Privacy policy

Legal document · Privacy

Last updated: 2 September 2026

NORMIQ is a platform through which OSH (occupational safety and health) specialists and the companies they serve organise employee training, testing, electronic signing of training records and the archiving of those records. To do that, we process personal data — yours or that of your company's employees.

This document sets out, briefly and without needless jargon, what we do with that data and what rights you have.

Who we are

The NORMIQ platform and the normiq.ro website are operated by [Denumirea societății] S.R.L., with its registered office at [Registered office], Bucharest, Romania, registered with the Trade Register under no. [J__/____/____], CUI [CUI] (“NORMIQ”, “we”). You can reach us on any data protection matter at hello@normiq.ro.

This policy explains what personal data we process, in which capacity, for which purposes and on which legal bases, how long we keep it, who we share it with and what rights you have, in line with Regulation (EU) 2016/679 (GDPR) and Legea nr. 190/2018.

Controller or processor — the two roles of NORMIQ

NORMIQ processes data in two distinct capacities, and the applicable rules differ for each:

As a data controller — for the data of website visitors, of people who contact us or request a demo, and of users who create and manage an account (OSH specialists, administrators of client companies). For this processing NORMIQ decides the purposes and the means.
As a processor — for employee data uploaded to the platform by the employing company or by the OSH specialist serving it (identification data, training records, test results, electronic signatures). For this data the controller is the employer, who processes it to meet its own legal obligations on occupational safety and health. NORMIQ acts solely on the employer's documented instructions, under art. 28 GDPR, and enters into a data processing agreement (DPA) with every client.

If you are an employee of a company that uses NORMIQ and you have questions about your data, you can write to us, but requests concerning your rights are handled together with your employer, as the controller.

What data we process

On the website (as a controller):

Contact details submitted through the form: name, email address, company, message and the consent given.
Technical data: IP address, browser and device type, pages visited, log data and cookies, as described in the dedicated section.

In the platform, for user accounts (as a controller):

Identification and contact details: name, email, phone number, job title, company and role in the platform.
Authentication and security data: password (stored only in encrypted form), authentication factors, sessions, IP addresses and access logs.

In the platform, for the employees being trained (as a processor, on behalf of the employer):

Identification data required by the OSH documents: name, job title, workplace, hiring date and, only where the statutory forms require it, the CNP (personal numeric code), the series and number of the identity document, date of birth and home address. These fields are encrypted at field level and accessible only to authorised roles.
Training data: the materials covered, their version, the time spent, the test questions and answers, the result and the date.
Electronic signature data: the identity of the signatory, the moment of signing (timestamp), the IP address, the device and the cryptographic fingerprint of the signed document.
The audit log: every relevant action (who, what, when), kept in a register that cannot be altered, so that compliance can be evidenced during an inspection.

We do not process special categories of data (for example health data) unless the employer uploads such data to the platform on the basis of its own legal obligation, in which case it remains under the employer's control.

Purposes and legal bases

Providing the platform and performing the contract with the client (account creation, training, testing, signing, archive, notifications, support) — art. 6(1)(b) GDPR.
Meeting the employer's legal obligations on occupational safety and health training — Legea nr. 319/2006 (the Romanian occupational safety and health act), HG nr. 1425/2006 (the government decision with the implementing norms for that act), Legea nr. 208/2021 (the Romanian act allowing safety training in electronic form) and HG nr. 259/2022 (the government decision on OSH training documents kept in electronic form) — art. 6(1)(c) GDPR, for the data processed on behalf of the employer.
Meeting our own legal obligations (accounting, tax, responding to requests from the authorities) — art. 6(1)(c) GDPR.
Our legitimate interest in keeping the platform secure, preventing abuse and fraud, maintaining audit logs and improving the service — art. 6(1)(f) GDPR.
Our legitimate interest in producing aggregated and anonymised statistics about the use of the platform (for example compliance rates by sector), used for benchmarking, product improvement and marketing — art. 6(1)(f) GDPR. Anonymisation is the last operation carried out on the personal data; the result is no longer personal data. Details in the “Anonymised data and case studies” section.
Your consent — for marketing communications and for non-essential cookies; you can withdraw it at any time, without affecting processing carried out beforehand — art. 6(1)(a) GDPR.

Electronic signature

Training records are signed in the platform with an electronic signature, within the meaning of Regulation (EU) No 910/2014 (eIDAS, the EU regulation on electronic identification and trust services) and of Legea nr. 214/2024 (the Romanian act on electronic identification and trust services), a form accepted for OSH training documents under HG nr. 259/2022. The data needed to identify the signatory, the moment of signing and the integrity of the document is embedded in the signed record and in the audit log.

At the moment of signing, the signatory is shown a privacy notice about the processing of their data, given on behalf of the employer.

How long we keep the data

Signed training records and the related audit log: for the duration of the employee's employment relationship and, afterwards, for the archiving period required by the legislation applicable to employment and OSH documents. The employer may configure a longer retention period, but cannot ask for deletion before the legal obligation has expired.
User account data: for the duration of the contract with the client and 30 days after it ends, during which the client can export its data; afterwards the data is deleted, except where the law requires us to keep it.
Messages sent through the contact form: at most 12 months from the last interaction, if no contract is concluded.
Technical security logs: at most 12 months.
Accounting and tax data: for the period set by financial and accounting legislation.

Who we share the data with

We do not sell personal data. We share it only with the following categories of recipients, and only as far as necessary:

The employer and the OSH specialist serving it — as controller, for the data of the employees being trained.
Sub-processors that provide our infrastructure: application hosting and delivery, database, file storage, background job processing, email sending, error monitoring and the electronic signature service provider. An up-to-date list of sub-processors is available on request and is communicated to clients under the data processing agreement.
Public authorities (for example Inspecția Muncii, the Romanian labour inspectorate), where the law requires it or at the employer's request during an inspection.
Professional advisers (legal, accounting) bound by confidentiality obligations.

Some providers may process data outside the European Economic Area. In those cases we make sure the transfer relies on an adequacy decision or on the standard contractual clauses adopted by the European Commission, with additional measures where necessary.

How we protect the data

Encryption in transit (TLS) and at rest, with additional field-level encryption for sensitive identification data.
Each client's data is isolated at database level, access is controlled by role, and users authenticate with an additional factor.
An immutable, timestamped audit log for all relevant actions.
Download links with limited validity and no personal data in the names of stored files.
The support team accesses a client's data only at that client's request, and every such access is fully recorded in the audit log.
Incident response procedures; in the event of a security breach we notify the supervisory authority and, where applicable, the people affected, within the deadlines set by art. 33–34 GDPR.

Anonymised data and case studies

Outside of providing the service, NORMIQ uses platform data in one form only: non-nominal and aggregated. We draw a clear distinction between three situations, because the rules differ:

Anonymised statistics. We calculate aggregated indicators (for example the share of training sessions completed within the legal deadline, or the average time until a record is signed), by sector of activity or by company size band, only for groups large enough that no individual and no company can be identified, either directly or by combining the data with other information. We keep no key linking the statistics back to the source data; the anonymisation is irreversible. These statistics are no longer personal data and may be used for benchmarking, product improvement and marketing.
Case studies. An account of a client company's experience, even under a substitute name, is published only with that company's written agreement and contains no employee-level data.
Pseudonymised data. Replacing the name of a company or of an employee with a pseudonym does not make the data anonymous: as long as an individual record can be linked back to a person, it remains personal data. NORMIQ never uses employee-level records, not even pseudonymised ones, for any purpose other than the service provided to the employer.

Your rights

Under art. 15–22 GDPR, you have the right:

of access to your data and to information about the processing;
to have inaccurate or incomplete data corrected;
to erasure (the “right to be forgotten”), within the limits of legal retention obligations — training records cannot be deleted before the statutory archiving period has expired;
to restriction of processing;
to data portability, in a structured, commonly used format;
to object to processing based on legitimate interest, including direct marketing;
to withdraw your consent at any time, for processing that relies on it;
not to be subject to a decision based solely on automated processing that produces legal effects — NORMIQ does not take such decisions; test results are determined according to the rules set by the employer.

To exercise your rights, write to us at hello@normiq.ro. We reply within one month at the latest, a deadline that may be extended by two months in complex cases. If the data is processed on behalf of your employer, we will forward your request to them and support them in handling it.

You also have the right to lodge a complaint with the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, the Romanian data protection supervisory authority), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro, or to bring the matter before the competent courts.

Cookies and similar technologies

The website uses cookies and similar technologies. On your first visit we ask for your consent for the non-essential categories, and your preferences can be changed at any time from the cookie settings.

Essential — needed for the website and the platform to work (authentication, security, navigation). They cannot be switched off.
Analytics — anonymised usage statistics, used to understand how the pages are used. No personal profile is built.
Marketing — measuring campaign performance and showing relevant messages. You can opt out at any time.

Minors

The website and the platform are aimed at professionals and at people in an employment relationship. We do not knowingly collect data from people under 16 outside the context of a lawful employment relationship.

Changes to this policy

We may update this policy to reflect changes in the law or in the service. The current version and the date of the last update are published on this page; significant changes are communicated to users with an account by email or in the platform. This English text is a translation provided for convenience: in case of any conflict between the language versions, the Romanian version prevails.