1. Who processes your data
FISCALNET SRL, with its registered office in Oradea, Str. Nicolae Jiga No. 50, Bihor County, postcode 410013, Tax Reference Number (CUI) 48933292, registered with the Trade Register under No. J05/2606/2023, hereinafter referred to as "FiscalNet" or "we", is the data controller for the activities described in this policy.
For questions about data protection and the exercise of rights, you can write to us at office@fiscalnet.ro, via the contact form or by post to the address indicated above. You do not need to have a customer account to submit a request to us.
The policy covers interactions via fiscalnet.ro, driverfiscal.ro and shop.driverfiscal.ro, commercial and partnership enquiries, the purchase and administration of licences, as well as support via email, contact form, telephone and remote access. fiscalnet.ro currently redirects to driverfiscal.ro.
Data about a company is not always personal data. However, the policy applies to information that identifies natural persons, including representatives, employees, contact persons, individual professionals and users of the services.
2. What data we process and where we obtain it from
Depending on the interaction, we process:
- contact and professional details: name, email, telephone number, company represented and position, if provided to us;
- order and invoicing data: name, tax code, registration number, address, product or service selected, amount, payment status and related correspondence;
- licensing data: the FiscalNet serial number provided, the type and validity of the licence, activations, and the information necessary to identify the product for which you are requesting support;
- data from requests: the message, comments, documents and files submitted, the description of errors and our responses;
- telephone data: number, date, time, duration and routing of the call; for calls selected for recording, the voice and content of the conversation;
- technical data: the IP address and the logs necessary for the operation and security of the websites; for support, information about the application, system and equipment relevant to the reported issue;
- during remote support, the information visible on the screen and the files to which you allow access for intervention.
We mainly receive data directly from you. We may receive contact or licensing data from the company you represent or from the distributor involved in the request. The purchase form allows the retrieval of tax identification data from ANAF. Payment providers can inform us of the result and the transaction reference.
Please provide only the necessary information. Do not include passwords, authentication codes, full card details, medical information, or other sensitive data unrelated to the request in messages or conversations.
Before a remote session, close any documents and applications not related to the support intervention.
3. What we use the data for and on what legal basis
The legal bases set out below refer to Article 6(1) of Regulation (EU) 2016/679. Point (b) concerns a contract with the data subject or the steps requested by the data subject prior to its conclusion. For individuals representing a company, we rely, where applicable, on the legitimate interest in communicating and managing the commercial relationship, point (f); we do not assume that the representative is personally a party to the contract.
Requests by email and form, business discussions, partnerships
Main data: Contact, Company, Message
Purpose and legal basis: Response and quotation: b), when applicable; f), for professional communication and request management
Standard retention: No more than 12 months from the closure of the request, unless it becomes part of a contractual relationship
Relevant recipients: Commercial or technical staff; email and IT providers
Orders, licences and services
Key data: Identification, Invoicing, Serial number, Order, Payment status
Purpose and legal basis: Provision and administration of the service: b); f), for relations with representatives and the prevention of unauthorised use
Standard retention: For the duration of the relationship or the validity of the licence; thereafter, only the data necessary for obligations or claims, as set out in Section 6
Relevant recipients: Authorised personnel, IT, payment providers; the distributor involved
Invoicing and accounting records
Main data: Invoice, identification, transaction
Purpose and legal basis: Tax and accounting obligations: c)
Standard retention: The statutory period, detailed in Section 6
Relevant recipients: Accounting, banks, invoicing providers, competent authorities
Technical support and documentation of the intervention
Main data: Contact, serial number, errors, correspondence, technical data
Purpose and legal basis: Problem resolution: b), when applicable; f), for support provided to representatives and for follow-up of interventions
Standard retention: Intervention record: no more than 12 months from closure; temporary diagnostic files: no more than 30 days from closure
Relevant recipients: Technical staff and IT or remote access providers
Selective telephone recordings
Key data: Voice, conversation and call identifiers
Purpose and legal basis: Verification and improvement of service quality: f), under the conditions set out in Section 4
Standard retention: No more than 30 days from the call
Relevant recipients: Authorised quality officers; maintenance providers only if the intervention requires access
Operation and security
Main data: IP, technical and access events
Purpose and legal basis: Operation, diagnostics and prevention of misuse: f)
Standard retention: Standard logs: no more than 30 days; specific incidents are handled separately
Relevant recipients: Authorised IT staff and providers
Data protection requests
Main data: Contact, request, necessary checks, response
Purpose and legal basis: Fulfilment of GDPR obligations: c); documentation of compliance and defence of rights: f)
Standard retention: For the duration of the resolution and for no longer than 3 years from closure, unless there is a dispute or a special obligation
Relevant recipients: Designated persons, advisers and competent authorities
Maximum retention periods do not justify retaining data that has become unnecessary earlier. We do not consider the mere sending of a message, placing of an order, or continuation of a call to constitute general consent for other uses.
4. Telephone calls and call recording
Certain calls may be recorded for the purpose of verifying and improving the quality of commercial and support services. We do not systematically record all calls for this purpose.
Before recording begins, we will inform you by automated telephone message or, for a call initiated by us, through our representative. Recording begins only after notification. The voice, the information communicated and the call identification data are processed.
The basis for the recording is the legitimate interest in identifying and correcting specific shortcomings in the support provided. We select a limited number of calls, to the extent justified by this purpose. We do not use these recordings for advertising, voice biometric identification, or the training of artificial intelligence models.
You can object to the recording and request access to the data in the recording that concerns you. If you do not wish the call to be recorded, you can end the call and write to us at office@fiscalnet.ro or via the contact form. If you raise this during the conversation, the representative will stop the recording, if the function is available, or will conclude the recorded part and direct you to the written channel. Objections to data already recorded are handled in accordance with Section 9.
Use of the written channel is not conditional on acceptance of registration. The commercial terms of the requested support continue to apply.
The records are stored locally, in the telephone exchange used by FiscalNet. Access is restricted to authorised persons who verify the services. Any maintenance providers may only have access if the intervention requires it, based on our instructions and on obligations regarding confidentiality and data protection.
Recordings are deleted no later than 30 days after the call is made, including operational copies, except in the specific situations described below. Any backup copy is not used to extend this period.
In the event of a complaint or a specific dispute, we can isolate only the relevant record if its retention is necessary and justified for the establishment, exercise or defence of a right, or if it is required by law.
We document the reason and review the need for retention; the record is deleted when the justifying cause ceases to exist. This exception does not apply preventively to all calls.
To identify a call, you can provide us with the number used and the date or approximate time period. We verify identity in proportion to the risk and protect the data of other participants when granting access. If the recording has already been deleted in accordance with the applicable retention period, we will inform you of this.
5. Specifics of support and payments
Remote support is initiated at your request and with your authorisation of access to the device.
We only access the information necessary for the intervention and limit the copying of files. The tools presented on the website for this type of support are AnyDesk and TeamViewer. Recording the telephone call does not automatically entail recording the screen; any recording of the session would require separate notification before activation.
For the data of your customers or employees to which we have exclusive access on behalf of your organisation, the roles and instructions are set out in the applicable data processing agreement. This policy does not replace that agreement and does not entitle us to use that data for our own purposes.
For card payments, also refer to the information from the provider identified in the payment interface. Do not send card details by phone, email, or the contact form. The commercial data of the transaction and the information required for invoicing are processed separately from the data used to authorise the payment.
6. How we determine the retention period
For supporting documents and accounting records subject to Article 25 of the Accounting Law No. 82/1991, the standard retention period is 5 years, calculated from 1 July of the year following the financial year in which they were prepared, subject to any special rules applicable to the specific document.
After the termination of the contractual relationship, we retain only the data necessary to prove obligations and defend rights, usually until the expiry of the 3-year limitation period applicable to the claim in question. The start time and any suspensions or interruptions are analysed for each situation. This rule does not automatically extend the retention of calls, diagnostic files, or all messages.
For a permanent licence, we may retain the minimum information necessary to recognise the right of use for as long as that right exists; this does not entail the indefinite retention of all correspondence with the contact person. We update or delete the data of individuals who no longer represent the client when we become aware of the change.
Upon expiry of the time limits, we effectively delete or anonymise the data. Exceptional retention for a specific audit, dispute or incident is limited to relevant information and is reviewed periodically.
7. Recipients and international transfers
In addition to authorised personnel, providers of hosting, IT maintenance, email, telephony, storage, invoicing and remote support services may also have access for the activities indicated in the table. Their access is contractually and technically limited to the services provided. Providers who process data on our behalf have confidentiality and data protection obligations.
Banks, payment providers, consultants and authorities may have their own processing obligations. We only share information about your request with a distributor when their involvement is necessary and there is an applicable legal basis. We do not share your data with partners for their marketing campaigns simply because you have contacted us.
We use ROMARG SRL for nameserver/DNS services, web hosting and email. Telephone recordings are stored separately, locally, on the telephone exchange's memory card, in accordance with Section 4.
For the activities described in this policy, we do not transfer personal data outside the European Economic Area (EEA) and do not allow access to it from outside the EEA. If we intend to change this situation, we will inform you before the new processing takes place and will apply the necessary legal safeguards.
You can request this from office@fiscalnet.ro information about the recipients of your data.
8. Cookies and commercial communications
Google Analytics is enabled on the presentation website only with analytics consent. Visit information is sent to Google for usage statistics and may include cookie identifiers, pages viewed and technical browser and device information. We do not intentionally send form data, company tax identifiers or fiscal device serial numbers to Analytics. Rejecting allows you to use the basic features. Consent can be withdrawn using “Cookie preferences”. Personalised advertising and Google Signals are disabled. Shop and order data have a separate implementation.
The list of technologies used by the presentation website, the purposes, the duration and the method of deleting local data are explained on the Cookies and Local Storage page. This notice should be consulted separately from the policies of the shop and of external services.
View cookies and local storage
Data from contact forms and orders are not automatically added to newsletter lists. If we offer you the option to subscribe to commercial communications, we request your consent separately and include a simple way to withdraw in every message. Communications that are strictly necessary for a request, order or licence are separate from marketing.
9. Your rights
Under the GDPR, you can request access to and a copy of your data, as well as rectification, erasure, and restriction.
Portability applies to data provided by you and processed automatically on the basis of consent or a contract. Consent may be withdrawn at any time, without affecting the processing carried out prior to the withdrawal.
Right to object: for processing based on legitimate interest, you may object on grounds relating to your particular situation. We cease processing, except where we demonstrate compelling legitimate grounds that prevail or the necessity for legal claims. For direct marketing, the right to object is unconditional, and processing for this purpose ceases.
We respond without undue delay, within one month of receiving the request at the latest. For complex or numerous requests, the deadline may be extended by a further two months, with the extension and the reasons for it being communicated within the first month. Requests are generally free of charge; only in the case of manifestly unfounded or excessive requests do the legal exceptions, duly justified, apply.
Identity verification is limited to the necessary information if there are reasonable grounds for doubt. We do not automatically request a copy of the identity document. Protecting other individuals may require the redaction of certain information, not the automatic rejection of the entire request.
You may contact the National Supervisory Authority for Personal Data Processing and the competent courts. You can contact us for resolution, without this limiting the rights recognised by law.
10. Provision of data and automated decision-making
Mandatory fields are indicated in the relevant form. The absence of data required for response, licensing or invoicing may prevent the request from being processed or the order from being fulfilled. Optional information is not a condition for the provision of the service. Refusing marketing or non-essential cookies does not prevent an order.
We do not use telephone recordings for solely automated decisions that produce legal effects or similarly significantly affect you. If we introduce other processing of this type, we will provide the information and safeguards required by law before implementation, including explanations of the logic used and the consequences.
11. Security and Updates
We apply technical and organisational measures proportionate to the risks, including access authorisation, staff confidentiality, protection of transmissions, management of backup copies and incident management. Access to records and data stored on media is limited to what is necessary for professional purposes.
We review the policy when we change the services or the method of processing. We publish the updated version and its date; for significant changes, we use a form of notification appropriate to the situation. A change to the policy does not retroactively make processing authorised.
Data protection contact: office@fiscalnet.ro.
Contact: office@fiscalnet.ro
Back to top ↑