Privacy

Who is responsible for your data

The LA RECE service is provided by First Principle law firm, registered with the Bucharest Bar as PATRICIU – Societate Civilă de Avocați, tax identification number RO38960435, Bucharest, Sector 1, Calea Victoriei no. 155, building D1, section 5, floor 6, apartment A6. For requests concerning your data: contact@la-rece.ro.

What data we use

Identification and contact details, questionnaire responses, uploaded documents, correspondence, legal findings, and contracting and billing data. Documents may contain information about sellers, representatives and other people involved. We receive this data from you and, where necessary and permitted, from documents or sources consulted for the case. Send only relevant information; health data or other sensitive information should be included only if necessary for the review.

Purposes and legal bases for processing

We use the data for steps you request before contracting and for performance of the agreement, for legal and professional obligations, and for legitimate interests relating to the security of the service and the defence of rights. Where the case requires processing special categories of data for the establishment, exercise or defence of a right, the lawyer assesses necessity separately. Providing the information needed for contracting and the review is a condition of the service; without it, we may be unable to accept or analyse the case.

How we protect documents

Connections use HTTPS. Documents are encrypted and kept in private Hostinger storage, outside the public website directory. The questionnaire, reports and lawyer’s notes are also encrypted; not all technical case administration fields are encrypted. Lawyer access requires a password and authentication code. No technical measure can eliminate every risk.

Who sees the report

The Client can access their own case and the final version approved and published for them. The preliminary report, internal note and unpublished versions remain private in the lawyer’s area. Keep access links and credentials confidential. We do not publish documents on the website.

AI-assisted analysis

We use the OpenAI API for the three assisted drafting stages. Relevant documents and necessary data are transmitted to the service; the lawyer reviews the results and separately approves publication. We do not make a final legal decision solely through automated processing. OpenAI states that API data is not used for training by default without an express data-sharing opt-in. The application disables storage of the response for reuse through the API; this does not mean zero retention. The provider may ordinarily retain abuse-monitoring logs for up to 30 days, subject to the legal and security exceptions in its policy. We do not claim that OpenAI processing takes place exclusively in the EU.

Antivirus scanning

We use attachmentAV through its European endpoint. The original is transmitted over an encrypted connection, without a public link or the original filename. The provider states that processing takes place in the EU region and the file is deleted before the response. Until a favourable result is associated with the exact file, access and use for analysis are blocked. Detection, an error or exhaustion of the quota maintains this block and keeps the original private. We accept PDF, JPEG, PNG and WebP, up to 10 MB per file. You must convert HEIC/HEIF before uploading.

Providers and communications

Hostinger provides hosting and email; OpenAI assists the analysis, and attachmentAV scans the files. Stripe processes payment, while SmartBill issues the invoice and handles the configured fiscal transmission to ANAF. Only the data necessary for payment and invoicing is communicated to those providers, not the legal documents in the case. Backblaze B2, in the EU region, receives only copies that have already been encrypted, without the application key. Recipients may also include authorities or professionals to the extent required by the engagement or an applicable obligation. We do not automatically send the request email to the seller; you review and send it.

International transfers

Selecting an EU region for scanning and backup does not mean that all provider operations are limited to the EU. In particular, the OpenAI service and support or subcontracting operations may involve processing outside the European Economic Area. The transfer mechanisms provided in the providers’ terms apply, as appropriate, including adequacy decisions or standard contractual clauses. You may request information and copies of the applicable safeguards at contact@la-rece.ro.

Preparation cases without an order

For an optional preparation case that has not become an order and has no agreement, payment, report or service deadline, a review for controlled deletion takes place after 90 days from the client’s last activity. An authenticated return to the case and updates from the client record activity; lawyer or automated operations do not, by themselves, extend this period. Review does not mean immediate or automatic deletion. Any concrete, justified ground for retention is recorded together with a new review date; there is no promise of unlimited retention. The rules for contracted cases, reports, agreements, accounting records and backups remain as set out below.

Access and retention

Client access to the report lasts for 90 days after delivery. The professional case file is archived for one year after the service ends; freezing documents for analysis does not end the service. At expiry, documents that no longer need to be retained are reviewed and deleted. Agreements, tax records and information needed for disputes or legal obligations are retained separately for as long as those purposes require. An exception does not automatically extend retention of the entire case. Expiry of access does not mean deletion of the documents.

Backups

Backups are encrypted and intended for recovery following an incident, with restricted access. Deletion from the current case does not instantly remove content from copies already created. For external daily backups, the rotation rule hides the copy 30 days after upload and schedules its deletion after a further day, subject to the provider’s processing. This rotation is separate from the professional archive; on restoration, subsequent deletions and restrictions are reapplied.

Your rights

You may request access, rectification, erasure, restriction or portability, and may object, under the applicable conditions. If processing is based on consent, you may withdraw it for the future. Write to contact@la-rece.ro; we may request proportionate information to verify your identity. These rights apply taking account of legal obligations, professional secrecy and other people’s rights. You may lodge a complaint with ANSPDCP.

Necessary cookies and your choice

LA RECE uses necessary cookies to operate the website, protect forms and provide access to your case file. They are not used for advertising. The larece_session cookie maintains your session. The la_rece_consent cookie remembers your advertising-measurement choice for up to 180 days from your last explicit choice; simply visiting the website does not extend that period.

We also use technical browser markers to respect a refusal and communicate changes between open tabs. They remain valid for up to 180 days from your explicit choice, without renewal on visits, and are not used for advertising tracking. They are no longer valid after expiry: the website deletes them from your browser when the page is active or next runs if it has been closed or suspended. The website cannot delete local storage while it is not running. An expired choice does not mean acceptance: measurement remains off until you give consent again.

Optional advertising measurement

Only if you agree, we use Google Ads to understand whether advertisements lead to a successfully submitted question or a confirmed payment. Before consent, we do not load the advertising tag or send requests to Google Ads. You can refuse without losing access to the website or the LA RECE service.

We do not use this integration for Google Analytics, personalised advertising or matching your contact details to a Google account. The tag does not load in private case files, documents, reports or internal dashboards. A payment conversion is measured on a separate confirmation page accessible only to the authorised customer.

What data is used

Google may receive technical connection and browser data, including your IP address, advertising identifiers and the fact that a question was submitted or a payment was confirmed. For a payment, we send the actual amount in Romanian lei and an opaque transaction identifier used to prevent duplicate counting. We do not assign a monetary value to a question.

We do not include your name, email address, telephone number, message, apartment address, case identifier, access tokens, documents or legal conclusions in these events. We do not describe technical identifiers as anonymous data.

How long we keep our records

To prevent duplicate reporting, we retain a minimal conversion register in our active database for 90 days from the time an event is recorded for dispatch. The register contains the opaque identifier, event type, recording time and an internal reference to the consent record. It does not contain your documents or question text. Keeping this duplicate-prevention marker does not authorise new transmissions after you withdraw consent.

To demonstrate your choice, we keep a separate minimal record: a dedicated random identifier, your choice, the date and time, the purposes accepted, the language and the version of the notice presented. We do not collect your name, email address, IP address, detailed browser information or case data in this record. Evidence of consent and its withdrawal is kept while consent remains valid and then for three years after it expires, is withdrawn or is replaced. A refusal without any previous consent is retained for up to 180 days. Where a specific dispute exists, the strictly necessary evidence may be retained while that dispute is resolved.

The minimal choice records and copies of the notices presented can be recovered from encrypted backups managed by the application, with restricted access, kept separately from the legal archive. Local copies managed by the application, including those created manually through it, have a 30-day rotation period. External copies managed by the application have their own rotation policy; residual records in these local and external copies may not remain more than 31 additional days after deletion from the active database. The conversion register is excluded from backups managed by the application. Restoration preserves recovered historical evidence within its retention limits, without reactivating consent or retransmitting old conversions. If a copy does not contain later changes to a choice, we conservatively limit the retention of that evidence without inventing a withdrawal. We do not delete or shorten the legal archive or the retention of agreements or invoices to apply these rules.

Separately, for backups, snapshots or database dumps managed directly by Hostinger, the data included and the retention and deletion periods are still being clarified with the provider. The 31-day limit and exclusion of the conversion register described above concern copies managed by the application; we do not present them as confirmed for copies managed directly by Hostinger.

In the website configuration checked, the Google _gcl_au cookie has a lifetime of 30 days. The website is configured not to extend that period automatically on a visit. Google states a standard lifetime of 90 days for the _gcl_* family; the lifetime of other attribution cookies that may appear after an ad click has not yet been confirmed. See Google’s cookie explanation. A cookie’s lifetime is not the retention period for data already received by Google; its processing and retention are described in Google’s privacy policy.

Google and international data transfers

For the standard Google Ads service used here, Google Ireland Limited acts as an independent controller for its processing under the applicable service terms. Google and its entities may also process data outside the European Economic Area, including in the United States. We do not represent that this measurement takes place exclusively in the EU.

Google describes the mechanisms it uses for transfers, including the EU–US Data Privacy Framework for covered transfers and standard contractual clauses where applicable. Consent to measurement does not replace the safeguards required for transfers. See Google’s transfer information and data protection terms. You can request information about the applicable safeguards from contact@la-rece.ro.

How to refuse or withdraw consent

Choose “Refuse measurement” or change your choice at any time through “Privacy preferences”. Withdrawal stops new conversion transmissions and removes Google attribution cookies accessible to the website. It does not affect the legal service and does not automatically delete data already received by Google. For requests about that data or to exercise the rights described in this policy, contact contact@la-rece.ro.