Policy information last updated: 20 July 2026. English version prepared: 14 September 2026.
1. Who we are
The controller is Cabinet de Avocat „Rotaru Rareș”, Str. Muzelor no. 5A, Sector 4, Bucharest, a member of the Bucharest Bar. Contact: rotaru@rrlaw.ro or +40 754 411 870. This policy explains processing of visitors’ personal data under Regulation (EU) 2016/679 (GDPR).
2. Data and purposes
Information you provide. When contacting us by telephone, email, WhatsApp, Signal, SimpleX or the website form, we process the name, contact details and message content you choose to share. The website form sends the message through the practice’s server to its email inbox without keeping it in a website database. The legal basis is Article 6(1)(b) GDPR for steps you request before a legal assistance contract or performance of that contract.
Technical information attached to form messages. The sender’s IP address and submission date and time are attached to incoming messages to help prevent spam and abuse. For rate limiting, the server temporarily retains a cryptographic hash of the IP address separately from the sender’s name and message. Records are valid for one hour. Expired files are removed by automatic cleanup triggered by form use, so physical deletion may occur later. The legal basis is Article 6(1)(f), the legitimate interest in protecting the practice’s communications infrastructure.
Estimation-tool input. Weight, biological sex, quantities, times and risk factors entered into the tools are processed only in your browser. They are not sent to the server, saved, associated with a profile, used for advertising or analytics, included in the URL or passed to the contact form. They disappear when the page is reloaded or closed, and the practice cannot access or recover them. Hosting logs record the visit, not the values entered into the calculator.
Server logs. The hosting provider automatically records standard technical information such as IP address, access time, requested page and browser type. The legal basis is Article 6(1)(f), the legitimate interest in operation and security. These records are not used to identify visitors or combined with other sources.
Client files. Client data is additionally processed under Law no. 51/1995 and the Statute of the Legal Profession and is protected by professional secrecy. Further details are addressed in the legal assistance contract.
3. Retention
Enquiries that do not lead to a contract are kept for the time needed to address them. Client-file retention follows the applicable professional, archival and tax rules. Server logs are retained for short periods determined by the hosting provider. Rate-limiting records are valid for one hour, with expired files deleted during subsequent automatic cleanup. An IP address attached to an incoming message follows that message’s retention arrangements.
4. Access and disclosure
Data is not sold or used for marketing. It may be accessible to the hosting provider, whose server is in the European Union, to operate the service, and to public authorities where legally required within the limits of professional secrecy. The practice’s published policy states that it does not transfer data outside the European Economic Area. The website itself loads its fonts and resources locally rather than from third-party services.
If you choose to leave the website to use an external messaging service, that service also processes data under its own terms and privacy policy.
5. Your rights
You have rights of access, rectification, erasure, restriction, portability and objection, subject to the conditions of the GDPR, and protection against decisions based solely on automated processing. The website does not use such decisions or profiling. Contact rotaru@rrlaw.ro to exercise your rights.
You may also complain to Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru no. 28–30, Sector 1, Bucharest. See dataprotection.ro.
6. Cookies
The website does not use cookies. See the cookie policy and terms of use.
7. Security
The website is served over an encrypted HTTPS connection with technical server safeguards. Encrypted channels such as Signal or SimpleX may be used for confidential communication on request. This policy may be updated. The current version is the one published on this page.