Privacy policy

Controller and data-protection contact

The controller of personal data processed through this website is Radu Florin Alin – Cabinet de avocat. Professional details and the contact address appear under “Provider identification” in every page footer.

For privacy questions and data-subject requests, contact alin.radu@rfa-avocati.ro.

Data we process

The contact form may collect your name, email address, telephone number, selected practice area, contact preference, brief description, language and source page. The career form may additionally collect the position, LinkedIn profile, motivation, CV and information included by the candidate in that CV.

For operation and security, we may process the date and time, a technical request reference, message-delivery status and pseudonymous identifiers used to limit abuse. The hosting provider may generate technical logs including the IP address, browser, device and requested route.

The contact form does not request documents. Do not submit health, conviction, child or other sensitive information unless strictly necessary for an initial assessment.

Purposes and legal bases

We assess requests, check whether we may assist and reply through the selected channel. The legal basis is taking steps at your request before a potential legal-services engagement and, where applicable, our legitimate interests in managing communications, organising work and protecting the website from abuse (Article 6(1)(b) and (f) GDPR).

Candidate data is processed to assess the application and communicate about it, based on the steps requested by the candidate and legitimate recruitment interests. Retention for future opportunities occurs only when separately selected and relies on consent, which may be withdrawn at any time.

We may also process data to comply with legal duties, defend rights and manage incidents (Article 6(1)(c) and (f)). The required form checkbox acknowledges that the notice was read; it does not turn processing necessary for the current request into consent.

Required and optional data

Fields marked as required are necessary to identify, assess and answer the request. The form cannot be submitted without them. Telephone is required only when telephone contact is selected; other optional fields may be omitted.

Providing data is voluntary and does not automatically create a lawyer–client relationship. You may use the public email address instead of a form.

Recipients and providers

Data is available only to authorised people handling requests and, as necessary, contracted providers: Render for hosting, Supabase for the database and private CV storage, Resend for email delivery, and technical providers involved in security and maintenance. Sanity manages public editorial content and, under the current architecture, does not receive form data.

Data may be disclosed to authorities, courts or other recipients where required by law or necessary to establish, exercise or defend a legal claim. We do not sell personal data or use it for behavioural advertising.

International transfers

Some providers may process data outside the European Economic Area. Where this occurs, we use applicable GDPR mechanisms such as an adequacy decision or standard contractual clauses, with supplementary measures where required. Actual provider regions and documents are checked before production forms are enabled.

Retention periods

Contact requests and ordinary applications are scheduled for deletion after no more than 180 days. Applications separately retained for future opportunities are scheduled for deletion after no more than 365 days. Data may be deleted earlier when no longer needed.

Specific information may be kept for a different period where required by law, necessary to defend a right or where the request leads to an engagement; in that case the professional-relationship notice applies. Logs and anti-abuse records are kept only as long as needed for their purpose.

Quick contact through WhatsApp

The WhatsApp button is an external link initiated only by the visitor; the website does not load a Meta SDK or send data to WhatsApp before the link is selected. Email and the contact form remain available alternatives.

After opening the link, WhatsApp may process the telephone number, account data, metadata and message under its own terms and policies. Do not send documents or confidential information that is unnecessary for the initial message. A message does not automatically create a lawyer–client relationship.

Map and social media

Google Maps loads automatically on the Contact page. The browser connects to Google, which may receive the IP address, device and browser information, the referring page and other technical data, and may use its own storage technologies under its policies. The office address and external Google Maps link are also displayed separately.

Facebook and Instagram links are plain external links. The website loads no Meta SDK, pixel or content before a link is selected. The external provider’s policies apply after opening it. These services are not required in order to contact the firm.

Data-subject rights

Subject to the GDPR, you may request access, correction, deletion, restriction and portability. You may withdraw consent where consent is the legal basis, without affecting processing performed before withdrawal.

You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop unless we demonstrate compelling legitimate grounds that override your interests or the processing is needed to establish, exercise or defend a legal claim.

Send requests to alin.radu@rfa-avocati.ro. We may request reasonable information to verify identity and generally respond within one month as required by the GDPR.

Complaints and automated decisions

You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) through www.dataprotection.ro, without losing your right to seek a judicial remedy.

We do not use website data for decisions based solely on automated processing that produce legal or similarly significant effects, and we do not profile visitors for such purposes.

Security, children and updates

We apply appropriate technical and organisational measures, including limited access, encrypted transport, private CV storage, validation and abuse controls. No internet transmission can be guaranteed to be absolutely secure.

The website and forms are not directed at children. If we learn that we have received a child’s data without justification, we will take appropriate steps to erase it or establish a valid legal basis.

We may update this notice when flows, providers or legal requirements change. Version 2 applies from 10 August 2026; material changes will be signposted here and, where required, a new choice will be requested.