Digital & legal compliance.

For organisations processing personal data about customers, employees, patients or other individuals.

We review how data moves through your business and organise documentation, responsibilities and safeguards around actual operations. We connect privacy requirements with your website, CRM, forms and the applications your team uses.

• An inventory of processing, purposes, legal bases and retention periods.
• Privacy notices, applicable records and arrangements with data-processing suppliers.
• Procedures for access, rectification, erasure and other applicable rights.

For mandatory appointments under GDPR Article 37 and organisations choosing to appoint a DPO voluntarily.

We organise the data protection officer function: advice, compliance monitoring and a contact point for individuals and the supervisory authority. The appointment defines expertise, autonomy and the management of conflicts of interest with other roles.

• Assessment of the need for appointment and definition of the DPO mandate.
• A monitoring plan, recommendations and reporting to management.
• Support for requests, incidents and communication with the competent authority.

For processing likely to create high risks and for personal data transfers to third countries.

We assess the impact on individuals before introducing high-risk processing. We separately examine data destinations, supplier roles and the mechanism applicable to international transfers, including cloud, application and AI projects.

• Description of processing, necessity, proportionality and risks.
• A safeguards plan, responsibilities and residual risk assessment.
• Documentation of transfer mechanisms and supplier assessments.

For websites and applications storing or accessing information on a user’s device, taking account of the exceptions for strictly necessary operations.

We inventory cookies, pixels and scripts, then configure their behaviour according to user choices. We test acceptance, rejection and withdrawal in the browser, including analytics, advertising and embedded content.

• Technology classification and information reflecting actual purposes.
• Configuration of the consent platform, tags and withdrawal controls.
• Tests before and after a choice, records and checks after changes.

For electronic commercial communications, with prior consent or under the statutory exception for existing customers and similar products or services.

We organise preference collection, segmentation and communication automation. We track contact sources and unsubscribe behaviour across the website, CRM and email marketing platform so individual choices are respected throughout the workflow.

• Forms, information texts and records of communication choices.
• Unsubscribe controls and synchronised suppression lists across applications.
• Review of campaigns, imports and active automations.

For protecting data and systems, with safeguards selected according to risk, operations and sector requirements.

We assess access points, updates, backups and recovery capability. We implement controls for the website, hosting and applications within scope, with responsibilities and periodic checks defined in the contract.

• Multifactor authentication, role-based access, updates and security configuration.
• Backups, tested restores and documented business continuity steps.
• Logging, vulnerability reviews and tracking of agreed remediation.

For technical incidents, personal data breaches and incidents reportable under the organisation’s applicable regime.

We define escalation and response, evidence preservation and service recovery. We assess impact to identify applicable notifications and prepare the information required by management and the specialists handling reporting.

• A response plan, contacts, responsibilities and working scenarios.
• Impact containment, recovery and a documented timeline.
• Notification assessment and a post-incident remediation plan.

For essential and important entities identified by sector, size and the specific statutory criteria.

We start with the organisation’s scope assessment and risk level. We build the implementation programme, prepare the maturity self-assessment and document controls, suppliers and continuity measures, with management approvals and responsibilities.

• Scope assessment, asset inventory and support for notification documentation.
• Risk assessment, gap analysis and a prioritised implementation plan.
• Self-assessment, implementation evidence and control checks with your team.

For regulated periodic or ad hoc audits of essential and important entities under the applicable conditions.

We organise the audit with an auditor holding a valid DNSC attestation and meeting independence requirements. Audit scope, systems, access and evidence are agreed before the assessment; the responsible professional and deliverables are identified in the project.

• An audit plan and verification of the auditor’s professional requirements.
• Assessment of documentation and controls within the agreed scope.
• An auditor-issued report and tracking of the remediation plan.

For online stores and consumer distance contracts falling within the applicable legislation.

We align commercial information and checkout with the rules applicable to the products and services sold. We connect legally reviewed documentation with price presentation, confirmations, delivery and the exercise of consumer rights.

• Trader identification, pre-contract information and clearly presented costs.
• Review of checkout steps, agreements and durable-medium confirmation.
• Processes for withdrawal, returns, complaints and applicable exceptions.

For contractual relationships and terms governing websites, applications and digital services.

We include the legal work required by the project, provided by a lawyer through the professional practice required by law. Documents describe the actual service, roles and agreed workflows, while technical implementation reflects the reviewed rules.

• Terms and conditions, acceptable-use rules and customer relationship documents.
• Clauses covering confidentiality, data processing and supplier responsibilities.
• Alignment of documentation with forms, contracting and platform operations.

For services covered by Romanian Law 232/2022, including e-commerce, with the statutory exemption for microenterprises providing services.

We assess accessibility across important user journeys and fix the interface at source. We check content, forms and controls through automated and manual testing, including keyboard navigation and assistive technology use.

• Applicability assessment, issue inventory and remediation priorities.
• Fixes for structure, contrast, focus, labels and error messages.
• Re-testing of journeys and accessibility information required by the applicable regime.

For private companies with at least 50 employees and other entities or specific cases covered by the law.

We implement the reporting channel and tools for the person appointed to handle reports. We organise confidentiality, access, electronic records and deadline tracking according to the organisation’s internal procedure.

• An intake channel, information and procedure for internal reports.
• Electronic records, restricted access and data retention rules.
• Acknowledgements, communication and deadlines for responsible staff.

For teams working with data and IT systems and roles with training requirements under NIS2 legislation.

We build training around team activities: account access, documents, phishing, incidents and confidentiality. For programmes requiring accreditation, the provider, recognition and completion documents are specified before enrolment.

• Content tailored to organisational roles, applications and risks.
• Workshops, exercises and materials for applying rules in daily work.
• Attendance records, assessment and recommendations for further training.

For AI system providers and professional deployers, with requirements determined by role, use and system category.

We inventory AI tools and define which data may be entered, who reviews outputs and how access and suppliers are managed. We prepare AI literacy measures and information requirements applicable to AI interactions.

• An AI inventory, roles and rules for personal or confidential information.
• Contextual training, human review and records of adopted measures.
• Configuration of access, notices and approved usage workflows.