Privacy Policy
Last updated: October 2026
This is a translation provided for convenience. The legally binding version is the Romanian text, and Romanian law applies. Where the two differ, the Romanian version prevails.
1. Identity of the controller
The controller of your personal data is Golden Audit Consulting S.R.L., with its registered office in Bacau, Romania.
Contact email: office@goldenauditconsulting.ro
Phone: +40 334 630 000
2. What data we collect and for what purposes
a) Quote request form
Data: first name, surname, email, phone, company name, the message sent.
Purpose: sending the tailored quote requested and the subsequent communication about it.
Legal basis: performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR).
Retention: 3 years from the last interaction, or until consent is withdrawn.
b) Newsletter
Data: email address.
Purpose: sending periodic information about ISO, legislation and Golden Audit Consulting® services.
Legal basis: the explicit consent of the data subject (Article 6(1)(a) GDPR).
Retention: until you unsubscribe or withdraw consent.
You can unsubscribe at any time using the link in every email.
c) Cookies and browsing data (with consent)
Data: IP address, pages visited, time on page, traffic source, browser and device data.
Purpose: traffic analysis (Google Analytics via GTM), remarketing (Facebook Pixel), tracking visitor behaviour on the site (internal platform).
Legal basis: your explicit consent through the cookie banner (Article 6(1)(a) GDPR). This data is NOT collected if you do not accept statistics and marketing cookies.
Retention: according to each provider policy (Google: 26 months, Facebook: 180 days, internal: 12 months).
d) Shop orders
Data: name, billing and delivery address, email, phone, payment data (processed exclusively by Stripe — we do not store card details).
Tax identification data: VAT number (CUI) and company name for legal entities; personal numeric code (CNP) for individuals who request an invoice. These fields are optional at checkout and we collect them solely to issue the invoice and report it through the Romanian tax authority’s e-Factura (SPV) system, as required by law. We do not use them for any other purpose and do not process them for marketing or profiling.
Purpose: processing and delivering the order, issuing tax documents and reporting them to ANAF.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) and legal accounting and tax obligations (Article 6(1)(c) GDPR). The CNP is processed solely on the basis of the legal e-Factura reporting obligation.
Retention: 10 years (accounting obligations under Romanian law).
e) The Clara AI assistant (chat window)
Data: the content of the messages you write in the chat, IP address, the page from which you opened the conversation, the language, and any data you provide voluntarily in the conversation (email, company name, phone).
Purpose: answering your questions about standards and services, preventing abuse of the service, and connecting you with a consultant when you ask for one or when the question goes beyond the assistant’s scope.
Legal basis: pre-contractual steps at your request (Article 6(1)(b) GDPR) for the conversation content; legitimate interest (Article 6(1)(f) GDPR) for the IP address, used strictly to limit abuse.
Clara is an artificial intelligence system, not a person. You are informed of this in the chat window before the first message, and a handover to a human consultant is announced explicitly.
Please do not enter sensitive data in the chat (health, card details, passwords). Use our direct contact channels for such information.
Retention: 12 months from the last message in the conversation.
f) ISO to Mastery online training (game and training sessions)
Data: email address (required for access and for sending the report), display name, the job/role chosen in the game, the access code, the decisions and scores in the session, messages written in the session chat; the voice recording of the discussion and its transcript, only if you gave explicit consent to recording.
Purpose: running the training, evaluating the team’s answers, generating and sending the final report (score, classifications, SWOT analysis).
Legal basis: performance of the training contract (Article 6(1)(b) GDPR) for participation, scoring and the report; consent (Article 6(1)(a) GDPR) for recording and transcribing your voice. You may refuse voice recording; in that case you cannot take part in sessions that use automated evaluation of the discussion.
Automated processing with artificial intelligence: the audio recording is transcribed automatically and the transcript is analysed by an AI system that proposes a classification of the answers. The proposal supports the training evaluation; in the facilitated option it is reviewed and confirmed by a person. No decisions with legal effects on you are made based on this processing.
Audio data and transcripts are sent to OpenAI (USA) via its API; under OpenAI’s API terms, they are not used to train its models.
Retention: audio recording — deleted after the transcript is generated, at most 30 days after the session; transcript, scores and report — 24 months after the session; email address and billing data — as set out in section d).
g) Phone calls to the company number
Data: the phone number you call from, the date, time and duration of the call, the audio recording of the conversation, its transcript and summary, and any voicemail left outside business hours.
Notice: at the start of every call, an automated message informs you that the call may be recorded. If you do not want to be recorded, you can contact us by email or through the quote form.
Purpose: keeping a record of requests received by phone, calling you back when we could not answer, preparing the quote or answer you asked for, and improving the quality of our services.
Legal basis: our legitimate interest in documenting client requests accurately and improving our services (Art. 6(1)(f) GDPR); steps taken at your request prior to entering into a contract, when you call for a quote (Art. 6(1)(b) GDPR). You may object to this processing at any time.
Automated processing: the recording is transcribed automatically and an artificial intelligence system generates a summary and follow-up tasks. The summary is used internally as support; no decisions with legal effects on you are taken on the basis of this processing.
Retention: audio recording — kept by the telephony provider for at most 12 months; transcript and summary — 12 months from the call; call data (number, date, duration) — 3 years from the last interaction.
3. Who we share the data with
Your data may be shared with the following categories of recipient, strictly for the purposes set out above:
- • Stripe Inc. — secure payment processing (USA, under EU standard contractual clauses)
- • Google LLC — traffic analysis through Google Analytics and Google Tag Manager (USA, standard clauses)
- • Meta Platforms Inc. — remarketing through Facebook Pixel (USA, standard clauses)
- • Supabase Inc. — hosting of the website and online training database, including audio recordings (EU, data centre in Ireland)
- • Vercel Inc. — hosting of the website and the training application (USA, under EU standard contractual clauses)
- • Resend (Plus Five Five Inc.) — sending transactional emails: access links, training codes, reports (USA, under EU standard contractual clauses)
- • OpenAI, L.L.C. — automatic transcription of training audio recordings and of phone calls, and AI analysis of the transcript for the final training report (USA, under EU standard contractual clauses; data sent via the API is not used to train models)
- • Cookiebot/Usercentrics — management of cookie consent (EU)
- • Anthropic PBC — generating the Clara assistant’s replies and phone call summaries (USA, under EU standard contractual clauses)
- • Zadarma — telephony: handling calls to the company number, recording conversations and voicemails
- • Voyage AI (MongoDB Inc.) — turning questions into vectors, for searching our documentation (USA, standard clauses)
- • Telegram Messenger Inc. — notifying the consultant when a handover is requested, including the last messages of the conversation, and of missed phone calls (caller number, call time)
- • LIKE WEB S.R.L. (mefi.ro) — issuing invoices and submitting them to e-Factura; receives billing data, including the VAT number (CUI) or personal numeric code (CNP) (Romania)
- • ANAF — reporting of invoices through the e-Factura / SPV system, a legal obligation (Romania)
- • Authorised courier — for delivering physical products (delivery address only)
We do not sell, rent out or transfer your personal data to third parties for their own commercial purposes.
4. Cookies
The website uses cookies. They are managed through the Cookiebot by Usercentrics platform. On your first visit you can accept or refuse the non-essential cookie categories.
| Category | Provider | Purpose | Duration |
|---|---|---|---|
| Necessary | Cookiebot, Cloudflare | Website operation, security, consent management | Session / 12 months |
| Statistics | Google Analytics (GTM), internal Supabase | Traffic analysis, visitor behaviour | 26 months / 12 months |
| Marketing | Facebook Pixel (Meta) | Remarketing, measurement of advertising campaigns | 180 days |
You can change your cookie preferences at any time from the consent banner accessible in the footer.
5. Your rights
Under the GDPR (EU Regulation 2016/679), you have the following rights:
🔍 Right of access
You can request a copy of the data we hold about you.
✏️ Right to rectification
You can ask for inaccurate or incomplete data to be corrected.
🗑️ Right to erasure
You can ask for your data to be erased under the conditions set out in the GDPR.
⏸️ Right to restriction
You can ask for the processing of your data to be restricted.
📦 Right to portability
You can receive your data in a structured, machine-readable format.
🚫 Right to object
You can object to processing based on legitimate interest or to direct marketing.
↩️ Withdrawal of consent
You can withdraw consent at any time, without affecting the lawfulness of processing before that point.
⚖️ Right to complain
You can lodge a complaint with ANSPDCP, the Romanian supervisory authority.
To exercise any of these rights, contact us at . We reply within 30 calendar days at most.
6. Data security
We apply appropriate technical and organisational measures to protect your data: HTTPS/TLS connections, restricted database access, PCI-DSS certified payment processors (Stripe), and storage in EU data centres. Even so, no system is 100% invulnerable. In the event of a security incident affecting your data, we will notify you as the GDPR requires.
7. External links
The website may contain links to external sites (ANPC, certification bodies, partners). This privacy policy does not apply to those sites. We encourage you to read their own privacy policies.
8. Changes to this policy
We reserve the right to update this privacy policy. Any significant change will be communicated by showing the update date at the top of the page. We encourage you to review this page periodically.