Personal Data Processing Policy

1. Controller

Right Consult Company S.R.L., IDNO 1022600002005, with its registered office at 259/6 Grenoble Street, office 57, MD-2072 Chișinău, trading as ExpertCont (the "Company"), is the controller of personal data for the processing operations whose purposes and means it determines.

1. address: 259/6 Grenoble Street, office 57, MD-2072 Chișinău;
2. email: [email protected];
3. telephone: +373 60 82 55 81;
4. personal data protection: [email protected].

The Company has not designated a data protection officer within the meaning of Article 37 of Law No. 195/2024. Enquiries concerning the processing of personal data should be sent to [email protected].

2. Scope of this Policy

This Policy sets out how the Company collects, uses, consults, discloses, stores, protects and erases the personal data of the persons with whom it interacts, in accordance with Law No. 195/2024 on personal data protection.

This Policy is general in nature and is supplemented by specific notices provided for particular services or operations, including the Website Privacy Policy, which governs online forms, traffic analytics and cookies. Where a specific notice describes a purpose, retention period, recipient or transfer in greater detail, that notice applies together with this Policy.

3. Categories of data subjects

Depending on the activity concerned, the Company may process the personal data of the following categories of persons:

1. clients and prospective clients;
2. representatives and employees of clients;
3. counterparties and their representatives;
4. persons involved in matters handled by the Company;
5. suppliers and their representatives;
6. job applicants;
7. employees and contractors;
8. persons who contact the Company;
9. visitors to the Company's online resources.

4. Categories of personal data

Depending on the specific legal relationship, the following categories of data may be processed:

1. first name and surname;
2. personal identification number (IDNP) and identity document details, where necessary;
3. address, telephone number and email address;
4. job title and signature;
5. professional, contractual and financial information;
6. correspondence;
7. documents provided for the performance of services;
8. information on disputes and other proceedings;
9. technical and security data;
10. other information required to manage a file.

Special categories of data and data relating to criminal convictions and offences are processed only where the nature of the service so requires and an appropriate legal basis exists. The Company does not request or knowingly collect data that is not necessary for the stated purpose. Where a document provided to the Company contains excessive data, access to and use of such data are limited to what is necessary to manage the file or to comply with legal obligations.

5. Purposes of processing

Personal data is processed for the following purposes:

1. handling enquiries and taking pre-contractual steps;
2. concluding and performing contracts, including the provision of accounting, legal and consulting services;
3. managing client files and communicating with clients and other persons involved;
4. complying with legal obligations, including accounting and tax obligations and obligations relating to the prevention of money laundering and terrorist financing;
5. establishing, exercising or defending rights and legitimate interests;
6. ensuring the security of information systems and preventing fraud and unauthorised access;
7. handling requests from data subjects;
8. recruitment.

Personal data is used for a new purpose that is incompatible with the original purpose only after the legal basis has been verified and the information required by law has been provided.

6. Legal bases

The legal basis is determined separately for each processing purpose and may consist of:

1. the performance of a contract or the taking of pre-contractual steps at the request of the data subject, for handling enquiries, preparing offers and providing services;
2. compliance with a legal obligation, for bookkeeping, tax reporting and anti-money laundering measures;
3. the legitimate interests of the Company or a third party, for system security, fraud prevention and the defence of legal claims, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject;
4. the consent of the data subject, only where no more appropriate basis exists, for example to retain a CV for future recruitment or for website traffic analytics;
5. the protection of the vital interests of the data subject or of another natural person.

For the processing of special categories of data, one of the additional conditions laid down by law is also identified. The fact that data is publicly available does not, in itself, permit its use for any purpose.

7. Consent

The Company does not request consent where the processing is based on another, more appropriate legal basis. Where processing is based on consent:

1. consent is requested separately for each purpose;
2. the data subject may refuse consent without suffering undue consequences;
3. consent may be withdrawn at any time, as easily as it was given;
4. withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Upon withdrawal of consent, processing based solely on consent ceases, unless another legal basis applies, in which case the data subject is informed accordingly.

8. Sources of personal data

Personal data may be obtained:

1. directly from the data subject;
2. from the client who engaged the service;
3. from representatives;
4. from the documents contained in a file;
5. from public authorities;
6. from registers and publicly available sources;
7. from counterparties;
8. from suppliers or partners, insofar as the disclosure is lawful.

Only the sources relevant to the specific purpose are used for each file. Where data is not obtained from the data subject, the Company provides the information required by law within the statutory time limits, subject to the applicable exceptions.

9. Recipients of personal data

To the extent necessary, personal data may be disclosed to:

1. authorised employees and contractors of the Company;
2. lawyers, consultants, experts and translators;
3. public authorities and courts;
4. notaries and bailiffs;
5. financial institutions;
6. accountants and auditors;
7. providers of IT, cloud and email services;
8. other persons, where disclosure is necessary and has a legal basis.

Each recipient receives only the data necessary for its role. The Company does not sell personal data. Where a recipient processes data for its own purposes, it is responsible for that processing in accordance with the law.

10. Processors

The Company engages only processors that provide sufficient guarantees to implement appropriate technical and organisational measures. The relationship with each processor is governed by a contract in accordance with legal requirements. The assessment of processors covers the nature of the service, security measures, confidentiality, sub-processors, processing locations, incident handling and data erasure.

The Company uses services provided by Zoho for email. Access to collaboration spaces is granted on an individual basis, public sharing of documents containing personal data is disabled, and employees' personal accounts are not used to store work files.

11. International transfers

Where personal data is transferred to a country outside the European Economic Area or to an international organisation, including where a provider in such a country has remote access to the data, the Company verifies that one of the following mechanisms provided for by Law No. 195/2024 applies:

1. an adequacy decision;
2. appropriate safeguards, including suitable contractual clauses;
3. binding corporate rules;
4. other mechanisms provided for by law;
5. in limited cases, a derogation provided for by law.

Data subjects may request further information on the safeguards applicable to a transfer concerning them.

12. Retention periods

Personal data is retained only for as long as necessary to achieve the purpose, perform the contract, comply with legal obligations, resolve a dispute or proceeding, or defend a right. The following periods apply as a guide:

1. enquiries and offers that did not result in a contract: 12 months from the last interaction;
2. client files: for the duration of the contract, and accounting and tax documents for the period required by accounting and tax legislation;
3. data obtained under anti-money laundering measures: for the period required by the applicable legislation;
4. CVs of unsuccessful applicants: 6 months, or up to 12 months with the applicant's consent;
5. security logs: between 6 and 12 months, depending on the level of risk.

The erasure of data required for a dispute, inspection, audit or investigation is suspended, in respect of the relevant data only, until the reason ceases to apply. At the end of the applicable period, data is erased, destroyed or anonymised.

13. Data security

The Company applies technical and organisational measures appropriate to the risk, including:

1. role-based access control on a need-to-know basis;
2. multi-factor authentication;
3. encryption;
4. password policies;
5. backups;
6. access logging;
7. device protection;
8. staff training and confidentiality undertakings;
9. an internal incident management procedure.

These measures are reviewed periodically, and access rights are withdrawn when they are no longer required.

14. Rights of the data subject

Under Law No. 195/2024, data subjects have:

1. the right to be informed;
2. the right of access;
3. the right to rectification;
4. the right to erasure;
5. the right to restriction of processing;
6. the right to data portability;
7. the right to object;
8. rights in relation to automated individual decision-making;
9. the right to withdraw consent;
10. the right to lodge a complaint with the National Center for Personal Data Protection;
11. the right to an effective judicial remedy.

These rights are not absolute and may be subject to the conditions and exceptions laid down by law. Where a request cannot be granted in full, the Company states the reasons.

15. Exercising your rights

Requests to exercise these rights should be sent by email to [email protected] or by post to 259/6 Grenoble Street, office 57, MD-2072 Chișinău.

The Company responds without undue delay and in any event within one month of receipt of the request. That period may be extended by up to two further months, taking into account the complexity and number of requests; the data subject is informed of any extension and the reasons for it within the initial period. Only the information strictly necessary to verify the requester's identity may be requested, in proportion to the nature of the request and the sensitivity of the data.

16. Automated decision-making

The Company uses the following processes based on the automated processing of personal data:

1. calculation of an estimated price for services based on the data entered by the user in the calculator on the website; the result is indicative only, produces no legal effects for the data subject, and the final offer is confirmed by a specialist;
2. screening of prospective clients, their directors and beneficial owners against international sanctions lists, lists of politically exposed persons and other relevant databases, in accordance with legislation on the prevention of money laundering and terrorist financing; any match is reviewed by a specialist before a decision on the business relationship is taken.

Data subjects have the right to obtain human intervention, to express their point of view and to contest the decision. Data processed in these processes is accessible only to authorised persons and is retained only for as long as the purpose requires. Information on the logic used to calculate the estimated price is available in the Website Privacy Policy.

17. Children's data

The Company does not knowingly collect data relating to children that is not necessary for the service provided. Where such data is processed, including in clients' personnel files, additional safeguards are applied and the appropriate legal basis is verified.

18. Personal data breaches

The Company maintains an internal procedure for identifying, assessing and documenting security incidents. Where a breach is likely to result in a risk to the rights and freedoms of natural persons, it is notified to the National Center for Personal Data Protection without undue delay and, where feasible, no later than 72 hours after becoming aware of it. Where the risk is high, the data subjects concerned are informed without undue delay, save in the cases provided for by law.

19. Amendments to this Policy

This Policy may be updated to reflect changes in legislation, services, technologies or providers, or the introduction of new processing operations. The date of the last update is shown at the top of this document. Material changes are brought to the attention of data subjects by reasonable means, depending on the available communication channel.