your rights
- Access, rectification and erasure.
- Restriction of processing and objection.
- Portability of data you provided when processed automatically on consent or contract grounds under GDPR Article 20. You may receive it in a structured, commonly used, machine-readable format and request transmission to another controller when technically feasible.
- Withdrawal of consent for processing based on consent.
- A complaint to the Romanian data protection authority (ANSPDCP).
Security
We apply reasonable technical and organisational measures to protect personal data.
Contact
For any question or request about your personal data, write to us at [email protected].