Privacy Policy

This Privacy Policy explains how MDM Legal (“we”, “us”) processes personal data when you visit www.mdm-legal.ro, contact us through the website or apply for a position with us. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and the applicable Romanian legislation, including Law no. 190/2018.

1. Who we are

The controller of your personal data is Cabinet de avocat Oana Munteanu (MDM Legal), with its registered office at 44 Gh. Brătianu Street, Ground Floor, District 1, 011414, Bucharest, Romania, fiscal code RO33256324.

For any question about this policy or the processing of your data, you can contact us at office@mdm-legal.ro or by phone at +40 21 314 25 68. [If a Data Protection Officer has been appointed, add the DPO’s contact details.]

2. What data we collect and why

Contact form. When you write to us through the contact form, we process your name, email address, phone number (optional), the content of your message and the date of your consent. We use this data to answer your request and, where relevant, to take steps before entering into a contract for legal services. Legal basis: your request and our steps prior to a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering correspondence (Art. 6(1)(f) GDPR).

Job applications. When you apply for a position, we process your name, email address, phone number, the position you apply for, your cover letter, your CV and any other information you choose to include. We use this data to assess your application and to contact you during the recruitment process. Legal basis: steps taken at your request prior to entering into an employment or collaboration contract (Art. 6(1)(b) GDPR). Please do not include in your CV special categories of personal data (such as health data) unless strictly necessary.

Technical and security data. When you use the forms, we record the IP address and browser information of the sender, and our servers keep standard access logs. We use these data to keep the website secure and to prevent spam and abuse. Legal basis: our legitimate interest in protecting the website (Art. 6(1)(f) GDPR).

Emails we send. After you submit a form, we send you an automatic confirmation email. We do not use your data for marketing and we do not send newsletters.

3. How long we keep your data

• Contact messages: [12 months] from the last exchange, unless the request leads to a mandate, in which case the data become part of the client file and are kept according to the legal requirements for the legal profession.
• Job applications: [12 months] from receipt, or longer only with your express consent for future recruitment processes.
• Server access logs: [30 days].

4. Who receives your data

Your data are accessed only by MDM Legal staff who need them to handle your request. We use carefully selected service providers acting on our behalf, under contracts that comply with Art. 28 GDPR:

• the hosting provider of this website [name, country of the data centre];
• the email service used to deliver form notifications and confirmations [name];
• Cloudflare, Inc., which provides the Cloudflare Turnstile bot check on our forms.

We may also disclose data to public authorities where we are required to do so by law. We do not sell personal data.

5. Transfers outside the European Economic Area

Cloudflare may process technical data in countries outside the EEA, including the United States. Such transfers rely on the EU–US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission. [Confirm with the hosting and email providers whether any other transfers take place.]

6. Your rights

Under the GDPR you have the right to access your data, to have them rectified or erased, to restrict or object to their processing, to data portability and, where processing is based on consent, to withdraw your consent at any time without affecting the lawfulness of the processing carried out before withdrawal. To exercise these rights, write to us at office@mdm-legal.ro. We will answer within one month.

You also have the right to lodge a complaint with the Romanian supervisory authority: the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., District 1, Bucharest, www.dataprotection.ro.

7. Professional secrecy

Information you send us may be subject to the professional secrecy obligations of lawyers. Please note, however, that a lawyer–client relationship is not established by simply sending a message through this website, and we recommend that you do not send confidential information before we confirm that we can assist you.

8. Security

The website is served exclusively over an encrypted connection (HTTPS). CVs are stored outside the publicly accessible part of the server and can be accessed only by authorised staff. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration.

9. Cookies

Information about the cookies used on this website is available in our Cookie Policy.

10. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page, with the date of the last update shown at the top.