Privacy Policy

Last updated: October 2026.

This policy explains how the personal data of people who visit this website or send a message through the contact form is processed, in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Romanian law.

1. Data controller

Cabinet de Avocat Florina Zamfir Professional office: Bucharest, Blvd. Ferdinand I, no. 126 Email: office@zamfir-legal.com Phone: +40 737 510 560

For any question about data processing, you can contact us at the email address above.

2. What data we collect, for what purpose and on what legal basis

a) The contact form

When you send a message through the form we collect: your name, email address, phone number (optional) and the content of your message.

• Purpose: to receive your request and reply to it; where appropriate, to arrange a consultation.
• Legal basis: your consent, given by ticking the box in the form [Art. 6(1)(a) GDPR], and taking steps at your request prior to entering into a contract [Art. 6(1)(b) GDPR].
• Please do not include confidential or sensitive details about your legal situation in the form. The form is only for initial contact; details are discussed afterwards, in a protected setting.

b) Server technical logs

The hosting server automatically records technical data: IP address, browser type, date and time of access, pages requested.

• Purpose: operation and security of the website, prevention of abuse.
• Legal basis: the controller's legitimate interest in keeping a secure and functional website [Art. 6(1)(f) GDPR].

c) Cookies

The website uses a single cookie, strictly necessary for technical reasons (see section 7). We do not use analytics, advertising or tracking cookies.

3. How long we keep the data

• Contact form messages: at most 12 months from the last correspondence, if no engagement follows. If the request leads to a legal assistance contract, the related data is kept in accordance with the legal and professional obligations applicable to lawyers.
• Server logs: for the period set by the hosting provider, typically around 30 days.
• The session cookie: deleted automatically after 30 minutes of inactivity or when the browser is closed.

4. Who we disclose data to

Data is not sold and is not disclosed to third parties for marketing purposes. It may be accessed by:

• the web hosting provider (Hostinger), which operates the server hosting the website, on servers located in the European Union;
• the email service provider, through which the form message is delivered to the practice.

These providers act as processors and process the data only in accordance with the controller's instructions.

5. Transfers outside the European Economic Area (EEA)

We do not carry out transfers of data outside the EEA. The website is hosted on servers located in the European Union.

6. Your rights

As a data subject, you have the right:

• of access to your data;
• to rectification of inaccurate data;
• to erasure of the data ("right to be forgotten");
• to restriction of processing;
• to data portability;
• to object to processing based on legitimate interest;
• to withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, send a request to office@zamfir-legal.com. We will respond to your request within the time limit set by the GDPR, as a rule within one month of receiving it.

You also have the right to lodge a complaint with the supervisory authority:

National Supervisory Authority for Personal Data Processing (ANSPDCP) B-dul General Gheorghe Magheru no. 28–30, Sector 1, Bucharest, Romania anspdcp.ro

7. Cookies — details

Cookie	Provider	Purpose	Duration
grav-site-…	this website	keeps the visitor's session and protects the contact form against fraudulent submissions (CSRF)	30 minutes / browser close

This cookie is strictly necessary for the website to function and, under applicable law, does not require prior consent. It cannot be disabled from the site, but it can be blocked in the browser settings (some features, such as the contact form, may be affected).

If in the future we introduce traffic analytics or other technologies that are not strictly necessary, we will update this policy and ask for your consent through a dedicated mechanism.

For more information, see our Cookie Policy.

8. Security

We apply reasonable technical and organisational measures to protect data against unauthorised access, loss or disclosure. Data submitted through the form is transmitted over an encrypted connection (HTTPS).

9. Automated decisions

We do not make decisions based solely on automated processing of data, and we do not carry out profiling.

10. Professional secrecy

Independently of this policy, communications between a lawyer and a client are protected by the lawyer's professional secrecy, under Law no. 51/1995 on the organisation and practice of the profession of lawyer.

11. Changes to this policy

This policy may be updated from time to time. The version in force is the one published on this page, with the last-updated date shown at the top.