Personal data processing policy

INSTANT FACTORING IFN S.A., with its registered office in Bucharest, Sector 2, 2 Gara Herăstrău Street, 2nd floor, office 212, Romania, registered with the Romanian Trade Register under no. J2018003635406, C.U.I. RO39029401, EUID ROONRC. J2018003635406, entered in the General Register of the National Bank of Romania under no. RG-PJR-41-110338/07.09.2018 and in the Special Register under no. RS-PJR-41-110156/14.06.2023 (“Instant Factoring”), owner of the domain name www.instantfactoring.com, through which it carries out factoring activities, as a personal data controller, hereby informs you, pursuant to the General Data Protection Regulation No. 679/2016 (“GDPR”), that we process the personal data of data subjects connected to the companies that use our services, their affiliated companies, as well as debtors whose receivables are assigned as part of factoring operations, in accordance with this policy.

This notice is provided in accordance with Article 14 of the GDPR and solely for the purpose of enabling Instant Factoring to comply with its information obligations in its capacity as a personal data controller.

This notice does not constitute and may not be interpreted as an agreement or approval by INSTANT FACTORING regarding any financing request or assignment of a receivable, nor does it constitute notice to the assigned debtor regarding an assignment of a receivable.

1. Definitions

For the purposes of this Policy, the terms below have the following meanings, unless the context indicates otherwise:

1.1. Customer: A legal entity that has entered into a Contract with Instant Factoring;

1.2. Contract: A factoring contract entered into between Instant Factoring and the Customer;

1.3. Applicant: a legal entity that has initiated the process of accessing the products and services offered by Instant Factoring and which, after its application is approved by Instant Factoring, becomes a Customer of our company;

1.4. Relevant Persons: the legal representatives, associates or shareholders, beneficial owners, and contact persons of the Applicant and affiliated companies, as well as persons connected to companies that are debtors of the Applicant;

1.5. User: a natural person who visits the website www.instantfactoring.com (“Site”) and creates an account on behalf of a Customer;

1.6. GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1.7. Data: personal data relating to an identified or identifiable natural person, either directly (such as by name) or indirectly (through other data).

1.8. Processing: means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2. Data controller

2.1. Instant Factoring is responsible for processing your personal data and, as a result, is considered a data controller under the GDPR.

3. Data collection

3.1. Instant Factoring collects data in the following ways:

1. following the User’s consent, by directly sending their personal data to Instant Factoring through the Site or by other means of communication;
2. when data subjects call Instant Factoring’s phone lines;
3. through the video call identification procedure for an Applicant’s representatives;
4. through the use of remote video identification solutions provided by specialized third parties (Onfido GmbH);
5. when the Applicant requests Instant Factoring services, Instant Factoring may collect the personal data of Relevant Persons from external sources. Such external sources include, without limitation, public and private registers (e.g. the Credit Risk Center - CRC, A.N.A.F., etc.). This information will be used to carry out credit and risk assessments;
6. through the conclusion and performance of a Contract between the Customer and Instant Factoring;
7. Instant Factoring collects personal data through automated means when the User accesses the website www.instantfactoring.com. For more information, please see the Instant Factoring Cookie Policy by following this link.

4. Legal bases and purposes of processing

Personal data is processed for the purposes of assessing creditworthiness and credit risk, concluding,  performing and managing factoring contracts, preventing the risk of fraud and non-payment of assigned receivables, collecting and recovering assigned receivables, as well as communicating with Customers and debtors.

Based on the data subject’s consent, in accordance with Article 6(1)(a) of the GDPR, we process Data for the following purposes:

• creating an account and registering Applicants on the Site;
• carrying out the identification procedure for the Applicant’s representatives by phone and video call;
• carrying out the remote video identification procedure through specialized providers;
• preliminary checks to identify financial and legal risks related to Applicants, Customers, affiliated entities, and their debtors.

For the performance of our legal obligations under Article 6(1)(c) of the GDPR, we process Data for the following purposes:

• customer due diligence procedures, prevention and combating of money laundering and terrorist financing, and implementation of international sanctions;
• beneficial owner identification procedures;
  
  • procedures to identify and verify the identity of Applicants’ legal representatives/authorized representatives;
  • processing biometric data (in particular the biometric facial map) collected during the remote identification procedure by video means, under Article 9(2)(g) of the GDPR in conjunction with Article 6(1)(c) of the GDPR, in relation to the customer identification and identity verification obligations imposed by Law No. 129/2019 on the prevention and combating of money laundering and terrorist financing;
• keeping accounting records and reporting to tax authorities, the National Office for the Prevention and Combating of Money Laundering, and other authorities in accordance with legal provisions, and carrying out internal and financial audits required by law.

Based on our legitimate interests, in accordance with Article 6(1)(f) of the GDPR, we process Data for the following purposes:

• managing Customer accounts and carrying out transactions;
• monitoring Customers’ activity in relation to identity verification and updating the relevant records;
• carrying out transactions and factoring operations;
• payment of receivables and insurance against the risk of non-payment;
• managing the relationship with Customers and periodically updating information about the Customer;
• analyzing transactions to detect any suspicious activity or attempted fraud;
• defending, where applicable, Instant Factoring’s rights arising from commercial relationships in court;
• to ensure the security of IT networks and data;
• managing Instant Factoring’s activities (in particular invoice administration, banking, and foreign exchange operations);
• analyzing the performance of Instant Factoring services;
• documenting requests/agreements/options regarding certain requested/discussed/agreed matters, including during phone calls initiated by Applicants, Customers, or Instant Factoring, by recording the matters discussed and, where applicable, audio recordings of phone calls or, where relevant, audio-video recordings;
• archiving documents/information in physical/electronic format, including backup copies;
• sending communications to existing Customers regarding features of our products and services and other information of interest about Instant Factoring and the sector in which we operate (direct marketing communications).

5. Remote video identification

Before the remote identification process begins, the person subject to identification gives explicit consent to completing the procedure, to the purpose of the identification, and to the taking of photographs and/or image captures, in accordance with Article 16 of the Regulation on the regulation, recognition, approval, or acceptance of the procedure for remote identification of a person using video means, issued by the Authority for the Digitalization of Romania on 11 November 2021. This consent is a condition for the validity of the identification procedure and is kept together with the recording of the process. Separately, the processing of biometric data and data from identity documents collected during the process is based, for the purposes of Regulation (EU) 2016/679, on the Company’s legal obligation under Article 6(1)(c) in conjunction with Article 9(2)(g), with reference to the provisions of Law No. 129/2019 on the prevention and combating of money laundering and terrorist financing, independently of the possibility of withdrawing procedural consent. Withdrawal of the consent given under the ADR Regulation does not affect the lawfulness of processing carried out before the withdrawal and does not require the Company to delete the records during the retention period imposed by AML legislation.

Onfido GmbH acts as a joint controller within the meaning of Article 26 of the GDPR or, where applicable, as a processor within the meaning of Article 28 of the GDPR, depending on the processing operations carried out within the identification flow. The Company has entered into an appropriate data processing agreement with Onfido GmbH, in accordance with the requirements of Article 28 of the GDPR. Data collected through the Onfido platform may be transferred outside the European Economic Area in compliance with the safeguards provided for in Chapter V of the GDPR, in particular under the standard contractual clauses adopted by the European Commission.

6. Automated decision-making and customer profiling

Instant Factoring creates a profile of the Applicant and Relevant Persons in order to decide whether their request to enter into a Contract is accepted or rejected. That decision is made by human operators.

The decision is made based on information received from the Applicant or User, information relating to Relevant Persons received from external sources, such as public and private registers, and from other third parties.

Profiling is necessary for concluding the Contract as well as for complying with legal obligations regarding the proper identification of the Applicant’s representative, creditworthiness assessment, and the prevention of fraud and money laundering.

7. Recipients to whom we disclose data

Personal data may be disclosed to the following categories of recipients within the European Union, depending on the purposes and legal obligations:

• Public institutions and authorities: the National Bank of Romania, ANAF,  the National Office for the Prevention and Combating of Money Laundering, ANSPDCP, CRC/CIP, ONRC, courts, bailiffs.
• Service providers: IT, hosting, and telecommunications companies, call‑center providers, courier, archiving, marketing, consulting, and audit companies, notaries, lawyers, experts, receivables collection agencies, banks, payment processors, remote video identification providers (namely Onfido GmbH), providers of services used to fulfill legal obligations in the area of preventing and combating money laundering and terrorist financing, including for international sanctions screening and verification of politically exposed persons (PEPs) (namely IVXS UK LTD).
• Creditors or assignees: companies that Instant Factoring authorizes to recover debts or to which receivables are assigned; financing partners and guarantee funds.
•  Business partners and guarantee institutions: insurance companies, courier companies, audit and accounting companies, the company’s legal and business consultants, etc.
• Analytics and marketing providers: third-party analytics and marketing providers, including cookie and analytics platforms, marketing automation and customer relationship management (CRM) solutions, as well as market research providers, etc. 

International transfers are limited. Data may be transferred within the group or to Instant Factoring’s external providers.

In all cases, we make sure that any such transfer takes place in accordance with applicable data protection legislation and only if adequate safeguards are in place, such as:

• adequacy decisions issued by the European Commission for the destination countries;
• standard contractual clauses approved by the European Commission and concluded with the recipient entities;
• other legal transfer mechanisms recognized by the GDPR.

For remote video communications, Instant Factoring uses Google Meet, for which the privacy policy available here applies: https://policies.google.com/privacy. If you do not accept the use of the Google Meet platform, we may not be able to provide certain services, such as remotely identifying the Applicant’s legal representative. 

Instant Factoring requires Users, Applicants, and Customers to communicate exclusively through the Site and the email addresses provided by Instant Factoring. The Company is not responsible for communications made through means other than those indicated by Instant Factoring. If Users, Applicants, or Customers choose to communicate with Instant Factoring using methods other than the Site or the email addresses provided by the Company, they are fully responsible for reviewing the privacy policies that govern the processing of personal data by the providers of those communication services.

8. Data retention period

Instant Factoring retains the Data of Relevant Persons and Users for as long as necessary to analyze the request for Instant Factoring services and products, as well as for a period of 12 months from the date the request to enter into a Contract is rejected or from the date of the last interaction with Instant Factoring.

After 12 months from the date the request to enter into a Contract is rejected or from the date of the last interaction with Instant Factoring, the Data will be retained in anonymized form and will be accessed only if this is required to fulfill a legal obligation incumbent on Instant Factoring, in response to a request from the authorities, or following a request from the data subject.

Instant Factoring retains the personal data of Relevant Persons related to a Customer in accordance with Law No. 129/2019 on the prevention and combating of money laundering and terrorist financing, for as long as necessary to fulfill the purposes for which it was collected, for as long as necessary to protect its rights, or for as long as required by applicable legal regulations. If the same Data is processed for several purposes, it will be retained for the longest applicable period. The maximum applicable period is up to 5 years from the date of the last transaction or from the date the account on the Site is closed, whichever is later.

Video recordings, photographs, and documents obtained during the remote identification procedure using video means (including the biometric facial map generated by the specialized provider) are retained for a period of 5 (five) years calculated from the date the business relationship with the Customer ends, in accordance with Article 21(1) of Law No. 129/2019. The legal basis for retention is the legal obligation set out in Article 6(1)(c) in conjunction with Article 9(2)(g) of the GDPR. During this period, withdrawal of the procedural consent provided for by the ADR Regulation of 11 November 2021 does not result in the deletion of the data, since the processing is based not on consent but on a legal obligation. At the end of this period, the data will be irreversibly deleted or anonymized, except where an ongoing dispute or an express request from a competent authority justifies, with proper documentation, an extension of storage.

At the same time, if personal data is included in documents relevant for accounting purposes, including, without limitation, factoring contracts, assigned invoices, related supporting documents, and any other record that constitutes a financial and accounting document within the meaning of Law No. 82/1991 on Accounting, it will be retained for a period of 10 years from the end of the financial year in which it was prepared, in accordance with Article 25(1) of Law No. 82/1991 in conjunction with the provisions of Order of the Ministry of Public Finance No. 2634/2015 on financial and accounting documents. Retention of this data for the stated period is based on the Company’s legal obligation under Article 6(1)(c) of Regulation (EU) 2016/679 (GDPR), with the processing limited exclusively to the purpose of archiving and making the documents available to the competent authorities.

9. Data subject rights regarding Data

Depending on the legal bases and purposes of Data processing, data subjects have the following rights regarding Data:

a) the right to information, meaning the right to receive transparent information about the identity of the controller, the purpose of the processing, the legal basis, and the duration of Data processing;

b) the right of access, meaning the right to obtain from Instant Factoring, on request, confirmation as to whether personal data is being processed, access to that data, and information about the processing;

c) the right to request rectification of inaccurate personal data or completion of incomplete data;

d) the right to restriction of processing, in which case Data may still be processed, except for storage, only with the data subject’s consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. Restriction of processing may be requested in the following cases:

• until we verify the accuracy of the Data if it has been contested by the data subject;
• the processing is unlawful and the data subject opposes erasure of the Data, requesting restriction instead;
• we no longer need the Data for the purpose of processing, but the data subject requests it for the establishment, exercise, or defense of legal claims;
• you have objected to our processing based on our legitimate interest, during the period in which we verify whether our legitimate interests override those of the data subject;

e) the right to erasure of Data (“the right to be forgotten”) if the Data has been processed unlawfully or:

• the Data is no longer necessary for the purposes of processing;
• the data subject has withdrawn consent for processing based on that consent and there are no other legal grounds for processing the Data;
• the data subject has exercised their right to object and there are no overriding legitimate grounds for continuing the processing;

f) the right to Data portability, meaning the right to receive the personal data provided, in a structured, machine-readable format, including the possibility for the data to be transferred to another controller, in cases where the processing is based on the data subject’s consent or on a contract or where the processing is carried out by automated means.

g) the right not to be subject to a decision based solely on automated processing, including profiling, if it produces legal effects concerning the data subject or similarly significantly affects them;

h) the right to object to processing based on the Controller’s legitimate interest.

i) The right to object to processing for direct marketing purposes.

j) The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing, headquartered at  28-30 General Gheorghe Magheru Blvd., Sector 1, postal code 010336 Bucharest, Romania, e-mail: anspdcp@dataprotection.ro (ANSPDCP) if you believe that your rights under the Regulation have been infringed;

You may exercise these rights free of charge by contacting us in writing at 2 Gara Herăstrău Street, 2nd floor, office 212,  Bucharest, Sector 2,  Romania or by email at dpo-romania@instantfactoring.com

10. Applicability over time

This data protection policy enters into force on the date of its approval and publication by the Controller and applies to all personal data processing operations carried out as part of factoring activities, regardless of when the data was collected. It remains valid for an indefinite period, until replaced by a new version.

Any significant revision will be published on the Controller’s website and, when necessary, communicated directly to data subjects.

Published on: 04.05.2026