Privacy Policy

Last updated: 23 October 2026

This is an English translation provided for convenience. The Romanian version (Politica de confidențialitate) prevails.

This policy explains what personal data we process through the website contconsulting.ro and through our appointment application, for what purposes, on what legal basis, to whom we disclose it, how long we keep it and what rights you have, in accordance with Article 13 of Regulation (EU) 2016/679 (GDPR).

1. Who the controller is

CONT CONSULTING SRL, registered office in Brașov, Brândușelor Street no. 68-70, 2nd floor, office 2 (C1-U5), postal code 500397, Romania, tax ID RO6522895, Trade Register no. J1994002845084 (“we”). E-mail: contact@contconsulting.ro.

We have not appointed a Data Protection Officer (DPO). For any question or request regarding your data, please write to the e-mail address above or by post to our registered office.

2. What data we process, why and on what legal basis

2.1. Contact forms (Contact page and service pages)
Data: name, e-mail address, phone number and location (where requested), subject and message.
Purpose: to reply to you and, upon request, to send you an offer.
Legal basis: Article 6(1)(b) GDPR – steps taken at your request prior to entering into a contract; for requests not related to a contract, Article 6(1)(f) – our legitimate interest in replying to the messages we receive.

2.2. Order forms for setting up an SRL or a PFA / II / IF
Data: identification data of the applicant, shareholders, directors or owners (first and last name, address, identity document details, phone, e-mail; in the PFA / II / IF form, also a copy of the identity document), proposed company names, registered office and secondary offices, business activities, share capital and its structure.
Purpose: sending the offer, drafting the documents and completing the registration formalities with the Trade Register.
Legal basis: Article 6(1)(b) GDPR – performance of the contract or pre-contractual steps; Article 6(1)(c) GDPR – compliance with legal obligations, including the customer due diligence measures required by Romanian Law no. 129/2019 on preventing and combating money laundering, as our firm is a reporting entity under Article 5(1)(e) of that law.

2.3. Appointment application (contconsulting.ro/meeting/)
Data: for the account – e-mail address, first name, last name, company or PFA (optional), preferred language, mobile phone number and password (or sign-in with your Google account, if you choose this option); for appointments – date, time and details of the meeting.
Purpose: managing meetings: confirmations and reminders by e-mail and by SMS or WhatsApp, generating the link for online meetings and recording the appointment in our Google calendar.
Legal basis: Article 6(1)(b) GDPR – steps taken at your request and performance of the contract.

2.4. Comments on articles
Data: name, e-mail address, website (optional), comment text, IP address and browser information.
Purpose: publishing and moderating comments; comments are published only after we approve them manually.
Legal basis: Article 6(1)(f) GDPR – our legitimate interest in moderating published content. Your e-mail address is not displayed publicly. An anonymised string (hash) created from your e-mail address may be sent to the Gravatar service to check whether you have a profile picture.

2.5. Operation and security of the website
Data: IP address, date and time of access, pages accessed, browser and device type, recorded in the server logs and by the website’s security modules.
Purpose: technical operation of the website, preventing and blocking cyber attacks.
Legal basis: Article 6(1)(f) GDPR – our legitimate interest in keeping the website secure.

2.6. Cookies, Google Analytics and Google Ads
Analytics and advertising cookies are used only with your consent (Article 6(1)(a) GDPR and Article 4(5) of Romanian Law no. 506/2004), which you may withdraw at any time. Details in our Cookie Policy.

3. To whom we disclose your data

We do not sell your data. We disclose it only as necessary for the purposes above, to:

  • ROMARG SRL (Romania) – website and e-mail hosting; the servers are located in Romania;
  • Google Ireland Limited and Google LLC – Google Analytics and Google Ads (only with your consent), Google reCAPTCHA (SRL and PFA order forms), Google sign-in and Google Calendar (appointment application), Google Maps (Contact page, only after clicking “Show map”), Google Fonts;
  • Automattic Inc. – the Gravatar service (profile pictures shown next to comments);
  • the SMS / WhatsApp messaging provider and the online meeting platform provider used by the appointment application;
  • public authorities and institutions (for example the National Trade Register Office or the National Agency for Fiscal Administration), where disclosure is necessary for the requested service or required by law.

4. Transfers outside the European Economic Area

Some of the providers above (Google LLC, Automattic Inc., messaging or online meeting providers) may process data in the United States. Such transfers rely on Commission Implementing Decision (EU) 2023/1795 (EU-U.S. Data Privacy Framework) for providers certified under that framework, such as Google LLC, or on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

5. How long we keep your data

  • Requests sent through the contact forms: for as long as needed to handle them; if no contract follows, for up to 3 years, the general limitation period under Article 2517 of the Romanian Civil Code, for the possible defence of legal claims.
  • Data and documents from the SRL / PFA order forms: for the duration of the service; documents obtained for customer due diligence are kept for 5 years after the end of the business relationship (Article 21(1) of Law no. 129/2019), and accounting documents, including invoices, for the period set out in Article 25 of Accounting Law no. 82/1991.
  • Appointment application account: for as long as the account is active; we delete it at your request, except for information we must keep by law.
  • Comments: for as long as they are published on the website.
  • Google Analytics: user-level data is kept for 14 months and event data for 2 months.
  • Server and security module logs: for the limited period set by the hosting provider and by the configuration of the security modules.

6. Your rights

Under Articles 15–22 GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on our legitimate interest. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR).

To exercise these rights, please write to contact@contconsulting.ro. We reply within one month of receiving your request, a period that may be extended under Article 12(3) GDPR. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (www.dataprotection.ro), under Article 77 GDPR.

7. Do you have to provide your data?

The fields marked with * in the forms are required for us to reply or to provide the requested service; without them we cannot process your request. The data needed to set up a company and for customer due diligence are required by law. All other fields are optional.

8. Automated decision-making

We do not make decisions based solely on automated processing of your data that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). If you accept advertising cookies, Google may use browsing data to show you personalised ads; details in our Cookie Policy.

9. How we protect your data

The website and the appointment application use an encrypted connection (HTTPS). Access to data is limited to the people in our firm who need it to reply to you or to provide the service, who are bound by confidentiality. The website is protected by security modules that block suspicious access attempts.

10. Changes to this policy

We may update this policy when the way we process data changes. The date of the last update is shown at the top of the page.