Privacy Notice

Last updated: 8 November 2026. This notice is given under Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR) and Romanian Law no. 190/2018. It covers the personal data processed through the frandes.law website, including the chat assistant, the contact form and the free tools.

1. Who we are

The controller for the processing described in this notice is:

Insolvency and restructuring work is carried out by a separate professional office led by the same practitioner:

If an enquiry you send through this website concerns an insolvency or restructuring matter and the insolvency office takes it on, that office is the controller of the data in the resulting file.

We do not have a data protection officer. For any question about your data, write to office@frandes.law.

2. Confidentiality

Information you entrust to us in connection with a possible matter is kept confidential and is covered by the professional secrecy of lawyers under Article 11 of Law no. 51/1995, and, for insolvency matters, by the confidentiality duties of insolvency practitioners. This applies whether or not you later instruct us.

The chat assistant on this website is an automated AI system. Its messages are processed by the AI providers listed in section 5. Please do not use it to share confidential details of your matter. Write to us at office@frandes.law instead.

3. What data we process and why

3.1 Chat assistant

When you use the chat assistant, your browser sends the text of the conversation (your messages and the assistant's earlier replies, up to the last 20 messages) and the language of the page to our server. Our server receives your IP address as part of the connection.

Our server forwards the conversation to an AI model, which generates the reply. The model normally used is provided by Mistral AI (France). If Mistral rejects a request, our server may send it to an equivalent model provided by Microsoft (Azure OpenAI Service) or Google (Vertex AI, Gemini), in both cases processed in the European Union.

We do not store the content of chat conversations on our server and do not write it to our logs. The conversation is kept only in your browser's memory and disappears when you close or leave the page. Your IP address is used only for short-lived counters in memory that prevent abuse (see section 3.5); it is not written to our logs.

Purpose: to answer your questions about the firm, its practice areas and its services, and to keep the service free of abuse.

3.2 Consultation requests made through the chat

If you ask the assistant to arrange a call or meeting and give your name and email address, the assistant sends a consultation request to our inbox at office@frandes.law. The request is an email sent through Resend and contains:

• your name and email address;
• your phone number and preferred time, if you gave them;
• a category for the matter and a one-line description of the topic, both written by the assistant from your messages;
• the language of the page.

The assistant is instructed not to include facts of your matter in this request.

Purpose: to contact you and arrange the consultation you asked for.

3.3 Contact form

When you submit the contact form, we receive your name, email address, phone number (optional), your message and the language of the page, Our server sends them by email, through Resend, to office@frandes.law, and keeps no copy.

If the email cannot be sent, for example because the daily sending limit has been reached, your message is not kept. The form tells you so and asks you to write to us directly at office@frandes.law.

Purpose: to answer your enquiry and to assess whether we can act for you.

3.4 CUI lookup in the CAEN migration tool

When you look up a company by its fiscal code (CUI) in the CAEN migration tool, your browser sends the CUI to our server as part of the web address requested. Our server answers from its own copy of public data published by the National Trade Register Office (ONRC open data) and by the National Agency for Fiscal Administration (ANAF). The CUI is not recorded in our logs.

A CUI is normally company data. If it belongs to a sole trader or another form of business run by an individual (PFA, II, IF), it may relate to an identifiable person.

Purpose: to show publicly registered company information that helps with CAEN Rev.3 migration.

3.5 Server logs and abuse prevention

This website is hosted by RoLeaf (Cloud Forest Infrastructure SRL, Buzău, Romania). Its web server records each visit in an access log: your IP address, the date and time, the page or file requested and the identification string of your browser. RoLeaf keeps this log for the security of its servers and for troubleshooting, and deletes it automatically after at most 90 days. For the chat, the contact form and the CUI lookup, our own API server keeps no access log, only an error log, which records your IP address when a request fails and is deleted automatically after 3 days. Our application writes technical log lines (for example, that a message was sent and how long it was) without your IP address and never with the content of your messages.

To prevent abuse, our server keeps counters per IP address in memory, for short time windows, and may block an IP address temporarily after repeated misuse. These counters are not written to disk.

When a page of this website loads, your browser also opens a connection to our API server, which handles the chat, the contact form and the CUI lookup. That server is run by us at Hostinger, separately from the hosting of the website.

Purpose: security of the website and its server, abuse prevention and troubleshooting.

3.6 Tools that run in your browser

The cap-table tool, the Civil Code term calculator, the insolvency timeline generator, the capital-markets AGM calendar and the CAEN code search run entirely in your browser. What you enter is not sent to our server or to anyone else. Files you save from these tools (PDF, CSV or calendar files) are generated in your browser and saved directly to your device.

3.7 Fonts, styles and the office map

All fonts, style sheets, scripts and images of this website, including the static map of our office on the contact page, are served from our own server. The website loads no resources from third parties. The links to Google Maps and Apple Maps on the contact page open those services only if you click them; from that point, the processing is governed by those providers.

4. Legal bases

We rely on the following legal bases under Article 6(1) GDPR:

• Article 6(1)(b), steps taken at your request before entering into a contract: processing your contact form message and any consultation request made through the chat, so that we can answer you and assess whether we can act for you.
• Article 6(1)(f), legitimate interests: answering your questions through the chat assistant, including the use of a backup AI model when the main one is unavailable; operating the CUI lookup; keeping the server's error log and abuse-prevention counters. Our interests are to provide the website and its functions, to keep them secure and free of abuse, and to answer every enquiry we receive. We consider these interests are not overridden by yours, because the data is limited, is not used for profiling or marketing and is kept only as long as needed.

We do not rely on consent for any of the processing described here, and we do not send marketing messages.

Are you required to give us your data? No. Using the chat, the contact form and the tools is entirely voluntary, and no law or contract requires you to provide personal data. Without a name and an email address or phone number we cannot reply to your enquiry. Your IP address is necessarily processed whenever your browser connects to a website.

5. Recipients and transfers outside the EEA

We use the following service providers, who process data on our behalf as processors under Article 28 GDPR:

Where a provider or its group is based in the United States, transfers rely on the EU-US Data Privacy Framework for certified companies and on Standard Contractual Clauses (Article 46(2)(c) GDPR). You can ask us for information about these safeguards at office@frandes.law.

We disclose data to public authorities only where the law requires it. A full list of the providers we use, including those used for client work, is on our Processors page.

6. How long we keep data

7. Your rights

Under the GDPR and Law no. 190/2018 you have the right to:

• access your personal data and receive a copy of it (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17), unless we must keep it, for example under the rules of the legal profession;
• restrict processing (Article 18);
• receive data you gave us in a portable format, where the processing is based on a contract or on steps taken at your request and is automated (Article 20);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Article 21). We will then stop, unless we show compelling legitimate grounds that override your interests or need the data for legal claims.

We will tell the recipients of your data about any correction, erasure or restriction, unless this is impossible or involves disproportionate effort (Article 19).

To exercise these rights, write to office@frandes.law or to our office address. We will reply within one month of receiving your request. This period can be extended by two further months for complex or numerous requests, in which case we will tell you within the first month. Exercising your rights is free of charge. Under Article 12(5) GDPR, if a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee based on our administrative costs or refuse to act on it. Under Article 15(3), we may charge a reasonable fee for any further copies you request. We may ask you for information to confirm your identity.

8. Complaints

You have the right to lodge a complaint with the Romanian supervisory authority:

You may also complain to the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place, and you may go to court.

9. Automated decisions

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). The chat assistant gives general information only and decides nothing about you. More on how we use AI is on our AI transparency page.

10. Cookies and browser storage

This website sets no cookies and writes nothing to your browser's local or session storage. We use no analytics, tracking pixels or advertising tools. Details are on our Cookies and storage page.

11. Changes to this notice

We update this notice when our processing or the law changes. The date at the top shows the latest version. If a change is significant, we will say so on this website.

12. Contact

For any question about this notice or about your data, write to office@frandes.law or to our office address in section 1.