1. Controller Information

For GDPR purposes, AMS International Consulting Group is the data controller for the processing described in this Policy, unless explicitly stated otherwise in a separate written agreement (e.g., a Data Processing Agreement for client engagements).

2. Scope of This Policy

This Policy applies to personal data we collect through (i) the Site, (ii) communications with us (email, phone, social media, video calls), (iii) lead generation and inquiry forms, and (iv) business development and client relationship management activities. Where we process personal data strictly on behalf of a client as a processor (e.g., in a consulting project that involves client-controlled datasets), such processing is governed by the applicable contract and/or Data Processing Agreement.

3. Categories of Personal Data We Collect

3.1 Data you provide directly

We may collect personal data you voluntarily provide, including:

• Identity & contact data: name, email address, phone number, business address.
• Professional data: job title, company name, department, professional role, corporate identifiers (where relevant).
• Communication data: contents of messages, inquiries, feedback, call notes, meeting details, and correspondence.
• Commercial data: service interest, proposal requests, engagement details, invoicing references (as applicable).

3.2 Data collected automatically

When you use the Site, we may collect certain data automatically, such as:

• Technical data: IP address, device type, browser type, operating system, language preferences, time zone.
• Usage data: pages viewed, session duration, referral URLs, clickstream data, approximate location derived from IP (city/region level).
• Cookie/identifier data: cookies, pixel tags, and similar technologies (subject to your cookie choices/consent).

3.3 Special categories of data

We do not intentionally collect special categories of personal data (e.g., health, biometric, political opinions, religion) via the Site. Please do not submit such data through forms or email unless we have explicitly requested it and agreed appropriate safeguards in writing.

4. Sources of Personal Data

We may collect personal data from the following sources:

• Directly from you (forms, email, phone, meetings, messages).
• Automatically from your device when you browse the Site (cookies/analytics depending on consent).
• From publicly available business sources (e.g., company websites, professional directories) for B2B outreach where permitted by law.
• From third parties you authorize (e.g., referrals, partners), in accordance with applicable law.

5. Purposes of Processing and Legal Bases (GDPR)

We process personal data only where we have a lawful basis under GDPR, including:

6. How We Use Personal Data

We use personal data for the following purposes:

• To operate, maintain, and secure the Site (including monitoring, auditing, and incident prevention).
• To respond to inquiries, schedule calls/meetings, and provide requested information.
• To provide, administer, and improve our Services and business processes.
• To send service messages and relationship communications (non-marketing), including operational updates.
• To send marketing communications where permitted and in line with your preferences/consent (you can opt out at any time).
• To establish, exercise, or defend legal claims; to enforce our Terms; and to protect our rights, property, and safety.
• To comply with legal, accounting, and tax obligations.

7. Cookies and Similar Technologies

We use cookies and similar technologies (e.g., pixels, local storage) to operate the Site, enhance user experience, analyze traffic, and support marketing—depending on configuration and your consent. For details about types of cookies, purposes, and how to manage preferences, please refer to our Cookie Policy (recommended as a separate page).

Where required by law, non-essential cookies (e.g., analytics/marketing) will be used only after you provide consent via a cookie banner/consent management platform. You can modify your browser settings to block cookies; however, certain Site features may not function properly.

8. Sharing and Disclosure of Personal Data

We do not sell your personal data. We may disclose personal data in the following circumstances:

• Service providers (processors): trusted vendors who host the Site, provide analytics, email delivery, CRM, IT/security support, scheduling, and similar services—under contractual safeguards.
• Professional advisors: lawyers, auditors, accountants, insurers, and consultants where necessary for advice, compliance, or defense of claims.
• Legal and regulatory disclosures: to courts, authorities, or law enforcement where required by law or to protect rights and safety.
• Corporate transactions: in connection with a merger, acquisition, restructuring, financing, or sale of assets (subject to appropriate confidentiality and legal safeguards).
• With your instructions/consent: where you request or authorize disclosure.

9. International Data Transfers

We may transfer personal data to countries outside the European Economic Area (“EEA”) or the UK where our service providers or operations require it. Where such transfers occur, we implement appropriate safeguards as required by GDPR/UK GDPR, such as adequacy decisions, Standard Contractual Clauses (SCCs), and supplementary measures where necessary.

You may request information about applicable safeguards by contacting us at business@amaliaconsulting.com.

10. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, including to comply with legal obligations, resolve disputes, enforce agreements, and maintain business records. Retention periods vary depending on the data type, purpose, and legal requirements (e.g., accounting/tax record retention). Where feasible, we anonymize or securely delete data when no longer required.

11. Security Measures

We implement reasonable and appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures may include access controls, least-privilege permissions, encryption where appropriate, backups, logging, and incident response processes.

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security and disclaim liability for unauthorized access beyond what is imposed by mandatory law. You are responsible for maintaining the security of your own devices, networks, and communications.

12. Your Rights (EEA/UK)

Subject to conditions and exemptions under applicable law, you may have the following rights regarding your personal data:

• Access – obtain confirmation whether we process your data and access a copy.
• Rectification – correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) – request deletion in certain cases.
• Restriction – request limitation of processing in certain cases.
• Portability – receive data in a structured, commonly used format (where applicable).
• Object – object to processing based on legitimate interests and to direct marketing at any time.
• Withdraw consent – where processing is based on consent.

To exercise your rights, contact us at business@amaliaconsulting.com. We may need to verify your identity and request additional information to process your request.

You also have the right to lodge a complaint with your local data protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP).

13. Marketing Preferences

Where we send marketing communications, you can opt out at any time by using the unsubscribe link (if available) or contacting us at business@amaliaconsulting.com. Opting out of marketing does not affect service-related or transactional communications (e.g., replies to inquiries, contractual notices).

We may maintain a suppression list (minimal information) to ensure we respect your opt-out request, based on our legitimate interests and compliance obligations.

14. Children’s Privacy

The Site is not directed to children and we do not knowingly collect personal data from individuals under 18. If you believe a minor has provided personal data, contact us and we will take appropriate steps to delete it where required.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes become effective when posted on the Site with an updated “Last Updated” date. Your continued use of the Site after changes are posted constitutes acceptance of the updated Policy, to the extent permitted by law.

16. Contact Us

If you have questions, requests, or concerns regarding this Privacy Policy or our data practices, please contact: