Privacy Policy

Last updated: May 2026

1. Identity of the controller

The controller of personal data collected through the website www.ralucaanderco.ro is:

• Name: Av. Raluca Elena Anderco
• Capacity: Independent lawyer, member of the Bucharest Bar Association
• Professional address: Bucharest, Sector 5, Romania
• Email: raluca@ralucaanderco.ro
• Phone: +40 742 353 983
• Website: www.ralucaanderco.ro

2. What data we collect

2.1 Data you provide directly

By completing and submitting the contact form on the website, you may provide the following data:

• First and last name;
• Email address;
• Phone number (optional, if provided);
• The content of your message (description of your request or enquiry).

2.2 Data collected automatically

When you access the website, the following technical data may be collected automatically:

• IP address of the device used;
• Browser type and version;
• Operating system;
• Pages visited and duration of visit;
• Referring source (referral website);
• Date and time of access.

This data is collected through cookies and web analytics tools (Google Analytics). For details, please see our Cookie Policy.

2.3 Data we do not collect

The website www.ralucaanderco.ro does not collect special category data (health data, racial or ethnic origin, religious beliefs, biometric data, etc.), does not process payments, and does not store financial data.

3. Purpose and legal basis of processing

Your data is processed exclusively for the purposes described below, each with its corresponding legal basis:

Purpose	Data processed	Legal basis (GDPR)
Responding to requests submitted via the contact form	Name, email, phone, message	Art. 6(1)(b) — pre-contractual measures at the request of the data subject; or Art. 6(1)(f) — legitimate interest
Establishing and managing the lawyer-client professional relationship	Data required for the provision of legal services	Art. 6(1)(b) — performance of a contract; Art. 6(1)(c) — legal obligation
Compliance with legal obligations (e.g. tax, anti-money laundering)	Data required by law	Art. 6(1)(c) — legal obligation
Anonymous statistical analysis of website traffic	Anonymised browsing data	Art. 6(1)(f) — legitimate interest (website improvement)

4. How long we retain data

Your data is retained only for as long as necessary to fulfil the purposes for which it was collected, in compliance with applicable legal retention periods:

Category of data	Retention period	Reason
Contact form data (where no contractual relationship follows)	12 months from the date of request	Legitimate interest — handling and following up on the request
Data relating to the lawyer-client relationship	10 years from the end of the engagement	Professional legal obligations (Law no. 51/1995, Statute of the Legal Profession)
Financial and tax documents	10 years	Legal tax obligations (Romanian Fiscal Code)
Browsing data (Google Analytics)	26 months (per Google's policy)	Aggregate statistical analysis

Upon expiry of the applicable retention period, data is deleted or irreversibly anonymised.

5. Who we share data with

5.1 General principle

Your personal data is not sold, rented, or commercially shared with third parties. Data is only transferred to third parties where strictly necessary, as described below.

5.2 Possible recipients

• Technical service providers — website hosting provider, WordPress platform provider, email service provider, with whom we have entered into data processing agreements pursuant to Art. 28 GDPR;
• Google LLC — via the Google Analytics service, for statistical traffic analysis (anonymised data);
• Public authorities — where we are legally required to provide data (e.g. courts, investigative bodies, tax authorities);
• Bucharest Bar Association / UNBR — to the extent required by the professional and ethical obligations of the legal profession.

5.3 Legal professional privilege

6. International data transfers

Your data is processed primarily within the European Union. Where Google Analytics is used, data may be transferred to servers of Google LLC located in the United States of America.

Google LLC participates in the mechanisms approved by the European Commission for international data transfers (Standard Contractual Clauses — SCCs). Further information is available at policies.google.com/privacy.

We do not carry out any other transfers of data outside the European Economic Area (EEA).

7. Your rights

As a data subject, under the GDPR you have the following rights with respect to your personal data:

7.1 Right of access (Art. 15 GDPR)

You have the right to obtain confirmation that your data is being processed and, if so, a copy thereof, together with information about the purpose of processing, the categories of data, the recipients, and the retention period.

7.2 Right to rectification (Art. 16 GDPR)

You have the right to request the correction of inaccurate data or the completion of incomplete data relating to you.

7.3 Right to erasure — "right to be forgotten" (Art. 17 GDPR)

You have the right to request the deletion of your personal data in the circumstances provided for by the GDPR (e.g. the data is no longer necessary for the purpose for which it was collected, you have withdrawn consent, the data has been unlawfully processed). This right does not apply where processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defence of legal claims.

7.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to request restriction of processing of your data in certain circumstances (e.g. you contest the accuracy of the data, the processing is unlawful but you do not wish erasure, the data is no longer needed but you require it for the establishment, exercise, or defence of legal claims).

7.5 Right to data portability (Art. 20 GDPR)

You have the right to receive the data you have provided in a structured, commonly used, and machine-readable format, and to transmit it to another controller, where processing is based on consent or a contract.

7.6 Right to object (Art. 21 GDPR)

You have the right to object at any time to the processing of your data based on the legitimate interests of the controller. In the event of an objection, we will cease processing unless we can demonstrate compelling legitimate grounds which override your interests.

7.7 Right not to be subject to automated decision-making (Art. 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you. We confirm that the website www.ralucaanderco.ro does not use automated decision-making or profiling systems.

7.8 Right to withdraw consent

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

7.9 How to exercise your rights

You may exercise any of the above rights by sending a written request to raluca@ralucaanderco.ro. We will respond within 30 calendar days of receipt. In complex cases, this period may be extended by a further 60 days, with prior notice to you.

Your request should include sufficient information to identify you as a data subject and a clear description of the right you wish to exercise.

8. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure, including:

• Secure HTTPS connection (SSL/TLS encryption) for all communications with the website;
• Access to stored data is restricted exclusively to authorised persons;
• Regular updates to the WordPress platform and installed plugins;
• Secure access credentials and protected authentication for the administration panel.

In the event of a security incident affecting your data that poses a high risk to your rights and freedoms, you will be notified in accordance with Art. 34 GDPR.

9. Data relating to minors

The website www.ralucaanderco.ro is not intended for persons under the age of 18 and does not knowingly collect personal data from minors. If you become aware that a minor has provided data through our website, please contact us at raluca@ralucaanderco.ro so that it may be deleted.

10. Links to third-party websites

The website may contain links to other websites. This Privacy Policy applies exclusively to www.ralucaanderco.ro. We are not responsible for the privacy practices of third-party websites and recommend that you review their privacy policies before providing any personal data.

11. Changes to this policy

We reserve the right to update this Privacy Policy at any time, displaying the date of the most recent update. Changes take effect upon publication on the website.

In the event of material changes affecting your rights, you will be notified by appropriate means (e.g. a prominent notice on the website). We recommend checking this page periodically.

12. Contact and complaints

For any questions, requests, or concerns relating to the processing of your personal data, please contact us:

• Email: raluca@ralucaanderco.ro
• Phone: +40 742 353 983
• Professional address: Bucharest, Sector 5, Romania

12.1 Right to lodge a complaint with the supervisory authority

If you consider that the processing of your personal data infringes the GDPR or applicable Romanian law, you have the right to lodge a complaint with the national supervisory authority:

• National Supervisory Authority for Personal Data Processing (ANSPDCP)
• Address: B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest
• Email: anspdcp@dataprotection.ro
• Website: www.dataprotection.ro

You also have the right to bring proceedings before the competent courts for the protection of your rights.

This policy is to be read together with the Terms and Conditions and the Cookie Policy published on the website.