I. The Operator

TABACU M. MIHAI-EUGEN INDIVIDUAL ENTERPRISE, entity with professional headquarters in Bucharest, 4th District, Văcărești way, No. 391, Sun Offices, Entrance A, Office 325, 3rd floor, CUI 43753096, registered in the Trade Register with number F2021000185290, registered with the National Authority for the Supervision of Personal Data Processing with number 3/02.01.2025,

and

TABACU MIHAI-EUGEN – TAX CONSULTANT, entity with professional headquarters in Bucharest, Sector 2, Dacia Boulevard, No. 133, Block D, CUI 51005827, registered with the National Authority for the Supervision of Personal Data Processing with number 2/02.01.2025,

collectively referred to hereinafter as METAB Consulting^®, “the operators”, or independently “the operator”, collects and processes personal data for the provision of services contracted by its clients, or for one-time services.

II. Personal data collected and processed

METAB Consulting^® collects and processes the following categories of personal data regarding the client (as contractor) and/or the beneficiary(ies) (when the service beneficiary is different from the client, and the client is only the contractor):

• Personal identification data, generally listed on the identity card or other civil status documents (such as, but not limited to: name, surname, home address, correspondence address, personal identification number, identity card series and number);
• Contact data (phone number, email address);
• Banking information (account number and account holder’s name);
• Fiscal information (such as, but not limited to: personal fiscal history obtained through the ANAF Virtual Private Space, nature and amount of income earned, nature and amount of present or past fiscal obligations, type of operations carried out with third parties and authorities)

III. Purposes of collecting and processing personal data

METAB Consulting^® collects and processes personal data regarding the client and/or beneficiary(ies) for the following purposes:

1. Current purposes:

• Execution of the service provision contract, when there is a valid contract between METAB Consulting^® and the client;
• Provision of one-time services, without a valid contract between METAB Consulting^® and the client;
• Preparation of documents and/or reports related to contracted services/one-time services;
• Issuing fiscal invoices, and sending them through communication channels agreed upon by the client;
• Archiving documents, in accordance with current legislation;
• Providing access to METAB Consulting^® platforms for conducting document exchange operations and online consultancy sessions;
• Sending notifications via SMS/email regarding occasional information provided by METAB Consulting^® (only with the client’s express consent);
• Sending notifications/documents to the client’s registered office/home address, via postal and courier services.

2. Exceptional purposes:

• When legislation requires the operator to communicate certain data to authorities, under the law (e.g., National Authority for Consumer Protection, other authorized institutions), to store client data for a certain period, or to process client data in a manner other than those mentioned, the basis for processing will be the fulfillment of a legal obligation;
• In case of necessity, METAB Consulting^® may process data for the establishment, exercise, or defense of rights or interests before courts, bailiffs, public notaries, other public authorities, arbitration tribunals, mediators, or other public or private bodies that resolve disputes, lawyers, consultants, or other public or private individuals and legal entities involved in those disputes or negotiations. In these situations, METAB Consulting^® will process data as applicable, based on fulfilling legal obligations or legitimate interests;
• In the context of sale-purchase operations of METAB Consulting^® social shares, restructuring, and other similar activities, personal data may be processed by disclosing them to certain consultants, audit activities, potential buyers, public authorities, or other persons. The basis for processing will be the legitimate interest of the parties or the fulfillment of a legal obligation.

IV. Disclosure of personal data to third parties (excluding authorities)

In case the nature of services provided by METAB Consulting^® to the client requires collaboration with third parties, certain personal data may be transmitted to them by the operator in order to fulfill the contractual obligations assumed by METAB Consulting^®.

In case of collaboration with third parties for the transmission of notifications or documents to the client via postal and courier services, the operator will provide the postal and courier companies with which it collaborates a series of personal data of the client (name, surname, address, and phone number) for the purpose of generating transport documents for the envelopes and/or parcels sent to the client.

In case of collaboration with third parties for the provision of qualified digital certificates with unique validity for the electronic signing of documents in relation to METAB Consulting, the operator will provide the companies offering such services with the client’s email address for the purpose of generating the qualified digital certificate and transmitting the documents for the collection of signatures.

V. Duration of personal data processing

METAB Consulting^® will process the personal data collected in accordance with the legal provisions in force throughout the duration of the contract (when there is a contract concluded between METAB Consulting^® and the client), or until the obligations between the parties are extinguished, in the case of one-time services purchased by the client.

By extinguishing the obligations, it is understood the complete provision of services by METAB Consulting^® and the full payment of invoices by the client.

The period of personal data processing may be extended when there is a legitimate interest or a legal obligation of the operator in this regard (for example, but not limited to, archiving documents in physical or electronic format, or keeping essential documents in the operator’s archives for the conduct of its activities or for compliance with legislation).

VI. Client’s rights

The client has the following rights regarding their personal data provided to the Consultant under the service contract:

• Right of access to data – the client has the right to access the data provided to the operator and obtain information regarding the nature, processing, and disclosure of these data;
• Right to data rectification – the client has the right to obtain rectification of the data if they are not accurate;
• Right to data erasure – the client has the right to request and obtain the erasure of data when they are no longer processed or there is no longer a legal obligation regarding their retention or archiving;
• Right to restriction of data processing – the client has the right to request and obtain restriction of data processing. In this regard, if the execution of the contract or provision of services can no longer be carried out due to the restriction, METAB Consulting^® will inform the client about this aspect;
• Right to object – the client has the right to object to the processing of data. In this regard, if the execution of the contract or provision of services can no longer be carried out due to objections, METAB Consulting^® will inform the client about this aspect;
• Right to data portability – the client has the right to request a complete format with all data provided to the operator and transmit them to another operator.
• Right to withdraw consent – In situations where certain data have been processed by the operator with the express consent of the client, the client has the right to withdraw their consent, without affecting the legality of the processing prior to withdrawal and nor the legality of other personal data provided based on other legal grounds (e.g., for the conclusion and execution of the contract);
• Right to lodge a complaint with the Supervisory Authority – the client has the right to lodge a complaint with the supervisory authority for the processing of personal data (National Authority for the Supervision of Personal Data Processing – ANSPDCP) regarding the processing of data provided to the Consultant or by proxies on its behalf.

To exercise their rights or, as the case may be, to withdraw their consent when they have given consent, or to the extent that they require additional information or clarifications, the client can address these requests via email at dpo@metab.ro, or through postal or courier services to the professional address of the operator, attention to the data protection officer.

The client can decide to refuse to provide personal data. In the event that they decide not to provide the operator with essential personal data for the execution of the contract and/or the provision of services of any kind, METAB Consulting^® may refuse to conclude the contract and/or provide services due to the inability to execute.

VII. Other Provisions

The client fully assumes responsibility for the accuracy and truthfulness of the personal data provided to the operator and understands that the operator will process these data exactly as provided, and is absolved of any fault if it is found at any time that the data provided are false or incomplete, and their use imposes consequences of any nature.

In the event of a breach of a personal data security obligation, a cyber attack, or any situation where the client’s personal data have inadvertently come into the custody of a third party or have been unsecured, METAB Consulting^® will immediately inform the client, notify ANSPDCP, and take all measures to restore the situation.

METAB Consulting^® undertakes to compensate the client for any damage caused to them as a result of a cyber attack leading to the loss or jeopardizing of the quality and security of the databases in which the client’s personal data are stored, if the client proves with admissible evidence the damages occasioned by the event caused by the fault of METAB Consulting^®.

If the client provides the operator with personal data concerning other persons (e.g., parents’ names, documents or data regarding other family members, etc.), the client will inform the respective third parties about the information provided and the purpose for which it was provided. Additionally, the client will provide the involved third parties with this information regarding the processing of personal data and ensure that they express their consent for the processing.

If the third parties are minors or incapacitated, their guardian or legal representative is obliged to represent them in expressing consent.

Consent regarding the processing of personal data can be expressed in person, through electronic means of remote communication, both directly by the persons involved and by their representatives. If consent is expressed by representatives or proxies of the data subjects, they will present the operator with documents attesting to their status as proxy or legal representative (notarial power of attorney, documents attesting to the status of legal guardian, certificate of incorporation, etc.).

Last update: 02.01.2025

METAB Consulting is a registered trademark of TABACU M. MIHAI-EUGEN INDIVIDUAL ENTERPRISE, and is used under license by TABACU MIHAI-EUGEN TAX CONSULTANT.
Any unauthorized use of the name or graphic representation of the trademark is strictly prohibited.