June 2018
Your privacy is important to us. This Privacy Policy explains how we handle and treat your personal data when you apply for a position within our company.
- Purpose of this Policy
- Who are we and what do we do
- How to contact us
- What personal data do we collect
- How do we use your personal data
- What is our legal basis to use or process your personal data
- Who do we share your personal data with
- Third party contractors and other controllers
- Where do we transfer your data to
- How long do we keep your personal data for
- Confidentiality and the security of your personal data
- How to access your data and your other rights
- Changes to this Privacy Policy
1. Purpose of this Policy
This Privacy Policy (“Privacy Policy”,”Policy”) explains our approach to any personal data that we collect from you or which we have obtained about you from a third party and the purposes for which we process your personal data. It also sets out your rights in respect of our processing of your personal data.
This Privacy Policy will inform you of the nature of your personal data that is processed by us and how you can request that we delete, update, transfer and/or provide you with access to it.
In this Privacy Policy we use the term “processing” to cover all activities involving your personal data, including the collection, handling, storage, sharing, access, use, transfer and removal of data.
This Privacy Policy is intended to assist you in making informed decisions when you apply to work at or with Vlănțoiu și Asociații. Please take a moment to read and understand it.
2. Who are we and what do we do
Vlănţoiu şi Asociaţii, hereinafter referred to as the “Company” or “We”, is a law firm that provides legal services to clients in accordance with the relevant laws of Romania and of the European Union, located in bd. Unirii nr. 45, bl. E3, sc. 5, et. 8-9, ap. 141, Bucharest, sector 3, legally represented by Mrs. Andreea Vlănţoiu, as a Managing Partner.
Vlănţoiu and Asociaţii is part of a global lawyer’s network, Linet SRL (Limited) C.F. / P.IVA 10187800965 – REA MI – 2511888, Via Roald Amundsen 5 20148 Milan, represented legally by Mr. Pierangelo Grassi. LINET does not itself provide legal or other services to customers.
3. How to contact us
If you have any questions about this Privacy Policy or want to exercise your rights set out in this Privacy Policy, please contact us by sending an email to: privacy@vlantoiu.ro
4. What personal data do we collect
Vlănțoiu și Asociații may collect personal data about candidates from the following sources:
- Directly from you – for example, information that you have provided when applying for a position directly, through the firm’s website or by using our mailing address
- From recruitment agencies – for example, when a recruitment agency contacts us to identify you as a potential candidate
- Through publicly available sources online – for example, where you have a professional profile posted online (e.g. on your current employer’s website, a recruitment platform or on a social networking site like LinkedIn)
- By reference or word of mouth – for example, through a reference from former employee/employer or from a referee who recommended you
a) The types of personal data that we can process about you are:
- Name, surname
- Domicile and residence address
- Contact details (address, e-mail, phone)
- Citizenship
- Place of birth
- Date of birth
- Education and qualifications, academic records
- Work history (activity data, previous employers (or similar), name and grade of occupied positions, employment interval, etc.)
- Other personal data contained in CVs and / or letters of intent; they may include, in addition to the data listed elsewhere in the enumeration, without limitation: civil status, children, military service, driving license, gender, known languages, projects you have contributed to, skills and abilities, nationality, third party recommendations, distinctions, hobbies, and similar
- The personal data you have provided on employment forums, LinkedIn (or other social network publicly available) or to third parties such as recruitment agencies
- Our contact history
- Information regarding or necessary to conclude the employment / collaboration contract (identity card data, basic remuneration / fees, benefits, bonuses, location, working hours, etc.)
- Health problems requiring adaptations of the work environment
- Audio recordings of interviews
- Video recordings of interviews
- Notes from face-to-face interviews
- CCTV images
- Photo (s)
- Details of professional records (such as membership in professional bodies, tax information, professional social insurance, and professional malpractice insurance information)
- Your user on social networks, other online platforms or apps and any other information you choose to make public, which we can find out during the recruitment process
- References and recommendations
- Results of tests and evaluations of any kind
b) Special categories of data
During the process we can observe certain special categories of personal data about you (for example, data on racial or ethnic origin, philosophical or religious beliefs, trade union membership, health or physical or mental information, sexual orientation, etc.) when provided or made public by you or deducted from your CV. We can also process certain special categories of data about you (e.g., physical or mental health information) to make reasonable adjustments to allow our candidates to run for positions within the Company and to ensure that we comply with the legal obligations imposed on us in terms of employment. We will process special categories of data only if this is permissible under the applicable laws, if the processing relates to personal data that is manifestly made public by you or we have obtained your explicit consent.
5. How do we use your personal data
We use your personal data to assess your suitability for any position you may apply for at Vlănțoiu și Asociații, including partner positions, collaborator, co-worker, associated positions, trainee or practice training contract, employee, apprentice, intern, as well as any administrative or service provision, whether such application was received online, on paper or as an application in person.
As part of the recruitment activities, we collect, process and store personal data and special categories of personal data that can identify you directly or indirectly. We process personal data for a number of purposes related to recruitment activities, and this may include managing your application, evaluation and screening before and during a partnership, collaboration, co-working, association, training or practice training contract, employment, apprenticeship or internship with us (all listed below in the generic term “co-optation”).
Vlănțoiu și Asociații uses your personal data to match your skills, experience and education with the specific roles offered by the firm. This information is passed to the relevant hiring managers and persons involved in the recruitment process to decide whether to invite you for interview. Vlănțoiu și Asociații will collect further data from you if you are invited to the interview (or equivalent) stage and onwards.
In connection with our recruitment activities, we may also collect special categories of personal data from candidates where we have an employment law obligation to do so, the information is relevant to their future working environment at Vlănțoiu și Asociații or the future provision of employment benefits, or with the individual’s explicit consent. For example, we may need to collect information about a candidate’s disabilities in order to provide a suitable working environment for that candidate if they are successful in their application.
We process your personal data only if permitted by law for one or more of the purposes listed below. Not all the purposes below will apply to you all the time.
a) Application: The activities carried out during receiving and managing applications, including examining general applications or applications for certain positions, and processing data in order to subscribe you to open position alerts within the company. This may involve processing the CV, name, address, employment history, academic and professional qualifications, age, including gender, nationality or similar;
b) Assessment: the activities carried out during the suitability assessment of the candidate for roles in the Company, which may involve the processing of your CV, tests (such as professional capacity assessment tests, skills or personality tests), interview (face-to-face, on the telephone, or video), behavioural assessments (such as role plays, group exercises, or presentation);
c) Candidate searches: during our search activities, we may use the personal data we have collected about candidates to identify the professional opportunities we think that might be of interest. It is possible to contact prospective candidates from time to time with regard to such opportunities. It is also possible to contact individuals from time to time to request names or other personal information about potential candidates in a search we are doing.
6. What is our legal basis to use or process your personal data
If we use your personal data in the recruitment process, it is in connection with the fact that it is our legitimate interest to analyse your application to assess your suitability for any position you may apply for at Vlănțoiu și Asociații.
If we use your personal data as part of the process of employment or concluding a collaboration, it is related to the fact that we are acting at your request to conclude a contract that we may have with you. The failure to provide this information leads automatically to the impossibility of concluding and / or executing the contract.
In connection with our recruitment activities, we can also process special categories of personal data from candidates when:
- processing is required to meet our specific employment obligations (health data, for example)
- you have given explicit consent to the processing of this personal data (e.g. data about a candidate’s disabilities, to provide a suitable work environment for that candidate if recruited)
- processing refers to personal data that is manifestly made public by you (e.g. sexual orientation, philosophical or religious beliefs)
- we can process data on criminal convictions and offenses when processing is authorized by Union or Member State law which provides adequate safeguards for the rights and freedoms of data subjects
7. Who do we share your personal data with
Vlănțoiu și Asociații may share personal data with a variety of the following categories of third parties as necessary: third parties to whom we outsource certain services, such as, without limitation, consulting services of various specialties, document processing and translation, secretarial services, confidential waste disposal, audit, training, IT systems or software providers, IT support service providers, document and information storage providers, cloud providers, marketing and PR agencies, advertising and advertising production, event organization, human resources and payroll companies, security companies and building management bodies, delegates, postal or courier providers assisting us with the delivery of documents related to a situation, or similar.
8. Third party contractors and other controllers
As mentioned above, we may appoint sub-contractor data processors as required, such as, without limitation, consulting services of various specialties, document processing and translation, secretarial services, confidential waste disposal, audit, training, IT systems or software providers, IT support service providers, document and information storage providers, cloud providers, marketing and PR agencies, advertising and advertising production, event organization, human resources and payroll companies, security companies and building management bodies, delegates, postal or courier providers assisting us with the delivery of documents related to a situation, or similar, who will process personal data on our behalf and at our direction. We conduct an appropriate level of due diligence and put in place the necessary contractual documentation in relation to any sub-contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.
It is also possible to transfer and share this information, in accordance with the applicable law, to affiliated or partner entities when it is in our legitimate interest to do so.
9. Where do we transfer your data to
For the processing purposes listed here, and in particular if a foreign element is involved, we may need to transfer your personal data to locations outside the European Economic Area. In any case, before transferring personal data to another jurisdiction, we will ensure that an adequacy decision of the level of protection is in force or that the controller or the processor in that jurisdiction offers adequate safeguards or one of the following exceptions apply:
- you have explicitly expressed your consent to the proposed transfer after you have been informed of the possible risks that such transfers may involve
- the transfer is necessary for the performance of a contract between you and us or for the implementation of pre-contractual measures adopted at your request
- the transfer is necessary for the conclusion or for the performance of a contract concluded in your interest between us and another natural or legal person
- the transfer is necessary for important reasons of public interest
- the transfer is necessary for the establishment, exercise or defence of legal claims
- transfer is necessary to protect your vital interests or others when the data subject is physically or legally incapable of giving consent
- the transfer is made from a register which is intended to provide information to the public and which is open to public consultation
10. How long do we keep your personal data for
We retain the personal data we collect from and about you for as long as it is necessary to fulfil the purpose for which we have collected and to satisfy any legal, accounting, or reporting requirements under our Retention Schedule. In order to determine the appropriate retention period for the personal data we process, we consider the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, legal, accounting, or reporting requirements, and whether we can achieve the scope of processing by other means.
At the expiry date, we may destroy such files without any other notification or liability.
11. Confidentiality and the security of your personal data
We apply appropriate technical, physical and organizational measures that are reasonably designed to protect personal data against unauthorized destruction, loss, alteration, disclosure or access, and against other forms of illegal processing. Access to personal data is limited to authorized recipients based on a need to know basis. We maintain a comprehensive information security program in proportion to the risks associated with the processing. The program is continuously adapted to mitigate operational risks and protect personal data, considering accepted practices in the field. We will also use enhanced security measures when processing any special categories of personal data.
All our partners, employees, consultants, workers, controllers and processors (i.e. those who process your personal data on our behalf for the purposes listed above) who have access to and are associated with the processing of personal data are required to comply with the confidentiality of such personal data, and to guarantee the same level of protection as that provided by the Company.
12. How to access your data and your other rights
a) Your right of access
If you ask us, we’ll confirm whether we’re processing your personal data and, if permitted by the law, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.
b) Your right to rectification
If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we’ve shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
c) Your right to erasure
You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it. If you are entitled to erasure and if we’ve shared your personal data with others, we’ll let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
d) Your right to restrict processing
You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you have objected to the processing. If you are entitled to restriction and if we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
e) Your right to data portability
You have the right, in certain circumstances, to obtain personal data you’ve provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
f) Your right to object
You can ask us to stop processing your personal data, and we will do so, if we are:
- relying on our own or someone else’s legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing
- processing is necessary to carry out a task that is of public interest, unless we can demonstrate compelling legitimate reasons justifying the processing
- processing your personal data for direct marketing purposes.
Vlănţoiu and Associates will never use your personal data to subject you to automated individual decision-making.
g) Your right to withdraw consent
If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
h) Your right to lodge a complaint with the supervisory authority
If you have a concern about any aspect of our privacy practices, including the way we’ve handled your personal data, you can report it to the relevant Supervisory Authority.
Please note that some of these rights may be limited where we have an overriding interest or legal obligation to continue to process the data or where data may be exempt from disclosure due to professional secrecy obligations or the disclosure involves the personal data of third parties.
13. Changes to this Privacy Policy
We may make changes to this Privacy Policy from time to time. To ensure that you are always aware of how we use your personal data we will update this Privacy Policy from time to time to reflect any changes to our use of your personal data. We may also make changes as required to comply with changes in applicable law or regulatory requirements. Where it is practicable, we will notify you by email of any significant changes. However, we encourage you to review this Privacy Policy periodically on our website to be informed of how we use your personal data.