Privacy Policy

1. Identity and Contact Details of the Data Controller

Data controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council ("the Regulation" or "GDPR"):

• Name: AS FIN EXPERT PARTNERS SRL
• Tax ID (CUI): RO23916636
• Contact: office@as-group.ro

AS FIN EXPERT PARTNERS SRL operates under the commercial brand AS Group. The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Legea nr. 190/2018 (Law No. 190/2018 on measures implementing the Regulation at national level).

2. Categories of Personal Data Processed and Purposes of Processing

2.1 Data Submitted via the Contact Form

Individuals who complete the contact form available on this website transmit the following categories of personal data to the controller directly and voluntarily:

• First and last name
• Email address
• Company and job title
• Service of interest or targeted sector/role (where applicable)
• Message
• LinkedIn profile URL or curriculum vitae — optional data, provided solely at the discretion of the data subject

Purpose of processing: handling the contact request, assessing the viability of a professional or commercial engagement, and providing a substantiated response to the data subject.

2.2 Data Collected via Essential Technical Cookies

This website uses exclusively browser-generated session cookies that are necessary for the technical operation of the pages. These cookies do not allow identification of the data subject, do not track browsing behaviour, and are not transmitted to third parties.

Pursuant to Art. 5(3) of Directive 2002/58/EC (the ePrivacy Directive), as transposed into national law, the storage of information or access to information already stored on the user's terminal equipment is permitted without consent where the operation is strictly necessary for the provision of an information society service explicitly requested by the user. Accordingly, essential technical cookies are not subject to a consent mechanism.

3. Legal Basis for Processing

• Mandatory contact form data (first and last name, email address, company, job title, message): processing is based on the legitimate interest of the controller pursuant to Art. 6(1)(f) of the Regulation, consisting in the controller's ability to respond to B2B commercial inquiries initiated by the data subject. The controller's legitimate interest has been assessed against the rights and freedoms of data subjects, with the conclusion that it does not override them in an unjustified manner, given that processing is strictly limited to data voluntarily provided in the context of a business inquiry.
• Optional data (LinkedIn profile URL, curriculum vitae): processing is based on the consent of the data subject pursuant to Art. 6(1)(a) of the Regulation. Consent is given by voluntarily providing these data and may be withdrawn at any time, under the conditions set out in Section 5 of this policy.
• Essential technical cookies: processing is based on the legitimate interest of the controller pursuant to Art. 6(1)(f) of the Regulation, read in conjunction with Art. 5(3) of Directive 2002/58/EC, without the need to obtain the data subject's consent.

4. Retention Period

• Data submitted via the contact form: data are retained for a maximum period of 2 (two) years from the date the request is submitted. Upon expiry of this period, data are deleted or irreversibly anonymised, unless a legal obligation requires retention for a longer period or the data subject requests erasure prior to the expiry of that period.
• Technical session cookies: these are automatically deleted upon closure of the browser session or upon session expiry, in accordance with the standard technical behaviour of this type of cookie.

5. Recipients of Personal Data

For the purpose of technically processing contact form submissions, the controller uses the Formspree service (Formspree, Inc., USA) as a data processor within the meaning of Art. 4(8) of the Regulation. The transfer of personal data to Formspree is carried out in accordance with Art. 28 of the Regulation, on the basis of a data processing agreement, with Formspree acting exclusively on the controller's instructions and ensuring appropriate technical and organisational security measures for personal data.

The transfer of data to Formspree, Inc. (USA) is based on Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) of the Regulation, which ensure an adequate level of protection for personal data in the context of international transfers.

Except as stated above, personal data are not transmitted to other recipients, are not sold, and are not used for marketing purposes by third parties. Data may be disclosed to competent authorities solely where required by a legal obligation.

6. Rights of the Data Subject

In accordance with Chapter III of Regulation (EU) 2016/679, the data subject has the following rights, which may be exercised by submitting a written request to office@as-group.ro:

• Right of access (Art. 15) — the right to obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to those data and to the information provided for in Art. 15(1) of the Regulation.
• Right to rectification (Art. 16) — the right to obtain, without undue delay, the rectification of inaccurate personal data or the completion of incomplete personal data.
• Right to erasure (Art. 17) — the right to obtain the erasure of personal data concerning them, subject to the conditions and limitations set out in Art. 17 of the Regulation.
• Right to restriction of processing (Art. 18) — the right to obtain restriction of processing in the situations exhaustively listed in Art. 18(1)(a)–(d) of the Regulation.
• Right to data portability (Art. 20) — the right to receive the personal data concerning them which they have provided to the controller, in a structured, commonly used and machine-readable format, and to transmit those data to another controller, where processing is based on consent or on a contract and is carried out by automated means.
• Right to object (Art. 21) — the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them which is based on the controller's legitimate interest [Art. 6(1)(f)]. The controller shall cease processing unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject.
• Right to withdraw consent (Art. 7(3)) — in the case of processing based on consent (optional contact form data), the data subject has the right to withdraw their consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal. Consent may be withdrawn by submitting a request to office@as-group.ro.

7. Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 of Regulation (EU) 2016/679, if they consider that the processing of personal data concerning them infringes the provisions of the Regulation.

The competent supervisory authority in Romania is:

• Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — National Supervisory Authority for Personal Data Processing
• Website: www.dataprotection.ro
• Email: anspdcp@dataprotection.ro

8. Date of Last Update

This privacy policy was reviewed and updated on 14 July 2026. The controller reserves the right to amend this document whenever relevant legislative or operational changes occur. The version in force is always the one published on this page.