Privacy Policy

CIGA Energy Advisory (CEA) respects your privacy and is committed to protecting your personal data. This policy explains what data we collect through this website, why we collect it, how we use it, and the rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), Romanian Law no. 190/2018, and other applicable law.

Who we are

CIGA Energy Advisory SRL is the operator (controller) of the personal data processed through this website. Our office is at 20 Dacia Boulevard, 3rd Floor, District 1, 010403 Bucharest, Romania. For any question about this policy or your data, write to advisory@cigaenergy.ro.

[To be confirmed by CEA legal counsel: registered legal entity name, trade register number, and VAT identification number.]

How we handle your data

We process your personal data lawfully, fairly, and transparently, and we follow the data protection principles set out in the GDPR:

• Lawfulness, fairness and transparency: we process data only on a valid legal basis and in a way you can understand.
• Purpose limitation: we collect data for specified, explicit, and legitimate purposes and do not process it further in a way incompatible with those purposes.
• Data minimisation: we keep the data adequate, relevant, and limited to what is necessary.
• Accuracy: we keep data accurate and, where needed, up to date.
• Storage limitation: we keep data no longer than is necessary for the purposes for which it was collected.
• Integrity and confidentiality: we process data with appropriate security, including protection against unauthorized access and accidental loss.
• Accountability: we are responsible for, and can demonstrate, our compliance with these principles.

Data protection contact

For any question about how we handle your personal data, or to exercise your rights, you can reach our data protection contact at advisory@cigaenergy.ro or by post at the address above.

What data we collect

This is a presentation website. We do not operate user accounts, online payments, or a newsletter. We process only two limited categories of data:

• Contact data you send us. If you contact us by email or phone, we process the details you choose to share, such as your name, company, email address, phone number, and the content of your message.
• Technical and usage data. With your consent, our analytics tool records anonymized information such as your approximate location, device and browser type, pages viewed, and time on site.

Why we process your data and the legal basis

1. To respond to your inquiries and to take steps at your request before any engagement. Legal basis: our legitimate interest in answering business inquiries and, where relevant, steps prior to entering a contract (Article 6(1)(f) and 6(1)(b) GDPR).
2. To understand and improve how the website is used, through analytics. Legal basis: your consent, which you give through the cookie banner and can withdraw at any time (Article 6(1)(a) GDPR).
3. To comply with our legal obligations, such as responding to lawful requests from public authorities. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

Cookies and analytics

We use a small number of cookies. Essential cookies are required for the site to work. Analytics cookies (Google Analytics 4) are loaded only after you accept them. Full details and the way to manage your choices are in our Cookie Policy.

Who we share data with

We do not sell your personal data. We share it only with service providers that help us run the website, such as our hosting provider and our analytics provider (Google). These providers act on our instructions and under contractual data-protection safeguards. We may also disclose data to public authorities where we are required to do so by law.

International data transfers

Some providers may process data outside the European Economic Area. Where this happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses or a transfer to a country recognized by the European Commission as offering an adequate level of protection.

How long we keep your data

We keep inquiry correspondence only for as long as needed to handle your request and our legitimate business relationship, after which it is deleted or anonymized. Analytics data is retained for a limited period in line with our analytics provider's settings.

Your rights

Under the GDPR you have the following rights regarding your personal data:

• Information: receive clear information about how we process your data (Articles 13 and 14).
• Access: obtain confirmation of whether we process your data and a copy of it (Article 15).
• Rectification: correct inaccurate or incomplete data (Article 16).
• Erasure: ask us to delete your data in the cases provided by law (Article 17).
• Restriction: ask us to limit processing in certain circumstances (Article 18).
• Portability: receive your data in a structured, machine-readable format (Article 20).
• Objection: object to processing based on our legitimate interests (Article 21).
• Withdraw consent: withdraw consent at any time, without affecting processing already carried out (Article 7).
• No automated decision-making: not be subject to a decision based solely on automated processing, including profiling (Article 22).
• Breach notification: be informed of a personal data breach that is likely to result in a high risk to your rights (Article 34).
• Complaint: lodge a complaint with a supervisory authority (Article 77).
• Judicial remedy: seek an effective judicial remedy against a controller or processor (Article 79).

To exercise any of these rights, write to advisory@cigaenergy.ro. You also have the right to complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Address: 28-30 G-ral Gheorghe Magheru Blvd, District 1, 010336 Bucharest
• Email: anspdcp@dataprotection.ro
• Phone: +40 318 059 211
• Web: www.dataprotection.ro

Automated decision-making and profiling

We do not use your personal data for automated decision-making or to build profiles about you.

How we protect your data

We apply technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or accidental loss. Anyone who processes data on our behalf is bound by confidentiality and security obligations.

Links to other websites

Our website may link to external sites that we do not control. We are not responsible for the content or privacy practices of those sites, and we encourage you to read their policies.

Definitions

In line with the GDPR, the terms below have the following meanings:

• Personal data: any information relating to an identified or identifiable natural person (the data subject).
• Processing: any operation performed on personal data, such as collection, storage, use, disclosure, or erasure.
• Controller: the person or body that determines the purposes and means of processing personal data.
• Processor: the person or body that processes personal data on behalf of the controller.

Changes to this policy

This policy is informative and does not affect the rights granted to you by law. We may update it to reflect changes in the law or in how we operate. The effective date at the top of the page shows when it was last revised, and we encourage you to check this page periodically.

Contact

For any question about this policy or your personal data, contact us at advisory@cigaenergy.ro or by post at 20 Dacia Boulevard, 3rd Floor, District 1, 010403 Bucharest, Romania.