I. The Controller

TABACU M. MIHAI-EUGEN ÎNTREPRINDERE INDIVIDUALĂ, an entity having its professional headquarters in Bucharest Municipality, District 4, 391 Calea Văcărești, Sun Offices, Entrance A, Office 325, 3rd Floor, Tax Identification Code 43753096, registered with the Trade Register under number F2021000185290, registered with the National Supervisory Authority for Personal Data Processing under number 3/02.01.2025,

and

TABACU MIHAI-EUGEN – CONSULTANT FISCAL, an entity having its professional headquarters in Bucharest Municipality, District 2, 133 Dacia Boulevard, Block D, having its mail address in Bucharest Municipality, District 4, 391 Calea Văcărești, Sun Offices, Entrance A, Office 325, 3rd Floor,  Tax Identification Code RO51005827, registered with the National Supervisory Authority for Personal Data Processing under number 2/02.01.2025,

hereinafter collectively referred to as METAB Consulting®, the “controllers”, or individually as the “controller”, collect and process personal data for the purpose of providing the services contracted by their clients, or one-off services.

II. Personal data collected and processed

METAB Consulting® collects and processes the following categories of personal data regarding the client (as contracting party) and/or the beneficiary(ies) (where the beneficiary of the services is a person other than the client, and the client only has the capacity of contracting party):

• Personal identification data, generally included in the identity card or in other civil status documents (such as, but not limited to: surname, first name, domicile address, correspondence address, personal numerical code, identity card series and number, maiden name, etc.);
• Contact data (telephone number, e-mail address);
• Banking information (IBAN account number and the name of the account holder);
• Tax-related information (such as, but not limited to: personal tax history obtained through the ANAF Private Virtual Space, the nature and amount of income earned, the nature and amount of present or past tax liabilities, the type of transactions carried out with third parties and with the authorities, as resulting from the documents made available by the client or from documents obtained upon the client’s instructions);
• Data related to telephone communications carried out through the fixed support line +40 371 169 945, including the caller’s telephone number, the date and time of the call, the duration of the conversation, the caller’s voice and the content of the conversation, to the extent that the call is recorded.

III. Purposes of collecting and processing personal data

METAB Consulting® collects and processes personal data concerning the client and/or the beneficiary(ies) for the following purposes:

1. Current purposes:

• Performance of the service agreement, where there is a valid contract concluded between METAB Consulting® and the client;
• Provision of “one-off services”, without there being a valid contract concluded between METAB Consulting® and the client;
• Preparation of documents and/or reports related to the contracted services / one-off services;
• Issuance of tax invoices and transmission thereof through the communication channels agreed with the client;
• Archiving of documents, in accordance with the applicable legislation;
• Providing access to METAB Consulting® platforms for the purpose of carrying out document exchange operations and conducting online consultation sessions;
• Sending SMS / e-mail notifications regarding occasional communications made by METAB Consulting® (only with the client’s express consent, where their subject matter is marketing communication);
• Sending notifications / documents to the client’s registered office / domicile through postal and courier services;
• Handling requests made by telephone through the fixed support line +40 371 169 945, including receiving calls, clarifying the client’s requests, documenting professional communications, ensuring service quality and, where applicable, using telephone recordings for the establishment, exercise or defence of a right or of a legitimate interest of METAB Consulting®.

2. Exceptional purposes:

• Where the law requires the controller to communicate certain data to the authorities, on the basis of the law (e.g. the National Authority for Consumer Protection, other competent institutions), to store clients’ data for a certain period of time or to otherwise process clients’ data beyond the cases mentioned above, the legal basis for processing shall be compliance with a legal obligation;
• Where necessary, METAB Consulting® may process the data for the establishment, exercise or defence of rights or interests before courts of law, bailiffs, public notaries, other public authorities, arbitral tribunals, mediators or other public or private bodies that settle disputes, lawyers, consultants or other public or private natural or legal persons involved in such disputes or negotiations. In such cases, METAB Consulting® shall process the data, as applicable, on the basis of compliance with legal obligations incumbent upon it or on the basis of legitimate interests;
• In the context of share sale and purchase transactions involving METAB Consulting®, restructuring and other similar activities, personal data may be processed by disclosing it to certain consultants, auditors, potential buyers, public authorities or other persons. The legal basis for processing shall be the legitimate interest of the parties or compliance with a legal obligation.

With regard to recorded telephone conversations, the processing is carried out, as applicable, on the basis of the performance of the contract or the taking of steps at the request of the data subject prior to entering into the contract, as well as on the basis of the controller’s legitimate interest in documenting professional communications, ensuring service quality and being able to use the recordings as evidence in the event of misunderstandings, complaints or disputes. The caller is informed at the beginning of the call that the conversation is being recorded.

IV. Disclosure of personal data to third parties (excluding authorities)

Where the nature of the services provided by METAB Consulting® to the client requires collaboration with third parties, certain personal data may be transmitted to them by the controller for the purpose of fulfilling the contractual obligations undertaken by METAB Consulting®.

In the case of collaboration with third parties for the purpose of sending notices or documents to the client through postal and courier services, the controller shall make available to the postal and courier companies with which it collaborates certain personal data of the client (surname, first name, address and telephone number), for the purpose of generating the transport documents for the letters and/or parcels sent to the client.

In the case of collaboration with third parties for the purpose of providing qualified digital certificates with one-time validity for the electronic signing of documents in the relationship with METAB Consulting, the controller shall make available to the companies providing such services the client’s e-mail address for the purpose of generating the qualified digital certificate and sending the documents for signature collection.

Where a user account is made available to the client on the SharePoint platform or on other similar or complementary platforms used by METAB Consulting® for document management, information exchange and the conduct of the professional relationship with the client, the controller may make available to the providers of such services certain personal data of the client, namely his/her surname and first name / company name and e-mail address, for the purpose of creating the access account, managing user rights, sending access codes, security codes or other elements necessary for authentication and secure access to the platform. Such processing is carried out for the purpose of restricting access to the client’s confidential information and documents, protecting them and complying with the confidentiality and professional secrecy obligations incumbent upon METAB Consulting®.

To the extent necessary for the operation of the fixed support line and the management of the related technical infrastructure, certain data relating to telephone calls may also be processed by IT, telecommunications, hosting, maintenance or security service providers, acting as processors on behalf of the controller, on the basis of METAB Consulting®’s instructions and subject to contractual confidentiality and security obligations.

V. Duration of the processing of personal data

METAB Consulting® shall process the personal data collected in accordance with the applicable legal provisions throughout the entire duration of the contract (where a contract has been concluded between METAB Consulting® and the client), or until the obligations between the parties have been discharged, in the case of one-off services purchased by the client.

The discharge of obligations means the full performance of the services by METAB Consulting® and the full payment of the invoices by the client.

The period for processing personal data may be extended where there is a legitimate interest or a legal obligation of the controller in this respect (for example, but not limited to, the archiving of documents in physical or electronic format, or the retention in the controller’s archives of certain essential documents for the conduct of its activity or for compliance with the legislation).

VI. Data retention and deletion policy

METAB Consulting® processes and retains personal data for the period necessary to fulfil the purposes for which such data was collected, in compliance with the principle of storage limitation and the applicable legal obligations.

As a general rule, personal data processed in connection with the conclusion and performance of the service agreement shall be retained throughout the entire validity period of the contract and, where applicable, until the full performance of all services undertaken by METAB Consulting®, respectively until the discharge of all relationships and obligations between the parties. In the case of one-off services, the data shall be retained until the full performance of the services and the discharge of the corresponding obligations between the parties.

Where certain personal data is included in documents or records whose preparation, issuance, use, archiving or retention is required by the applicable legislation, including, but not limited to, financial-accounting documents, invoices, tax records, supporting documents, registers or other documents whose retention is provided by law, such data shall be retained for the period provided by the applicable legal provisions, even if such period exceeds the duration of the contract or the moment of the full performance of the services.

Recordings of telephone conversations carried out through the fixed support line +40 371 169 945 are retained for a period of 60 calendar days from the date of the call, exclusively for the purpose of documenting professional communications and for possible use as evidence. These recordings are stored on METAB Consulting®’s secure servers located in the European Union, with appropriate technical and organisational measures applied in order to protect the confidentiality, integrity and availability of the data.

Upon expiry of the applicable retention periods, personal data shall be deleted, destroyed or anonymised, as applicable, through reasonable internal procedures and appropriate security measures, except where further retention is necessary for compliance with a legal obligation or for the establishment, exercise or defence of a right or of a legitimate interest of METAB Consulting® in administrative, judicial or extrajudicial proceedings.

VII. Client’s rights

The client has the following rights regarding his/her personal data provided to the Consultant pursuant to the service agreement:

• Right of access to data – the client has the right to access the data provided to the controller and to obtain information regarding the nature, processing and disclosure of such data;
• Right to rectification of data – the client has the right to obtain rectification of the data if it is inaccurate;
• Right to erasure of data – the client has the right to request and obtain the deletion of the data when it is no longer being processed or when there is no longer a legal obligation regarding its retention or archiving;
• Right to restriction of processing – the client has the right to request and obtain restriction of the processing of the data. In this respect, if the performance of the contract or the provision of the services can no longer be carried out due to such restriction, METAB Consulting® shall inform the client accordingly;
• Right to object – the client has the right to object to the processing of the data. In this respect, if the performance of the contract or the provision of the services can no longer be carried out due to such objections, METAB Consulting® shall inform the client accordingly;
• Right to data portability – the client has the right to request a complete format containing all the data provided to the controller and to transmit it to another controller.
  Right to withdraw consent – where certain data has been processed by the controller on the basis of the client’s express consent, the client has the right to withdraw such consent, without affecting the lawfulness of the processing carried out before the withdrawal and without affecting the lawfulness of the processing of the other personal data provided on the basis of other legal grounds (e.g. for the conclusion and performance of the contract);
• Right to lodge a complaint with the supervisory authority – the client has the right to lodge a complaint with the supervisory authority for the processing of personal data (National Supervisory Authority for Personal Data Processing – ANSPDCP) regarding the processing of the data provided to the Consultant or by processors on its behalf.

In order to exercise their rights or, as the case may be, to withdraw consent where such consent has been given, or insofar as additional information or clarifications are needed, the client may address such requests by e-mail to dpo@metab.ro, or by postal or courier services to the controller’s address in Bucharest Municipality, District 4, 391 Calea Văcărești, Sun Offices, Entrance A, Office 325, 3rd Floor, for the attention of the data protection officer.

The client may choose to refuse to provide personal data. Where the client decides not to provide the controller with personal data essential for the performance of the contract and/or the provision of services of any kind, METAB Consulting® may refuse to conclude the contract and/or provide the services due to the impossibility of performance.

VIII. Other provisions

The client assumes full responsibility for the accuracy and truthfulness of the personal data provided to the controller, and understands that the controller shall process such data exactly as provided, and shall be released from any liability where it is established at any time that the data made available is false or incomplete, and the use thereof gives rise to consequences of any nature.

In the event of a breach of a personal data security obligation, a cyberattack or any situation where the client’s personal data has unintentionally come into the custody of a third party or has been de-secured, METAB Consulting® shall immediately inform the client, shall notify ANSPDCP, and shall take all measures to restore the situation.

METAB Consulting® undertakes to compensate the client for any damage caused to him/her as a result of a cyberattack leading to the loss of or impairment of the quality and security of the databases in which the client’s personal data is stored, where the client proves, by admissible means of evidence, the damages caused by the event occurring due to the fault of METAB Consulting®.

Where the client provides the controller with personal data relating to other persons (e.g. parents’ names, documents or data regarding other family members, etc.), the client shall inform those third parties about the information provided and the purpose for which it was provided. At the same time, the client shall make this personal data processing notice available to the relevant third parties and shall ensure that they express their consent to such processing.

Where the third parties are minors or lack capacity, their guardian or legal representative has the obligation to represent them in expressing consent.

Consent regarding the processing of personal data may be expressed in person, through electronic means of distance communication, both directly by the persons concerned and by their representatives. Where consent is expressed by representatives or attorneys-in-fact of the data subjects, they shall provide the controller with the documents attesting their capacity as attorney-in-fact or legal representative (notarial power of attorney, documents attesting the status of legal guardian, certificate of findings, etc.).

Last update: 14.03.2026

METAB Consulting is a registered trademark of TABACU M. MIHAI-EUGEN ÎNTREPRINDERE INDIVIDUALĂ, and is used under licence by TABACU MIHAI-EUGEN CONSULTANT FISCAL.
Any unauthorised use of the name or graphic representation of the trademark is strictly prohibited.