1. Who is responsible for your data
The controller is IGAMING S.R.L. (Szilaghi Consulting), registered in Romania, VAT number RO44850461, Trade Register no. J2021004222122, registered office Cluj-Napoca, 89 Dorobantilor Way, X3/2, CJ, Romania.
Privacy contact: hello@szilaghi.com (subject “Privacy”). We have not appointed a Data Protection Officer because we are not required to under article 37 GDPR; the privacy contact handles all requests.
This policy explains how we process personal data under Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018. How we handle data for clients as a processor is described in our GDPR Policy.
2. What we process, why, and on what legal basis
| Who | Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Website visitors | IP address, browser, pages requested, date and time (server logs) | Deliver and secure the Website, detect abuse | (f) legitimate interest in a secure website |
| Website visitors who accept analytics cookies | Online identifier in the _ga cookies, pages viewed, approximate location, device and browser (Google Analytics 4) | Measure how the Website is used and improve its content | (a) consent, withdrawable at any time |
| People who use the contact form or e-mail us | Name, e-mail, company, phone, project details you choose to give, consent record; a keyed hash of your IP for rate limiting | Reply to your enquiry, prepare a quote, protect the form against spam | (b) steps at your request before a contract; (f) legitimate interest in preventing spam |
| People who download our reports | Full name, e-mail, company (optional), whether you asked for regulatory updates, consent record | Send you the report and its download link; notify our team; if you opted in, send occasional regulatory updates | (a) consent, withdrawable at any time; kept like other enquiries (24 months) |
| People who use the website chat | Questions and answers in the chat, the page you are on, a keyed hash of your IP for rate limiting; if you ask for a consultant, your name, contact details and message | Answer questions from our website content with an AI assistant; pass your enquiry to our team and reply | (b) steps at your request before a contract; (f) legitimate interest in answering enquiries; (a) consent for passing the conversation to our team via Telegram |
| Clients and their representatives | Contact details, correspondence, signatures, invoicing data | Perform the engagement, invoice, keep records | (b) contract; (c) legal obligations (accounting, tax) |
| Directors, shareholders, beneficial owners and key persons of clients | Identity documents, address, CV, references, source of funds and wealth, tax and criminal-record certificates where a regulator requires them | Compile and file license applications you instruct; client due diligence under AML law | (b) contract; (c) legal obligations under Law no. 129/2019 and the licensing law concerned; criminal-record data only as authorized by that law (GDPR art. 10) |
| Suppliers and partners | Business contact details | Manage the relationship | (b) contract; (f) legitimate interest |
We do not use your data for automated decision-making or profiling with legal effects. We only send newsletters or marketing e-mails if you have asked for them, and you can unsubscribe at any time.
4. Who receives your data
- Our service providers (processors): website hosting, e-mail, document storage and accounting software, under data-processing agreements (GDPR art. 28).
- Regulators and authorities to which you instruct us to file an application or report (for example ONJN in Romania, MGA in Malta, CGA in Curaçao), and authorities entitled to receive data by law, such as tax authorities and the Romanian FIU (ONPCSB).
- Professional partners involved in your engagement on your instruction: licensed counsel, notaries, translators, accredited testing laboratories, banks, EMIs and payment providers.
- Affiliated providers named in your Engagement Agreement, where one performs part of the Services.
We do not sell personal data. A current list of our processors is available on request.
5. Transfers outside the EEA
Some regulators and partners are outside the European Economic Area (for example in Curaçao, Anjouan, Nevis, the United Kingdom or Canada). Transfers rely on an EU adequacy decision where one exists (for example the United Kingdom and Canada for commercial organizations), on Standard Contractual Clauses (Commission Decision 2021/914) with our providers, on the EU–US Data Privacy Framework (Decision (EU) 2023/1795) for Google Analytics data that may reach Google LLC in the United States, or — for filings you ask us to make to a non-EEA regulator — on article 49(1)(b) GDPR, because the transfer is necessary to perform the contract with you.
6. How long we keep data
- Contact-form enquiries that do not lead to an engagement: 24 months, then deleted.
- Anti-spam records: keyed IP hashes for 24 hours; one-time form tokens for 2 hours.
- Server logs: up to 30 days, unless needed to investigate an incident.
- Client due-diligence records: 5 years after the business relationship ends (Law no. 129/2019), longer only if an authority requires it.
- Accounting and tax records: as long as Romanian accounting and tax law requires (generally 5 to 10 years).
- Engagement files: for the duration of the engagement and the limitation period for claims.
7. Your rights
You have the right to access your data (art. 15), to have it corrected (art. 16) or erased (art. 17), to restrict processing (art. 18), to data portability (art. 20) and to object to processing based on legitimate interest (art. 21). Where we rely on consent, you may withdraw it at any time without affecting earlier processing.
Send requests to hello@szilaghi.com. We reply within one month, which we may extend by two months for complex requests, telling you why (art. 12(3)). We may ask you to confirm your identity.
You may also complain to the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), Bd. G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro — or to the authority where you live or work.
8. Security
We use encrypted connections (TLS), access limited to the people working on your matter, encrypted storage for identity and due-diligence documents, confidentiality obligations for staff and partners, and separate secure transfer channels for sensitive documents. See the GDPR Policy for detail.
9. Children
Our Services are for businesses. We do not knowingly collect data from anyone under 18.
10. Changes to this policy
We update this policy when our processing changes. The effective date is shown at the top. Material changes affecting clients are notified directly.
Related: Terms and Conditions · Privacy Policy · Cookie Policy · GDPR Policy