Privacy
Updated on 14 September 2026.
Who is responsible for your data
The LA RECE service is provided by First Principle law firm, registered with the Bucharest Bar as PATRICIU – Societate Civilă de Avocați, tax identification number RO38960435, Bucharest, Sector 1, Calea Victoriei no. 155, building D1, section 5, floor 6, apartment A6. For requests concerning your data: contact@la-rece.ro.
What data we use
Identification and contact details, questionnaire responses, uploaded documents, correspondence, legal findings, and contracting and billing data. Documents may contain information about sellers, representatives and other people involved. We receive this data from you and, where necessary and permitted, from documents or sources consulted for the case. Send only relevant information; health data or other sensitive information should be included only if necessary for the review.
Purposes and legal bases for processing
We use the data for steps you request before contracting and for performance of the agreement, for legal and professional obligations, and for legitimate interests relating to the security of the service and the defence of rights. Where the case requires processing special categories of data for the establishment, exercise or defence of a right, the lawyer assesses necessity separately. Providing the information needed for contracting and the review is a condition of the service; without it, we may be unable to accept or analyse the case.
How we protect documents
Connections use HTTPS. Documents are encrypted and kept in private Hostinger storage, outside the public website directory. The questionnaire, reports and lawyer’s notes are also encrypted; not all technical case administration fields are encrypted. Lawyer access requires a password and authentication code. No technical measure can eliminate every risk.
Who sees the report
The Client can access their own case and the final version approved and published for them. The preliminary report, internal note and unpublished versions remain private in the lawyer’s area. Keep access links and credentials confidential. We do not publish documents on the website.
AI-assisted analysis
We use the OpenAI API for the three assisted drafting stages. Relevant documents and necessary data are transmitted to the service; the lawyer reviews the results and separately approves publication. We do not make a final legal decision solely through automated processing. OpenAI states that API data is not used for training by default without an express data-sharing opt-in. The application disables storage of the response for reuse through the API; this does not mean zero retention. The provider may ordinarily retain abuse-monitoring logs for up to 30 days, subject to the legal and security exceptions in its policy. We do not claim that OpenAI processing takes place exclusively in the EU.
Antivirus scanning
We use attachmentAV through its European endpoint. The original is transmitted over an encrypted connection, without a public link or the original filename. The provider states that processing takes place in the EU region and the file is deleted before the response. Until a favourable result is associated with the exact file, access and use for analysis are blocked. Detection, an error or exhaustion of the quota maintains this block and keeps the original private. We accept PDF, JPEG, PNG and WebP, up to 10 MB per file. You must convert HEIC/HEIF before uploading.
Providers and communications
Hostinger provides hosting and email; OpenAI assists the analysis, and attachmentAV scans the files. Stripe processes payment, while SmartBill issues the invoice and handles the configured fiscal transmission to ANAF. Only the data necessary for payment and invoicing is communicated to those providers, not the legal documents in the case. Backblaze B2, in the EU region, receives only copies that have already been encrypted, without the application key. Recipients may also include authorities or professionals to the extent required by the engagement or an applicable obligation. We do not automatically send the request email to the seller; you review and send it.
International transfers
Selecting an EU region for scanning and backup does not mean that all provider operations are limited to the EU. In particular, the OpenAI service and support or subcontracting operations may involve processing outside the European Economic Area. The transfer mechanisms provided in the providers’ terms apply, as appropriate, including adequacy decisions or standard contractual clauses. You may request information and copies of the applicable safeguards at contact@la-rece.ro.
Access and retention
Client access to the report lasts for 90 days after delivery. The professional case file is archived for one year after the service ends; freezing documents for analysis does not end the service. At expiry, documents that no longer need to be retained are reviewed and deleted. Agreements, tax records and information needed for disputes or legal obligations are retained separately for as long as those purposes require. An exception does not automatically extend retention of the entire case. Expiry of access does not mean deletion of the documents.
Backups
Backups are encrypted and intended for recovery following an incident, with restricted access. Deletion from the current case does not instantly remove content from copies already created. For external daily backups, the rotation rule hides the copy 30 days after upload and schedules its deletion after a further day, subject to the provider’s processing. This rotation is separate from the professional archive; on restoration, subsequent deletions and restrictions are reapplied.
Your rights
You may request access, rectification, erasure, restriction or portability, and may object, under the applicable conditions. If processing is based on consent, you may withdraw it for the future. Write to contact@la-rece.ro; we may request proportionate information to verify your identity. These rights apply taking account of legal obligations, professional secrecy and other people’s rights. You may lodge a complaint with ANSPDCP.
Cookies and sessions
The application uses technical cookies for authentication, form protection and session continuity. We do not use advertising cookies in the application. External services opened separately, such as the Stripe payment page, have their own notices.
Details: data processing through the OpenAI API · attachmentAV security · ANSPDCP.