Privacy policy

WHO ARE WE?

We are FISCONTEXPERT CONSULT SRL, a legal entity under Romanian private law, with headquarters in Iasi, Bd. Nicolae Iorga no. 51C, whose main activity is "Accounting and financial audit activities; consulting in the tax field" according to CAEN code 6920. In addition to the basic activity, FISCONTEXPERT CONSULT also carries out other activities related to the main activity, respectively: company formations and changes to legal documents, business consulting, payroll services and personnel management, tax consultancy, other related services.

FISCONTEXPERT CONSULT has both the capacity of Operator (art. 4 point 7 GDPR) in relation to its own employees and business management as well as the capacity of Authorized Person (art. 4 point 8 GDPR) regarding the services provided to clients, which involves the processing of personal data provided by clients according to the provisions of Article 28 GDPR.

FISCONTEXPERT CONSULT as Operator can collect personal data for company presentation (website, marketing, advertising, etc.), for recruitment, for own management, for managing and monitoring own employees, for accounting, for contracting, for getting to know clients.

FISCONTEXPERT CONSULT as an Authorized Person will process personal data in the field of providing services based on a contract or any other legal document: accounting services, payroll and personal management services, tax consulting, company consulting, other related services. FISCONTEXPERT CONSULT as the Authorized Person has the right to process the data received from clients only strictly within the limits and according to the instructions received from clients, based on the service contracts signed with the clients and the GDPR Agreements which can also be signed in the form of additional documents to the existing contracts, known in specialized language as DPA (Data Protection Addendum).

Consequently, compliance with the General Regulation on data protection, no. 679/2016, of an accounting company must be carried out both as an Operator and as an Authorized Person.

HOW DOES THE LAW PROTECT YOU?

Your personal data is protected by law: European Regulation 679/2016 (https://eur-lex.europa.eu/legal-content/RO/TXT/PDF/?uri=CELEX:32016R0679&from=EL), respectively Law 190/2018 (https://www.dataprotection.ro/?page=Legea_nr_190_2018&lang=ro).

The European Regulation says that we are allowed to process personal data only if we have a real reason. This also means the possibility of transmitting them outside our organization. The regulation says that we must have at least one of the following reasons for processing your data:

When we have a commercial (economic) reason to process your personal data, then it is said that there is a "legitimate interest". Whenever such a reason appears, we will inform you. You must know, however, that the existence of our legitimate interest must not be contrary to your interests.

The Regulation and other laws/regulations treat certain personal data as "special/sensitive". Included in this category are information about ethnic or racial origins, faith/religion, health status data, sexual orientation, union membership, records from the criminal record.

We do not collect or process such data without your consent, unless the law allows/obliges us to do so. We will process this type of information only if necessary.

FISCONTEXPERT CONSULT processes the following categories of personal data:

Regarding the Regulation, FISCONTEXPERT CONSULT has adopted the appropriate technical and organizational measures to ensure the protection of personal data and the rights of the persons whose personal data are processed (hereinafter "Data Subject").

In order to fulfill the obligations stipulated by the Regulation, FISCONTEXPERT CONSULT is obliged to inform the Data Subject regarding the details of the processing of personal data.

Let's conclude a contract between us
There must be a legal obligation
To have a well-justified legitimate interest
To protect your vital interests
We have to perform a task in the public interest
When you gave your consent
the personal data in relation to which FISCONTEXPERT CONSULT is the operator, because it determines the purpose and means of their processing;
the personal data in relation to which FISCONTEXPERT CONSULT is the authorized person, because it processes the respective data on behalf of its clients, clients who determine the purpose and means of processing.

WHAT DO WE DO AS AN OPERATOR?

FISCONTEXPERT CONSULT, as Operator, can collect Personal Data for the presentation of the company, for the following purposes:

marketing The purpose of collecting personal data: sending marketing materials (newsletters, invitations to events, etc.) to present the company to clients and potential clients of FISCONTEXPERT;
Legal basis: consent [article 6, paragraph 1, letter a) of the Regulation] and legitimate interest [article 6, paragraph 1, letter f) of the Regulation] - for the commercial purposes of the operator - presentation of the services offered and new services;
Area of application of personal data: first name, last name, title, e-mail, function, telephone number, interests (countries, business areas, type of materials/communication), CVs, other details that the user includes in the available message box;
Recipients: providers of IT services and administrative services at the FISCONTEXPERT CONSULT SRL headquarters only for the purpose of maintenance;
Transfer to a third country: N/A;
Storage period: for the period of the consent of the person concerned or for the period of the contractual relationship (in the case of clients/partners/suppliers);
Targeted persons: contact persons of clients and potential clients of FISCONTEXPERT CONSULT SRL, persons interested in receiving the information that our company offers (newsletters, invitations to events, informative or promotional materials, career opportunities/internships/internships, business opportunities);
Categories of processing: collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, alignment or combination, restriction, erasure or destruction.
Record of candidates who applied for a position within FISCONTEXPERT CONSULT Purpose: keeping records of rejected candidates of FISCONTEXPERT CONSULT;
Legal basis: consent [article 6, paragraph 1, letter a) of the Regulation]
Area of application of personal data: data mentioned in the CV and other additional documents;
Recipients: providers of IT services and administrative services at the FISCONTEXPERT CONSULT SRL headquarters only for the purpose of maintenance;
Transfer to a third country: N/A;
Storage period: for a period of 1 year;
Intended persons: candidates applying for a position within the company
knowing the client Purpose: fulfilling the Operator's obligations resulting from the professional standards and from the legislation for the prevention and combating of money laundering and the prevention of the financing of terrorism;
Legal basis: compliance with a legal obligation [article 6, paragraph 1, letter c) of the Regulation], especially Law no. 129/2019 for the prevention and sanctioning of money laundering, as well as for the establishment of measures to prevent and combat the financing of acts of terrorism, with subsequent amendments and additions;
The field of application of personal data: surname, first name, CNP, date of birth, domicile, possible temporary residence, citizenship, any additional personal data requested in accordance with the special regulations mentioned above;
Recipients: law enforcement authorities (ONPCSB, BNR, ANAF), IT service providers, internal administrative services of the Operator;
Transfer to a third country: N/A;
Storage period: during the contractual relationship and 5 years after its termination;
Targeted persons: statutory bodies (associates, administrators), trustees, contact persons, real beneficiaries of the operator's clients.
contractual documentation Purpose: administration of evidence in the event of a possible dispute with natural persons with whom a contract was concluded, contact persons in the case of contracts with legal persons and natural persons to whom power of attorney was granted;
Legal basis: contract [article 6, paragraph 1, letter b) of the Regulation], legitimate interest [article 6, paragraph 1, letter f) of the Regulation], processing the contact data of the client's employee for the purpose of communication;
The field of application of personal data: name, surname, place of work, domicile, residence, telephone number and e-mail, date of birth, type and number of identity card, bank account, signature;
Recipients: tax authorities, courts, other relevant authorities, banks, IT service providers, internal administrative services of the Operator;
Transfer to a third country: N/A;
Storage period: during the contractual relationship and 10 years after its termination;
Targeted persons: employees of the operator, natural persons with whom a contract was concluded or to whom power of attorney was granted, the client's contact persons.
e-mailPurpose: keeping records of recipients and senders of correspondence;
Legal basis: legitimate interest [art. 6, paragraph 1, letter f) of the Regulation] – to be informed about the date of sending and receiving the e-mail, including the sender and the recipient, in order to protect the rights and interests of the Operator;
Scope of application of personal data: function, name, surname, signature, address, e-mail;
Recipients: IT service providers, internal administrative services within the Operator;
Transfer to a third country: N/A;
Storage period: 5 years after receiving/transmitting the respective correspondence;
Targeted persons: natural persons - senders and recipients of emails.

WHAT DO WE DO AS A PROCESSOR?

FISCONTEXPERT CONSULT SRL, as Authorized Person, will process personal data in the field of providing services based on a contract or any other legal document:

Payroll and human resources services, including recruitment services The purpose of collecting personal data: providing services to fulfill the obligations of the Operator (employer) regarding the recruitment/employment relationship or similar work relationships;
Legal basis: compliance with a legal obligation of the operator [art. 6 paragraph 1 letter c) of the Regulation] based on local legislation and the execution of the contract [art. 6 paragraph 1 letter b) of the Regulation];
Area of application of personal data: personal data required on the basis of special legal regulations provided for in local legislation;
Recipients: social insurance company, health insurance company, tax authorities, private pension insurance company, labor inspectorate, employment agencies, statistics institute, courts, criminal bodies, bailiff, payroll software providers, IT service providers, administrative service providers at the FISCONTEXPERT CONSULT headquarters only for the purpose of maintenance
Transfer to a third country: N/A
Storage period: during the contractual relationship with the operator and, subsequently, for 10 years;
Targeted persons: candidates, employees of the operator, spouses of employees, dependent children of employees, parents of children dependent on employees, close relatives, former employees;
Categories of processing: collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, erasure or destruction
Accounting services The purpose of collecting personal data: maintaining the operator's accounting according to local legislation;
Legal basis: compliance with a legal obligation of the operator [art. 6 paragraph 1 letter c) of the Regulation] based on local legislation;
Area of application of personal data: personal data required on the basis of special legal regulations provided for in local legislation;
Recipients: social insurance companies, health insurance companies, tax authorities, statistics institute, accounting software providers, IT service providers, administrative service providers at FISCONTEXPERT CONSULT headquarters only for the purpose of maintenance
Transfer to a third country: N/A
Storage period: during the contractual relationship with the operator and, subsequently, for 10 years
Targeted persons: employees, statutory bodies and associates of the operator, external trainers and trainees
Categories of processing: collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, erasure or destruction
Fiscal consulting services Purpose of personal data collection: provision of fiscal consulting services according to local legislation
Legal basis: compliance with a legal obligation of the operator [art. 6 paragraph 1 letter c) of the Regulation] based on local legislation
Area of application of personal data: personal data required on the basis of special legal regulations provided for in local legislation
Recipients: Social insurance companies, health insurance companies, tax authorities, accounting software providers, IT service providers, administrative service providers at FISCONTEXPERT CONSULT headquarters for maintenance purposes only
Transfer to a third country: N/A
Storage period: during the contractual relationship with the operator and, subsequently, for 10 years
Targeted persons: employees, statutory bodies and associates of the operator, external trainers and trainees
Categories of processing: collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, erasure or destruction
Legal and corporate consulting services The purpose of collecting personal data: providing legal and corporate consulting services according to local legislation
Legal basis: compliance with a legal obligation of the operator [art. 6 paragraph 1 letter c) of the Regulation] based on local legislation, legitimate interest [art. 6 paragraph 1 letter f) of the Regulation] - for the protection of the operator's rights and interest in case of any complaints and the execution of a contract [art. 6 paragraph 1 letter b) of the Regulation]
Area of application of personal data: all personal data processed by the operator to the extent necessary to fulfill the rights and obligations provided by local legislation (based on the principle of proportionality)
Recipients: courts, public authorities, trade register, notaries, lawyers, translation offices, interpreters, insurance companies, IT service providers, administrative service providers at FISCONTEXPERT CONSULT headquarters only for the purpose of maintenance
Transfer to a third country: N/A
Storage period: during the contractual relationship with the operator and, subsequently, for 10 years
Targeted persons: employees, natural persons who provide services to the operator according to the cooperation contract, statutory bodies, proxies, clients - natural persons, client contact persons, external trainers and trainees
Categories of processing: collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, disclosure by transmission, dissemination or making available in any other way, alignment or combination, restriction, erasure or destruction

WHAT RIGHTS DO YOU HAVE AS A DATA SUBJECT?

1. The right to access the information: you have the right to request a report of the personal data we process.

2. The right to rectification: If your personal data is incorrect, you have the right to ask us to rectify it. If we communicate subsequently corrected data to third parties, we will inform the respective third parties accordingly.

3. The right to object to data processing:

4. The right to restrict processing: You have the right to request us to restrict the use of your personal data in the event that:

5. The right to data portability: You have the right to ask us to transfer your personal data directly to you or to another company.

6. The right to erasure

You can ask us to delete your personal data if:

7. The right to complaints

If you wish to exercise the rights mentioned above, please contact us using the following contact details: FISCONTEXPERT CONSULT, Bdul. Nicolae Iorga no. 51C, 1st floor, Iasi, Iasi county; E-mail: office@fiscontexpert.ro;

We will consider any requests or complaints we receive and we will send you an answer in compliance with the terms provided by law.

If you are not satisfied with our answer or consider that the processing is done in violation of the applicable legislation, you can file a complaint with the data supervisory authority in Romania: the National Authority for the Supervision of the Processing of Personal Data - based in Bd. Gheorghe Magheru no. 28-30, Bucharest, Romania.

You can object to receiving personalized commercial messages from us.;
You can object to processing that could cause damage or harm.;
You can oppose the creation of profiles without consent;
You cannot object to the processing of your personal data by FISCONTEXPERT CONSULT if we have the legal obligation to process them if it is necessary to conclude a contract with you.
consider that the information is inaccurate;
you consider that we are processing data illegally;
the data are no longer necessary for the purpose for which they were collected or processed;
withdraw the consent based on which the processing takes place, if applicable;
a regulation of the European Union or a member state of the European Union requires the deletion of your personal data by FISCONTEXPERT CONSULT.

CONFIDENTIALITY OF PROCESSING

Personal data is considered confidential information and will be treated as such. Any unauthorized collection, processing or use of this data by employees is prohibited. The processing of personal data is confidential. It will be carried out only by persons acting under the authority of FISCONTEXPERT CONSULT and only on the basis of its instructions.

Any data processing carried out by an employee, which has not been authorized to be carried out as part of his legitimate duties, is considered to be unauthorized. The "need to know" principle applies. Employees can have access to personal information depending on the suitability of this access to the types of data and the determined purpose. This is based on the careful breakdown and separation of the duties of FISCONTEXPERT CONSULT employees and involves the implementation of roles and responsibilities for each employee.

Employees are prohibited from using personal data for private or commercial purposes, disclosing it to unauthorized persons or making it available in any other way. Hierarchical superiors inform their employees at the beginning of the employment relationship regarding the obligation to protect data confidentiality.

In case of unauthorized use of personal data, employees may be sanctioned in accordance with applicable legislation and internal regulations applicable within FISCONTEXPERT CONSULT.

SECURITY OF YOUR DATA

Personal data are protected against unauthorized access and against illegal processing or disclosure, as well as accidental loss, modification or destruction. This applies regardless of whether the data is processed electronically, on paper or by other means. Before the introduction of the new data processing methods, especially the new computer systems, technical and organizational measures for the protection of personal data are defined and implemented. These measures must be based on the state of the art, the processing risks and the need to protect the data (determined by the information classification process).

Technical and organizational measures for the protection of personal data are part of information security management and are continuously adapted to technical developments and organizational changes.

Access to personal data is provided only to those FISCONTEXPERT CONSULT employees who need such personal data to perform their tasks related to any of the processing purposes mentioned above (including the human resources department, the Legal department, the Financial, IT, Administrative department). Any access to personal data for other employees who do not have access rights in accordance with this Policy is prohibited.

FISCONTEXPERT CONSULT employees who have access to personal data have the right to process only those data they need to fulfill their specific work responsibilities related to any of the processing purposes mentioned above.

Documents containing personal data are stored in the structural departments of FISCONTEXPERT CONSULT whose employees have access to personal data related to the fulfillment of their official duties and are responsible for interacting with the relevant data of the data subject.

A person who processes personal data on behalf of FISCONTEXPERT CONSULT respects the principles and rules for processing personal data established by this Policy.

We work hard to protect our customers, other people whose data we process and ourselves from unauthorized access and unauthorized modification, disclosure or destruction of the data we process.

In particular, we have implemented the following technical and organizational measures to ensure the security of personal data: dedicated policies, appropriate work procedures, data minimization, security methods and techniques, back-ups, ensuring the accuracy of your data, staff training and awareness, etc.

Although we take all reasonable measures to ensure the security of your data, we know that no information security program is infallible. FISCONTEXPERT CONSULT cannot guarantee the absence of any security breach or the impossibility of penetrating the security systems. In the unfortunate and unlikely event that such a breach occurs, we will follow the legal procedures to limit the effects and inform the persons concerned.

We reserve the right to periodically update this policy in accordance with the way we process your data or with legislative changes.

The most recent update of this policy was made in October 2019.