1. Data controller
Ebill Consulting Srl, tax ID 54763680, registered office: Lunca de Sus, no. 952b, Harghita County, Romania, is the controller for this website. The company provides hosting and email services. Privacy questions and requests can be submitted through the contact form or by post to the registered office, marked “Data protection”.
2. Scope
This notice covers browsing, enquiries and communication about accounting, HR, time tracking, invoicing, inventory, e-Transport and software development. Processing client documents and using applications may require separate notices and agreements. Controller and processor roles for employee and partner data entered by clients are defined in the service agreement, including under GDPR Article 28 where applicable.
3. Data and sources
The form requests a name, email address and message. Correspondence may contain other information you voluntarily provide, such as phone number, role and company details. Browsers and technical infrastructure may transmit IP addresses, requested pages, access times and device information. Data comes from you, your browser or the company you represent. Do not send passwords, identity documents, health data or employee records unnecessary for your enquiry.
4. Purposes and legal bases
Responding to a prospective contracting individual and preparing their requested contract relies on GDPR Article 6(1)(b). Business representatives and general enquiries are handled on the legitimate interest in communication and professional relationships (Article 6(1)(f)). Security and abuse prevention serve the legitimate interest in protecting services and users. Accounting, tax and lawful authority requests rely on legal obligations (Article 6(1)(c)). Where consent is required it must be obtained separately; sending the form does not automatically subscribe you to marketing.
5. Recipients
Data may be accessed by authorized company personnel and, when necessary, technical providers, advisers and competent authorities. Although the company provides email services, form messages are forwarded to a Gmail mailbox used by the company, so Google participates in email delivery and storage. External web resources and analytics are described below. Disclosures must be limited to the applicable purpose and legal basis.
6. Retention
Correspondence is retained to resolve and follow up enquiries, then only as necessary for a contractual relationship, legal obligation or legal claim. Accounting records follow the statutory period applicable to their category. Log and backup retention is determined by security, operational and recovery needs. You may ask about the period applicable to your data. An erasure request does not override mandatory retention obligations.
7. Cookies and external services
The site uses a session for functionality, language choice and form protection; blocking session cookies may affect these functions. The homepage and e-Factura pages include Google Analytics and resources from Google Fonts, jsDelivr, cdnjs and unpkg. These requests transmit technical data, including IP addresses, to providers. This privacy page does not load Google Analytics or those CDN resources. Optional cookies require prior consent where required by law; this notice is not consent. Browser settings allow cookie control, but deleting cookies does not erase data already transmitted.
8. International transfers
Google services and international web infrastructure may involve processing outside the European Economic Area. Transfers must comply with GDPR Chapter V through an adequacy decision applicable to the recipient or appropriate safeguards, such as standard contractual clauses. You may request information about the recipients and safeguards applicable to your data.
9. Your rights
Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Consent may be withdrawn without affecting prior lawful processing; you may object to direct marketing at any time. Submit requests through the form or by post. Only information necessary to verify identity may be requested. We normally respond within one month; GDPR permits an extension of two further months in specified cases, with notice. You may complain to ANSPDCP or the competent supervisory authority and seek a judicial remedy.
10. Required data, security and changes
Use of the form is voluntary, but a name, email address and message are necessary to handle an enquiry. The form does not make solely automated decisions with legal or similarly significant effects. Data must be protected through restricted access and proportionate technical and organizational measures. Requests concerning HR or time-tracking data may require involvement of the employer. This notice is updated when services, providers or legal requirements change; its version date is shown on this page.