Privacy policy

This policy explains what personal data FORCE GRUP SECURITY SRL processes, for what purposes, on what legal basis, how long we keep it, who we may share it with and what rights you have. It applies to visitors to this website, people who contact us, clients and prospective clients, and people whose data reaches us in the course of our security and guarding services.

This is an English translation provided for convenience. In the event of any discrepancy, the Romanian version prevails.

1. Who the data controller is

The controller of your personal data is FORCE GRUP SECURITY SRL, a Romanian legal entity with its registered office at Str. Litoralului nr. 86, Sector 2, Bucharest, postal code 022536, Romania, registered with the Trade Register under no. J2026002212001, EUID ROONRC.J2026002212001, tax identification number (CUI) 53273176 (“Force Grup Security”, “we” or “the company”).

For any question or request about your personal data, you can contact us:

• by email at office@forcegrupsecurity.ro, with the subject “Data protection”;
• by post or courier at the registered office address above;
• by phone on +40 720 559 065, Monday to Friday, 9:00 to 18:00 (Romanian time).

2. Legal framework

We process personal data in compliance with the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, “GDPR”);
• Romanian Law no. 190/2018 on measures implementing the GDPR;
• Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, which transposes Directive 2002/58/EC (the ePrivacy Directive);
• Romanian Law no. 333/2003 on the guarding of premises, goods and valuables and the protection of persons, and its Implementing Rules approved by Government Decision no. 301/2012, for data processed in the course of guarding;
• Romanian Law no. 365/2002 on electronic commerce;
• tax and accounting legislation, including Accounting Law no. 82/1991 and the Romanian Tax Code, for financial documents;
• Council of Europe Convention no. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, ratified by Romania.

The protection offered by this policy applies to everyone whose data we process, whatever their nationality or country of residence.

3. Terms used

• Personal data: any information relating to an identified or identifiable natural person, such as a name, an email address, a phone number or an image.
• Processing: any operation performed on data, such as collection, recording, storage, consultation, disclosure or erasure.
• Controller: the person who determines the purposes and means of the processing.
• Processor: the person who processes data on behalf of, and on the instructions of, a controller.
• Data subject: the natural person whose data is processed.

4. Data processed through the website

4.1. Quote request forms

When you fill in one of the forms on the website (the Contact, Services or Events page), we process the data you send us: first and last name, email address, phone number, company or organiser name, county, type of service requested and your message, which may include details about the event or site (date, venue, expected attendance).

• Purpose: to respond to your request, assess your security needs, arrange a site visit and send you a quote.
• Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). When you act on behalf of a company, the legal basis is our legitimate interest in communicating with the representatives of clients and prospective clients (Article 6(1)(f) GDPR). The consent tick box in the form confirms that you have read this policy.
• Whether providing data is mandatory: fields marked as required are needed for us to reply. Without them we cannot handle your request.

Please do not send us sensitive data through the form (for example health data, political opinions or data about criminal convictions), as it is not needed for a quote request.

4.2. Technical data when you visit the website

When you access the website, our hosting provider's servers automatically record the technical data needed to deliver the pages and keep them secure: IP address, date and time of access, page requested, browser and device type, referring page and the server response code.

• Purpose: displaying the website correctly, preventing cyberattacks and abuse, and diagnosing errors.
• Legal basis: our legitimate interest in ensuring the operation and security of the website (Article 6(1)(f) GDPR).

We do not use this data to identify you and we do not combine it with other sources.

4.3. Cookies and local storage

The website stores in your browser the choice you make in the cookie banner. We do not currently use analytics, advertising or social media cookies. Details are in the Cookie policy.

4.4. Links to other websites

The website contains links to social networks and to the websites of public institutions. These are simple links: we do not load content from these third parties and we do not pass them any data about you. When you visit such a website, the privacy policy of its operator applies.

5. Data received by email and phone

When you write to us or call us directly, we process your name, contact details and the content of the communication in order to reply and keep a record of requests. The legal basis is, as applicable, taking steps before entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in replying to correspondence (Article 6(1)(f) GDPR). We do not record phone calls.

6. Clients and the contractual relationship

To conclude and perform service contracts, we process the data of the legal representatives and contact persons designated by clients: name, job title, phone, email and signature, as well as the data that appears in contractual, invoicing and payment documents.

• Performance of the contract (Article 6(1)(b) GDPR) when the client is a natural person, or our legitimate interest in communicating with the client's representatives (Article 6(1)(f) GDPR) when the client is a legal entity;
• Compliance with legal obligations (Article 6(1)(c) GDPR), for accounting and tax records and for the register of guarding service contracts required by Law no. 333/2003 and its implementing rules;
• Legitimate interest in establishing, exercising or defending our legal claims (Article 6(1)(f) GDPR).

7. Data processed during security and guarding services

In providing event security and manned guarding, we may come into contact with the data of people who are not our clients: spectators, guests, artists, exhibitors, suppliers, our clients' employees and visitors to the sites we guard.

7.1. Our role

In most cases, the controller of this data is the event organiser or the owner of the guarded site, who sets the access rules and the purposes of the processing. We act as a processor, on the basis of the contract and the client's instructions, in accordance with Article 28 GDPR. For full information about these processing operations, please also read the privacy policy of the organiser or site owner.

We are the controller for the data the law requires us to keep in our own name as a specialised security company, and for the data needed to defend our legal claims.

7.2. What data may be processed

• Access control: names on lists and accreditations, the type of access, ticket or badge checks and, at guarded sites, the data in the register of personnel access and, where applicable, vehicle access required by the implementing rules of Law no. 333/2003;
• Video surveillance: images captured by the client's CCTV systems, monitored by our officers where the contract provides for this;
• Incidents: identification data and a description of the facts recorded in the incident register and in incident reports, including the data of the people involved and of witnesses;
• Identity checks: the identification data of people stopped and identified under Article 46 of Law no. 333/2003, and the data passed on to the police.

7.3. Legal bases

• compliance with the legal obligations of security staff and of the security company under Law no. 333/2003 and Government Decision no. 301/2012 (Article 6(1)(c) GDPR);
• the legitimate interest of the client and of our company in protecting people, goods and valuables and in preventing crime (Article 6(1)(f) GDPR);
• protecting the vital interests of a person, for example in a medical emergency (Article 6(1)(d) GDPR);
• data relating to criminal offences is processed only under Article 10 GDPR, within the limits of the law, by recording the facts and handing persons and goods over to the police.

7.4. Informing the people concerned

Areas under video surveillance must be marked by the system operator with visible warning signs. At events, the access rules and conditions for entry checks are communicated by the organiser, usually through the ticket terms and at the venue entrance.

8. Children's data

Our website and services are aimed at companies, event organisers and adults. We do not knowingly collect data from people under 16 through the website. If you become aware that a child has sent us data, write to us and we will delete it. At events, children's data may only be processed in the situations described in section 7, for example in the case of a lost child or an incident.

9. Who we share data with

We do not sell or rent personal data. We may only share it with the following recipients, strictly to the extent necessary:

• service providers acting as processors, under contracts that comply with Article 28 GDPR: website hosting, email and form delivery services, IT services, accounting and archiving;
• our clients, meaning organisers and site owners, for the data processed on their behalf at events and sites, including service and incident reports;
• public authorities, when required by law or at their lawful request: the Police, the Gendarmerie, the Emergency Situations Inspectorate, prosecutors' offices, courts, the National Agency for Fiscal Administration (ANAF), the Labour Inspectorate and the National Supervisory Authority for Personal Data Processing (ANSPDCP);
• emergency services (ambulance, SMURD), when necessary to protect a person's life or health;
• professional advisers bound by confidentiality: lawyers, auditors, physical security risk assessors and certification bodies;
• insurers, in the case of insured events;
• a possible successor, in the case of a reorganisation, merger or sale of the business, in compliance with this policy.

10. Transfers outside the European Economic Area

As a rule, data is processed in the European Union and the European Economic Area. The website is hosted by Vercel Inc., based in the United States, through its globally distributed network of servers, so the technical access data (section 4.2) may also be processed outside the EEA. Any such transfer takes place only with the safeguards provided by Chapter V of the GDPR: an adequacy decision of the European Commission, such as the decision of 10 July 2023 on the EU-U.S. Data Privacy Framework for certified companies, or the standard contractual clauses adopted by the European Commission (Article 46 GDPR). On request, we can give you information about the safeguards applied.

11. How long we keep data

We keep data only for as long as necessary for the purpose for which it was collected and to comply with our legal obligations:

• quote requests and correspondence that do not lead to a contract: no more than 2 years from the last communication;
• contract data: for the duration of the contract and afterwards for the general limitation period of 3 years under the Romanian Civil Code;
• accounting and tax documents: for the period required by Accounting Law no. 82/1991 and tax legislation;
• guarding service registers (the access register, the incident register, the inspection register and the other documents listed in Annex 2 to the implementing rules): at least 2 years, under Government Decision no. 301/2012;
• video recordings managed on behalf of clients: for the period set by the client, in line with the minimum period required by the implementing rules of Law no. 333/2003 and with the storage limitation principle, except for footage needed in an investigation or legal proceedings;
• incident reports: for as long as necessary to resolve the incident and to defend legal claims in any proceedings, within the applicable limitation periods;
• technical website access data: for the period set by the hosting provider for security logs, usually a few days or weeks;
• your cookie choice: until you change it or clear your browser data.

When these periods expire, the data is erased or irreversibly anonymised.

12. How we protect data

We apply technical and organisational measures appropriate to the risk, in accordance with Article 32 GDPR. Our information security management system is certified to ISO/IEC 27001:2022. The measures we apply include:

• access to data only for staff who need it for their work, on a need-to-know basis;
• written confidentiality obligations for employees and contractors, including the professional secrecy obligation under Article 46 of Law no. 333/2003;
• an encrypted connection (HTTPS) for the whole website and for form submissions;
• keeping the paper registers of the guarding service in conditions that prevent unauthorised access;
• regular data protection training for staff;
• data processing agreements with all providers acting as processors.

In the event of a personal data breach, we notify the ANSPDCP within 72 hours of becoming aware of it, in accordance with Article 33 GDPR, and we inform the people concerned when the breach is likely to result in a high risk to their rights, in accordance with Article 34 GDPR.

13. Your rights

Under the conditions set out in the GDPR, you have the following rights:

• the right of access (Article 15): to find out whether we process data about you and to receive a copy of it;
• the right to rectification (Article 16): to have inaccurate data corrected or incomplete data completed;
• the right to erasure (Article 17): to have data erased when it is no longer needed, when you withdraw your consent or object to the processing and there is no other legal basis;
• the right to restriction of processing (Article 18): to have processing limited, for example while the accuracy of the data is being checked;
• the right to data portability (Article 20): to receive the data you provided in a structured, commonly used and machine-readable format, or to have it transmitted to another controller, where the processing is based on consent or a contract and carried out by automated means;
• the right to object (Article 21): to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. You may object at any time, without giving reasons, to processing for direct marketing;
• the right to withdraw consent (Article 7(3)) at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• the right not to be subject to a decision based solely on automated processing (Article 22);
• the right to lodge a complaint with the supervisory authority and to go to court (Articles 77 to 79).

14. How to exercise your rights

Send us a request at office@forcegrupsecurity.ro or by post to our registered office. To protect your data, we may ask for additional information to confirm your identity, without asking for more data than necessary.

We reply without undue delay and within one month of receiving the request at the latest. This period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and the reasons within the first month (Article 12(3) GDPR). Exercising your rights is free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act on the request, with reasons (Article 12(5) GDPR).

For data we process as a processor on behalf of organisers and site owners (section 7), requests should be addressed to them first. If you send us such a request, we will forward it to the controller and help them reply to you.

15. The right to lodge a complaint

If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the supervisory authority:

National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, postal code 010336, Romania
Email: anspdcp@dataprotection.ro · Website: www.dataprotection.ro

If you live or work in another Member State of the European Union, you may also lodge your complaint with the data protection authority of that State. You also have the right to go to the competent court. We encourage you to contact us first, so we can try to resolve any concern together.

16. Automated decisions and profiling

We do not take decisions based solely on automated processing of data and we do not carry out profiling that produces legal effects concerning you or similarly significantly affects you.

17. Changes to this policy

We may update this policy when the law, our services or the way we process data change. The version in force is always the one published on this page, with the date of the last update shown at the top. When changes are significant, we will flag them clearly on the website.