1. Introduction
Ana HR SRL (“Ana HR”, “we”, “us”, “the company”) respects the right to privacy of data subjects and complies with Regulation (EU) 2016/679 on data protection (GDPR) and Law no. 190/2018 implementing the GDPR in Romania. This policy explains in detail how we collect, use, store and protect your personal data.
2. Definitions

• Personal data: any information relating to an identified or identifiable person.

• Processing: any operation on personal data (collection, storage, consultation, use, etc.).

• Operator: Ana HR SRL, responsible for decisions regarding data processing.

• Target audience: candidates, clients, partners and website visitors.

3. Data collected

1. Identification data: name, surname, CNP (if necessary in the context of recruitment), e-mail address, telephone number;

2. Professional data: CV, studies, experience, skills, certifications;

3. Contact details: physical address, alternative addresses (if requested);

4. Browsing data: IP, browser type, pages visited, session duration, cookies, analytics data;

5. Sensitive data (optional, with explicit consent): health data, union membership, disabilities;

6. Other data: messages and responses you voluntarily provide to us via forms, email or chat.

4. Purposes and legal bases
Purpose of processingLegal basis
Processing of applications (CV screening, interviews, selection) Execution of a contract/pre-contract and legitimate interest (art. 6(1)(b) and (f) GDPR)
Communications regarding service offers and newslettersExpress consent (art. 6(1)(a) GDPR)
Customer relationship management and invoicing Contract execution (art. 6(1)(b) GDPR)
Traffic analysis and website improvement Legitimate interest (art. 6(1)(f) GDPR) after performing a balancing test (LIA)
Legal and fiscal obligationsLegal requirements (art. 6(1)(c) GDPR) and Accounting Law no. 82/1991, Fiscal Code
Fraud prevention and investigationLegitimate interest and legal obligations (art. 6(1)(c), (f) GDPR)
Exercise of the rights of data subjects Fulfillment of the requirements for responding to the data subject's requests (art. 12-23 GDPR)

Note: You can withdraw your consent for newsletter or direct marketing at any time by sending an email to contact@anahr.ro or using the unsubscribe link in the newsletter.
5. Storage duration
Data typeRetention period
Recruitment data (CV, interviews) Up to 3 years from your last action.
Accounting and tax dataAccording to tax legislation (5–10 years)
Browsing data and cookiesEssential cookies: session; performance: max.2 years
Data obtained with consent (marketing)Until withdrawal of consent
Sensitive data (with DPO and explicit consent) Until the completion of the recruitment process or with deletion upon request
6. Data transfers and third party recipients
The data can be communicated to:

• IT service providers (hosting, cloud, CRM, recruitment platforms): all with processing agreement and EU standard contractual clauses;

• Recruitment and training partners: in compliance with GDPR;

• State authorities and institutions: ANAF, ANSPDCP, courts, only if required by law;

• Affiliated companies and subcontractors: only for strictly contract-related purposes.

International transfers
We do not transfer data outside the EEA. If we do so in the future, we will ensure appropriate safeguards (EU standard contractual clauses, adequacy decisions, etc.).