Personal Data Processing

1. MIRUS Group:

  • Mirus Consultanţă Fiscală S.R.L.
    Address: Bucharest, District 1, 26 Biharia Street, 4th floor, postal code 013981
    Tax ID No.: RO28785604
    Registration: Bucharest Trade Registry
    Reg. No.: J40/8224/2011
    NACE: 6920 “Accounting, bookkeeping and auditing activities; tax consultancy”
  • Mirus Consultanţă în Contabilitate S.R.L.
    Address: Bucharest, District 1, 26 Biharia Street, 4th floor, postal code 013981
    Tax ID No.: RO32756160
    Registration: Bucharest Trade Registry
    Reg. No.: J40/1358/2014
    NACE: 6920 “Accounting, bookkeeping and auditing activities; tax consultancy”
  • Mirus Consultanţă Salarizare S.R.L.
    Address: Bucharest, District 1, 26 Biharia Street, postal code 013981, Romania
    Tax ID No.: RO28765810
    Registration: Bucharest Trade Registry
    Reg. No.: J40/8146/2011
    NACE: 783 “Supply services and labor management”
  • Mirus Employment Services S.R.L.
    Address: Bucharest, District 1, 26 Biharia Street, 4th floor, postal code 013981
    Tax ID No.: RO30860651
    Registration: Bucharest Trade Registry
    Reg. No.: J40/12772/2012
    NACE: 7820 “Temporary employment agency activities”
  • Tax Representation S.R.L.
    Address: Bucharest, District 1, 26 Biharia Street, 4th floor, postal code 013981
    Tax ID No.: RO30328094
    Registration: Bucharest Trade Registry
    ID No.: J40/6973/2012

NACE: 6920 “Accounting, bookkeeping and auditing activities; tax consultancy”, hereinafter referred to as MIRUS, is processing its Clients’ personal data (persons covered by law no. 677/2001 on the protection of persons with regard to processing personal data and the free movement thereof), by complying with the principles mentioned below, for legitimate purposes, namely for meeting contractual obligations towards them.

2. Personal data

Personal data is information relating to an identified or identifiable person. This information may include, among others, but not limited to: name, address, telephone number, information on personal assets, health status, IDs, personal identification number, etc.

Personal data processing is carried out by automated and manual means, by complying with legal requirements and under terms ensuring safety, confidentiality and compliance with the rights of data subjects.

Personal data processed by MIRUS may be disclosed to the following recipients: the person concerned and its legal representatives, the employer or potential employer of the person concerned, Romanian Immigration Office, Notaries Public, Trade Register and other authorities/ public institutions empowered by the law to request information on personal data collected during company’s specific activity, other possible public, central and local authorities, other companies within operator’s group, as well as any other natural persons and legal entities established according to the Client’s requests.

Personal data processing is subject to the following principles:

  • Lawfulness. Personal data processing shall be made on the grounds of and pursuant to the law;
  • Well-determined purpose. Any personal data processing shall be made for well- determined, explicit and legitimate purposes;
  • Confidentiality. Processors of personal data, on behalf of an institution, are provided in the employment agreement and job description with a confidentiality clause.
  • Acknowledgement of the person concerned. A key element of the personal data processing is the agreement that the person concerned must express it, which is effective based on thorough information and own choice;
  • Data quality. Data that is processed must be adequate, relevant and not excessive in relation to the purpose they are collected for and subsequently processed;
  • Protecting data subjects. According to this principle, data subjects have the right to access data that are processed, to intervene on such data, to oppose and not to be subject to an individual decision, as well as the right to address the National Authority for the Supervision of Personal Data Processing or the court for defending the rights guaranteed by law and which were violated;
  • Safety. Safety measures for personal data shall be such as to ensure an optimum level of security for processed personal data;
  • Notification. Personal data operator is notified to the National Authority for the Supervision of Personal Data, receiving an operator number.

Under the legislation in force, the persons concerned according to Law no. 677/2001, have the following rights:

  • the right to information (art. 12);
  • the right of access to data (art. 13);
  • the right to intervene on data (art. 14);
  • the right to oppose (art. 15);
  • the right not to be subject to an individual decision (art. 17);
  • the right to go to court (art. 18).

2.1. Right to information

If personal data are obtained directly from the person concerned, the latter should be informed on the following matters:

  • identity of the operator and its representative, if necessary;
  • the purpose of data processing;
  • additional information, such as: recipients or categories of data recipients; whether the supply if all data requested is mandatory and the consequences of a refusal to provide them; the existence of the rights provided under this law for the person concerned, especially the right to access, to intervention on the data and to opposition, as well as the conditions under which they could be exercised;
  • any other information of which supply is required by order of the supervision authority, taking into consideration the specific processing.

2.2. The right of access to data

Any person concerned is entitled to obtain from the operator, on request (free of charge, once a year), the confirmation that its personal data are or are not processed by it, as well as the following information:

  • information on the processing’s purposes, categories of data concerned and recipients or categories of recipients to whom the data are disclosed;
  • communicating in an intelligible form the data undergoing the processing and of any available information as to their source;
  • information on the functioning principles of the mechanism through which any automated data processing is carried out;
  • information regarding the right to intervene on the data and the right to opposition as well as the conditions under which they may be exercised;
  • information on the possibility of consulting the personal data processing records, of submitting a complaint to the supervision authority, and of going to the court for appealing against operator’s decisions, in accordance with legal provisions.

The operator has to communicate the information requested within 15 days from the date of receipt.

2.3. The right to intervene on data

Any person concerned is entitled to obtain, free of charge, from the operator, through a request made in writing, dated and signed:

  • correction, updating, blocking or deletion of data the processing of which is not in compliance with the law, especially of incomplete or inaccurate data;
  • converting into anonymous data such data of which processing is compliant with Law no. 677/2001;
  • notification to third parties to whom the data were disclosed, unless this notification proves impossible or it involves a disproportionate effort towards the legitimate interest that could be harmed.

The operator is required to communicate the measures taken and, if applicable, the name of the third party to whom the personal data on the person concerned were disclosed, within 15 days from the date of receipt.

2.4. The right to oppose

The person concerned has the right to object, at any time, through a written application, dated and signed, for grounded and legitimate reasons relating to its particular situation, with regard to the data that are intended to be processed, unless there are laws to the contrary. In the event of justified opposition, the processing may no longer involve those data.

The person concerned has the right to object, at any time, free of charge and without any justification with regard to whether its personal data to be processed for direct marketing purposes, on behalf of the operator or of a third party, or to be disclosed to third parties for such purposes.

The operator is required to notify the person concerned the measures taken and, if applicable, the name of the third party to whom the personal data on the person concerned were disclosed, within 15 days from the date of receipt.

2.5. The right not to be subject to an individual decision

Any person is entitled to request and obtain:

  • the withdrawal or cancellation of a decision which produces legal effects concerning it, made solely on the basis of personal data processing, carried out by automatic means, intended to evaluate certain aspect of its personality, and its professional competence, credibility, behavior or other similar matters;
  • revaluation of any other decision made, which significantly affects it, provided the decision was made solely on the basis of data processing that meets the conditions specified above.

2.6. The right to go to court

Notwithstanding the possibility of filing a complaint with the supervision authority, any person who has suffered damage as a result of processing personal data, carried out illegal, may appeal to the competent court for settlement.

The competent court is the one within whose jurisdiction the applicant domiciles. The legal proceeding is exempt from stamp duty.

In order to exercise your rights in accordance with law 677/2001, you may submit a written request, dated and signed to MIRUS, at the following address: Bucharest, 17 Dumitru Florescu Street, District 1, Romania, or e-mail: office@mirus-group.eu.