How Carpathia Energy handles personal data, under Regulation (EU) 2016/679 (the GDPR) and Romanian data protection law.
1. Who we are
Carpathia Energy, an energy advisory established in Bucharest, Romania, is the controller of the personal data described here. Contact us at office@carpathiaenergy.com for any privacy matter, or to request our full company registration details. Where we instead process data on a client's instructions during a mandate, we act as a processor and the client's own notice applies.
2. What we collect, and where it comes from
From you: name, job title, employer, email, phone and business address; our correspondence; information exchanged during a mandate; and invoicing details.
From public sources: business contact details of people at companies active in the energy sector, from professional networking sites, company websites, the Romanian Trade Register, ANRE registers and industry publications. We tell people within one month of collecting their data this way, or at first contact if sooner.
Automatically: our host records standard server logs, including IP address and pages requested, to run and secure the site. The contact form collects only what you type into it.
We do not seek special category data as defined in Article 9 GDPR, and we carry out no automated decision-making or profiling under Article 22.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and discussing a mandate | Pre-contractual steps at your request — Art. 6(1)(b) |
| Providing advisory services and managing the engagement | Performance of a contract — Art. 6(1)(b), or our legitimate interests where the contract is with your employer — Art. 6(1)(f) |
| Business development and professional contact in the energy sector | Our legitimate interest in developing the business — Art. 6(1)(f) |
| Invoicing, accounting and tax | Legal obligation — Art. 6(1)(c) |
| Defending legal claims and securing the website | Our legitimate interest in protecting our position and our systems — Art. 6(1)(f) |
| Market updates, where offered | Consent — Art. 6(1)(a), withdrawable at any time |
4. Who we share it with, and transfers abroad
We do not sell personal data or share it for third-party marketing. We disclose it to service providers acting on our written instructions (hosting, email, cloud storage, IT support), to our accountants, lawyers and insurers, to parties involved in delivering a mandate with your knowledge, and to public authorities where legally required. Information shared with us during a mandate is otherwise treated as confidential.
Because we work with clients worldwide, data may be transferred outside the European Economic Area. Where it is, we rely on a European Commission adequacy decision, on Standard Contractual Clauses, or — for occasional transfers necessary to perform a contract with you or to defend legal claims — on a derogation under Article 49 GDPR. Ask us and we will tell you which applies to a specific transfer.
5. How long we keep it
Enquiries that do not lead to an engagement: up to 24 months from last contact. Engagement files and correspondence: the term of the engagement plus 3 years, being the general limitation period under Romanian law, extended while a claim is pending. Invoices and accounting records: as Romanian law requires, generally 10 years. Business development contacts: until you ask to be removed. After that we delete or anonymise the data. We apply security measures appropriate to the risk, including HTTPS, access controls and confidentiality obligations on anyone acting for us.
6. Your rights
Subject to the conditions in the GDPR you may request access to your data, rectification of it, erasure, restriction of processing, or portability. You may object to processing based on legitimate interests, and we stop direct marketing on request without exception. Where we rely on consent you may withdraw it at any time, without affecting what was done beforehand.
Email office@carpathiaenergy.com. We respond within one month. Some rights are limited where we must keep data to meet a legal obligation or defend a claim.
You may also complain to a supervisory authority, in particular where you live or work. In Romania this is ANSPDCP, B-dul General Gheorghe Magheru 28–30, Sector 1, Bucharest, www.dataprotection.ro.
7. Cookies and changes
This site sets no cookies and uses no analytics, advertising or tracking, which is why there is no cookie banner. It loads typefaces from Google Fonts, so your IP address is transmitted to Google and may be processed outside the EEA; we can serve them from our own server on request. External links, such as LinkedIn, are governed by their own notices.
We may update this notice. The version on this page is the one in force, and we will tell clients directly about material changes.