Privacy Policy

Last updated: 4 November 2026

1. Who we are

The data controller is Mazilu & Partners Consulting SRL, with its registered office at 11 Victoriei Street, Block 11, Entrance C, Apt. 2, Slatina, Olt County, postal code 230008, Romania, registered with the Trade Register under no. J28/622/2021, unique registration code (CUI) 44455861 (“M&P”, “we”). You can contact us at [email protected] or +40 767 57 31 57.

This policy explains how we process the personal data of visitors to www.maziluandpartners.com, in accordance with Regulation (EU) 2016/679 (GDPR).

2. What data we process, why and on what legal basis

Situation	Data	Purpose	Legal basis
You request a free guide	name, business email address, the guide requested	to send you the guide you requested	Art. 6(1)(b) – steps taken at your request
You tick the box to receive updates	name, email, date and wording of consent, email confirmation	to send you new guides and the “CFO Agenda” newsletter, at most twice a month	Art. 6(1)(a) – consent
You book the assessment	name, email, company, role, chosen topic, time	to organise the meeting and prepare the summary	Art. 6(1)(b) – pre-contractual steps
You request a proposal through the website form	name, company or tax ID, email, phone (optional), the service, the deadline and your message	to reply and prepare the proposal	Art. 6(1)(b) – pre-contractual steps
You write to us or call us	the data you send us	to reply to you	Art. 6(1)(f) – legitimate interest
You offer to work with us as a specialist	name, contact details, CV (sent by email to [email protected]), qualifications and professional experience	to assess a collaboration on future engagements	Art. 6(1)(b) – pre-contractual steps
You receive our emails	email address and delivery status (recorded by Brevo); we do not record message opens or link clicks	to know whether emails reach the recipient	Art. 6(1)(b) for the guide email; Art. 6(1)(a) for the newsletter
You open a page with a form	IP address and technical browser signals, analysed by Cloudflare Turnstile	to protect forms against bots and abuse	Art. 6(1)(f) – legitimate interest
You visit the website	IP address and technical data in security logs; aggregated, cookie-free statistics through Cloudflare Web Analytics	website security and visitor numbers	Art. 6(1)(f) – legitimate interest

Your name and email address are required to send you the guide; without them we cannot process the request. Any other information is optional.

We do not use the data for automated decision-making or profiling.

3. Who receives the data

The data is processed by providers acting on our behalf, under contracts that meet Article 28 GDPR:

Cloudflare, Inc. – website hosting, protection of forms against bots (Cloudflare Turnstile) and visitor statistics;
Brevo SAS (formerly Sendinblue SAS), France – sending guides, the newsletter and messages from the proposal request form;
Microsoft Ireland Operations Ltd. – meeting booking (Microsoft Bookings), online meetings (Microsoft Teams) and email.

We do not sell the data or share it with other companies for marketing purposes. We may disclose it to public authorities only where the law requires it.

4. Transfers outside the European Economic Area

Some providers or their subprocessors may process data outside the EEA, including in the United States. Transfers take place only with the safeguards provided by the GDPR: the EU–US adequacy decision (EU–US Data Privacy Framework), for certified providers, or the standard contractual clauses approved by the European Commission.

5. How long we keep the data

guide requests: 24 months from the last interaction;
newsletter subscription: until you unsubscribe; records of consent and of its withdrawal: 3 years after unsubscribing;
assessment bookings, proposal requests and correspondence: 24 months, unless you become a client, in which case the periods in the contract and in audit and archiving legislation apply;
security logs: up to 90 days.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting processing carried out before withdrawal. You can unsubscribe from the newsletter with a single click from any email.

Right to object. Where we process data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation, under Article 21 GDPR. An objection to marketing messages takes effect immediately, without any justification.

To exercise your rights, write to [email protected]. We reply within one month; this may be extended by a further two months where necessary, taking into account the complexity and number of requests; we will tell you about any extension within the first month (Article 12(3) GDPR).

Our contact for data protection matters is Cătălin Mazilu, managing partner, at [email protected].

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28–⁠30 G-ral Gheorghe Magheru Blvd., Sector 1, Bucharest, www.dataprotection.ro.

7. Security

We apply appropriate technical and organisational measures: encrypted connection (HTTPS), restricted access to data and two-factor authentication for the accounts that manage it.

8. Changes

We publish any changes on this page, with the date of the update.