GDPR notice

1. The controller

GLOBAL DATA PROTECTION SRL, a Romanian legal entity entered in the National Trade Register Office under no. J23/1513/2018, unique registration code 39146037, provides consultancy services under the trading name dataconsulting.ro. We are a controller of personal data within the meaning of Regulation (EU) 2016/679 (GDPR).

Single point of contact for any request concerning personal data: office@dataconsulting.ro.

2. Categories of data processed

In the course of our GDPR, AI Act and NIS2 consultancy work, we process the following categories of personal data: identification data (name, surname, position), contact data (email, phone, postal address), employer data (name, registration number, registered office), contractual and financial data (contract content, invoices, payments), electronic correspondence and recordings of consultancy sessions made with the agreement of the parties.

We do not routinely process special categories of data (health data, biometric data, political opinions and so on), except where they are expressly provided to us in the course of consultancy projects for sensitive sectors (for example medical clinics or financial institutions).

3. Lawful basis

We process personal data in the course of our consultancy work, on the following lawful bases provided by Regulation (EU) 2016/679:

Article 6(1)(b) — processing is necessary for the performance of the service contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract (quotes, proposals, the free audit).

Article 6(1)(c) — processing is necessary for compliance with our legal obligations, in particular tax and accounting obligations (the Romanian Tax Code, Accounting Law no. 82/1991), reporting obligations to authorities and document retention obligations.

Article 6(1)(f) — our legitimate interest in managing commercial relationships, promoting our services to existing clients and keeping our IT infrastructure secure. These interests are reviewed periodically through balancing tests (legitimate interest assessments).

Article 6(1)(a) — the explicit consent of the data subject, where the processing is not covered by the bases above (for example, direct marketing communications to new prospective clients).

4. Purposes

Data is processed solely for purposes connected with our consultancy work: delivering the contracted services (audit, GDPR and AI Act implementation, outsourced DPO, training), invoicing and collecting payment, meeting accounting and tax obligations, communicating with current and prospective clients during projects, handling quote requests and free audits, maintaining commercial relationships after the contract and, with prior consent, sending marketing communications about our services.

We do not process data for purposes incompatible with those stated. We do not use automated decisions producing legal effects concerning you (automated profiling).

5. Recipients

Your data may be passed to or accessed by the following categories of recipients, solely to the extent needed for the purposes above: IT service providers (hosting, email, cloud infrastructure), acting as processors under data processing agreements in accordance with Article 28 GDPR; the accounting firm that keeps our financial records; law firms, where legal advice on a matter is needed; competent public authorities (ANAF, ANSPDCP, the courts), solely on the basis of an express legal obligation.

We do not sell, rent or transfer your data to third parties for commercial purposes.

6. International transfers

As a rule, your data is processed within the European Economic Area. Where we use IT providers with infrastructure outside the EEA, we ensure appropriate safeguards are in place under Chapter V GDPR (a European Commission adequacy decision or Standard Contractual Clauses).

7. Retention periods

Contractual data and related correspondence: for the duration of the contract plus 10 years after it ends, in line with the general limitation period and accounting archiving obligations (Accounting Law no. 82/1991).

Tax documents and invoices: 10 years from the end of the financial year, under the Tax Code.

Prospective client data (quotes, free audit, contact forms): 3 years from the last interaction, or earlier if you ask us to delete it.

Direct marketing data: until you withdraw your consent.

Session recordings: 6 months after the project ends, solely for internal quality review of the consultancy.

8. Your rights

As a data subject, you have the following rights under Chapter III of Regulation (EU) 2016/679:

• Right of access (Art. 15 GDPR) — you can obtain confirmation that we process your data and a copy of it
• Right to rectification (Art. 16 GDPR) — you can ask for inaccurate or incomplete data to be corrected
• Right to erasure, or “right to be forgotten” (Art. 17 GDPR) — under the conditions set by the Regulation
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) — for data you provided on the basis of consent or contract
• Right to object (Art. 21 GDPR), in particular to processing based on legitimate interest or for direct marketing
• Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR)
• Right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3) GDPR)

To exercise any of these rights, write to us at office@dataconsulting.ro. We will reply without undue delay and in any event within one month of receiving the request. That period may be extended by two further months under Article 12(3) GDPR, in which case we will inform you within the first month.

9. Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your personal data infringes the GDPR.

In Romania, the competent authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

10. Changes to this notice

We may update this notice from time to time to reflect changes in how we process data or in the applicable law. The current version is always available at this address, and substantial changes will be communicated to active clients by email.