The legal basis is the reason the General Data Protection Regulation (GDPR) allows us to use the data.
When you use the contact form
What
Your name, email address, company and the description you write.
Why
To reply to you and arrange a conversation.
Legal basis
Our legitimate interest in answering business enquiries, and steps you ask for before a possible contract (GDPR Art. 6(1)(f) and (b)).
Kept for
Up to 12 months after our last contact, unless we go on to work together.
When you email or message us
What
Your email address or phone number, your name, and what you write.
Why
To reply to you and keep track of the conversation.
Legal basis
As for the contact form (GDPR Art. 6(1)(f) and (b)).
Kept for
Up to 12 months after our last contact, unless we go on to work together.
When you visit this website
What
Technical data recorded by the web server: IP address, browser type, pages requested, and the date and time.
Why
To deliver the pages and keep the website secure.
Legal basis
Our legitimate interest in running a secure website (GDPR Art. 6(1)(f)).
Kept for
Up to 90 days, unless we need it to investigate a security incident.
When you work with us as a client, partner or adviser
What
Business contact details, correspondence, and contract and invoicing details.
Why
To deliver the work, manage the relationship and meet our accounting and tax duties.
Legal basis
Performing a contract, meeting a legal obligation, and our legitimate interest in managing our business (GDPR Art. 6(1)(b), (c) and (f)).
Kept for
The length of the engagement plus 3 years, the general limitation period for claims in Romania. Accounting records are kept for as long as Romanian law requires, generally 5 to 10 years depending on the document.
You do not have to give us any of this information, but we need the details on the contact form in order to reply to you. We do not use your data to make automated decisions about you, and we will not add you to a mailing list unless you ask us to.
Please keep sensitive details out of your first message
We work on healthcare projects, among others, but a first enquiry should never need personal information about patients. Please do not send us health data or other sensitive personal details through the form or by message. If we receive them by mistake, we will delete what we do not need.
Who can see your data
We share personal data only where it is needed, and we never sell it. The people and organizations who may see it are:
Google, which provides our email and document storage.
Hostinger, our website hosting provider, which runs this website, keeps its technical logs and passes contact form messages on to our inbox. Form messages are not stored on the website.
Accountants, lawyers and other professional advisers, who are bound by confidentiality.
Public authorities, where the law requires it.
Partners on an engagement, only where the work requires it and only what it requires.
Access inside our company is limited to the people who need it. We do not name clients or publish details that could identify them on this website.
Transfers outside the European Economic Area
Some providers, including Google, may process data outside the European Economic Area. Where they do, the transfer relies on a safeguard recognized by the GDPR, such as a European Commission adequacy decision or standard contractual clauses.
Our work is international and can involve partners in countries such as the United States and China. If an engagement requires personal data to be shared with them, we share only what is necessary and use a safeguard the GDPR allows for that transfer.
Your rights
Under the GDPR, you can ask us to:
Show you the personal data we hold about you and give you a copy.
Correct anything that is wrong or incomplete.
Delete your data, where we have no legal reason to keep it.
Limit how we use your data in certain situations.
Move data you gave us to another provider, where this applies.
Stop using your data where we rely on legitimate interests, if you object.
Withdraw your consent at any time, wherever we rely on it. This does not affect what we did before you withdrew it.
To use any of these rights, write to office@apoimpact.com. It is free, and we will reply within one month. We may ask you to confirm your identity first.
How to complain
Please tell us first if something is wrong, so that we can try to put it right. You also have the right to complain to the Romanian data protection authority, or to the authority in the EU country where you live or work:
ANSPDCP (National Supervisory Authority for Personal Data Processing) Bd. Gen. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania www.dataprotection.ro
Cookies
This website does not use optional cookies or trackers. Our cookie policy explains this in full.
Changes to this statement
If the way we handle personal data changes, we will update this page and the date at the top.