pepcheck.ro // romanian law 129/2019 · reporting entities · official public sources a product of Systhema · AMLTracer™ · SMSI RO/EN
PepCheck due diligence · PEP
Sign in Free account

Your GDPR rights

General Data Protection Regulation (EU) 2016/679

This is an English translation provided for information. The Romanian version is the legally binding one and prevails in case of any difference.

1. What is the GDPR?

The General Data Protection Regulation (GDPR) is the European legislation that protects the personal data of EU citizens. It came into force on 25 May 2018 and gives individuals extensive rights over how organisations collect, store and use their personal data.

PepCheck complies with the GDPR. As a PEP and sanctions screening platform, we process personal data in accordance with AML/CFT legal obligations (Romanian Law 129/2019) and the GDPR, ensuring transparency and security.

2. Your rights under the GDPR

Under the GDPR, you have the following fundamental rights over your personal data:

  • Right of access (Art. 15) — you can ask whether your data are processed and obtain a copy of them.
  • Right to rectification (Art. 16) — you can ask for inaccurate personal data to be corrected or incomplete data to be completed.
  • Right to erasure (Art. 17) — “the right to be forgotten”: you can ask for your data to be deleted in certain circumstances.
  • Right to restriction (Art. 18) — you can ask for the processing of your data to be limited in certain situations.
  • Right to data portability (Art. 20) — you can receive your data in a structured format and transfer them to another controller.
  • Right to object (Art. 21) — you can object to processing for direct marketing or based on legitimate interests.

3. How PepCheck protects your data

Technical security measures

  • TLS/SSL encryption — all communications with the platform are encrypted in transit
  • Two-factor authentication — extra protection for your account
  • Servers in the EU — data are stored exclusively on servers in the European Union
  • Secure backup — encrypted daily backups
  • Audit logging — full monitoring of access to data

Organisational measures

  • Limited access — only authorised staff have access to data
  • GDPR training — continuous data protection training for the team
  • Internal policies — strict data handling procedures
  • Impact assessments — risk analysis for sensitive processing

Limited retention: we do not store PEP/sanctions search data for more than 90 days, in line with the GDPR principle of data minimisation.

4. What data we process

Account data

  • First name, last name, e-mail address
  • Your organisation and your role in it
  • Authentication data (password hashes, not passwords in clear text)

Usage data

  • History of the searches carried out (for the AML audit)
  • The reports generated
  • Access and activity logs

Technical data

  • IP address (for security)
  • Information about the device and browser
  • Cookies essential for operation

Legal basis: we process data on the basis of (1) the performance of the contract, (2) AML/CFT legal obligations, and (3) your consent where required.

5. Legal framework

PepCheck operates in accordance with:

  • GDPR — Regulation (EU) 2016/679
  • Romanian Law 190/2018 — measures implementing the GDPR in Romania
  • Romanian Law 129/2019 — preventing and combating money laundering (AML)
  • Directive (EU) 2015/849 — the Fourth AML Directive

Processing data for PEP and sanctions checks is necessary for our clients to meet their legal obligations under AML/CFT legislation.

6. How to exercise your rights

To exercise any of your GDPR rights:

  1. Registered users: open the “GDPR rights” section of your profile to export your data or delete your account
  2. By e-mail: send a request to hello@systhema.ro
  3. In writing: send a request to the controller’s address

Response time: we will reply to your request within 30 days at most from receipt, as the GDPR requires. In complex cases the period may be extended by a further 60 days, with prior notice.

Data protection contact

  • Controller: Systhema Analytics SRL
  • Tax ID (CUI): 45945560
  • E-mail: hello@systhema.ro
  • Address: Str. Dragoș Vodă nr. 2, bl. D5, ap. 3, Deva, Hunedoara County, postcode 330033, Romania

7. The right to complain

If you believe your GDPR rights have not been respected, you have the right to lodge a complaint with:

  • The National Supervisory Authority for Personal Data Processing (ANSPDCP), Romania
  • Website: www.dataprotection.ro
  • E-mail: anspdcp@dataprotection.ro
  • Phone: +40 318 059 211

Before lodging a complaint, we encourage you to contact us so we can resolve the issue directly.

Questions about your data?

Write to us at hello@systhema.ro or sign in to use the GDPR options.

Useful links