Legal compliance

Compliance services with the legal framework include not only the legal segment but are highly multidisciplinary obligations of legal entities.

In addition to the legal segment, most new regulations expect compliance in the organizational and process sense, as well as the application of adequate technical and technological tools for compliance monitoring.

Boost provides clients with a service of compliance with a number of multidisciplinary regulations such as:

  • CSRD report generation based on ESRS standard
  • GDPR and UK–GDPR
  • Act on the Protection of irregularity Reporting (so–called “whistleblowers”)
  • Cybersecurity Act for key service operators and digital service providers (NIS1
  • and NIS2, DORA, CER, etc.)
  • SOC2, HIPAA and similar regulations for the USA

Frequently asked questions (FAQ)

1Who is obliged to comply with GDPR?
All legal entities that collect and process personal data (in GDPR terminology known as data controllers) are required to comply with the GDPR. Apart from the fact that the institution itself has to be in line with GDPR, it is important to keep in mind that all external suppliers of services (data processors) also have to be adequately aligned with the GDPR, and in that case the responsibility is on the data collector to see through that data processor is adequately aligned with GDPR.
2What rights are granted to private persons?
The point of the GDPR is that every person has the right to know what happens to the submitted data, for what purposes they were collected, for which they are handed over to all third parties and for what purpose. In this respect, persons (known as data subjects in GDPR terminology) are entitled and must receive a response within 30 days from the legal entity in possession of their data about exactly what they are doing with them and/or may request a whole range of actions – deletion, modification of data, restriction in processing, transfer to third parties, etc.
3What protection measures should we apply in case of data storage?
Since the Regulation does not state what technical protection measures should be applied but it is expected that the same should be applied, each institution needs to assess how well is data protected and how sensitive is their business activity. At the same time, data controllers are obliged to assess what is the chance of alienation or any other aspect of inadequate data handling. For some institutions, adequate data protection is sufficient through code on the computer and keeping the documentation in the key cabinet, and some institutions will need to use multiple security encryption tools to protect their data in operational business. However, it is evident that regulators within the EU emphasize the importance of technical data protection measures.
4When do I need to have a consent of a physical person?
Consent is collected for collecting and processing personal data only in cases when the collecting and processing of personal data is not regulated by the law and / or existing contractual agreement. For example, it is not possible to ask the bank in which you have a current account to delete your personal data and in the same time continue using the bank services at the same time. Consents are most commonly used in practice for part of data that is not covered by the contract or those that are not defined by the law. For example, for the implementation of the Contract of employment, it is not necessary to collect the employee's consent for basic personal data, but if the employer uses the satellite tracking of official vehicles, for such processing of personal data company needs to have employee's consent.
5Is a General Data Protection Regulation a unique regulation?
Apart from the GDPR, the relationship between physical persons and service providers will be further defined by the future regulations such as ePrivacy, IDD, the Taliban Declaration, PSD2, and similar regulations which will guarantee the physical person a high quality data retention and transparent data processing including personal data. It is to be expected that the security and transparency of data processing in the coming years will be an increasing focus of regulators and legislative bodies.
6Who is obliged to comply with the Protection of irregularity Reporting Act?
The obligation to comply with that law is: - company employing at least 50 employees, regardless of the nature of their activity - small and micro-enterprises, which, among others, participate in public procurement tenders, use EU funds, are subject to money laundering or belong to regulated entities in the financial services sector - legal entities in the public sector.
7What is the role of NIS1 and NIS2 Regulation?
The goal of the NIS Directive is to ensure in all EU Member States a common level of security of network and information systems, whose malfunctioning due to security incidents could have a strong impact on society or the national economy.
8Who is covered by the NIS2 Directive?
NIS 2, like the previous version of the Directive, concerns operators of essential services and digital service providers, but the number of sectors it covers will expand from the previous 19 to 35. This will include, in addition to sectors such as energy, health, banking and finance, drinking water supply and distribution, digital infrastructure and services in State information infrastructure systems, such as postal services, waste management, food and chemical production and distribution. NIS Directive 2 will also apply to public administrations at central and regional level.
9What's DORA?
Digital operational Resilience Act - DORA creates a regulatory framework for digital operational resilience, under which all companies (affected by the obligation) must ensure that they are resilient to and able to respond to and recover from all types of ICT-related (information and communication technologies) disruptions and threats. The same requirements apply to all EU Member States, with the main objective of preventing and mitigating cyber threats.
10Who is obligatory DORA and what does it include?
The obliged entities are: Insurance companies Investment companies shall comprise: ICT risk management risk management of ICT third party risk testing of digital operational resilience ICT incidents monitoring critical ICT third party service providers.

Useful links

EU Consulting and HBOR/HAMAG-BICRO Consulting

EU Consulting

We proactively monitor existing and planned tenders.

Our team is not just consultants writing tender documentation for the project, but a team that is considering improving your business and financing the projects through a completely new perspective.

The company Boost focuses on tenders aimed at micro, small and medium–sized entrepreneurs, and among clients IT, manufacturing and young and innovative companies developing their solutions in the direction of IoT.

The service includes:

  • Preparation and writing of project applications – project conceptualization
  • Consultancy in the implementation of projects
  • Preparation of tender documents and financial reports
  • Participation in analytical monitoring and preparation of annual reports

HBOR/HAMAG-BICRO Consulting

We assist in applying for funds provided by these institutions, as a complement to EU funding, but also without EU funding.

We help clients prepare application documentation for HBOR and HAMAG–BICRO loans.

Frequently asked questions (FAQ)

1Does each project need to have a business plan?
Since co-financing through EU funds is not a banking service, state bodies that file and evaluate applications for EU funds, have to be sure that the proposed project and related activities are absolutely meaningful and business-justified. In doing so, the business plan is the only document that can guarantee the success of the proposed business idea. In this sense, the business plan must be fully detailed and all information quantified and verifiable. The Boost team will explain all the details of the co-financing by stages and expected steps. Only then can you decide whether you want to fund your development through EU funds or otherwise.
2Which EU funding programmes and tenders are followed by the Boost?
Boost LLC follows a number of tenders which are available through the Structural Funds. Company is focused on tenders targeted at micro, small and medium-sized entrepreneurs, such as product certification, participation at international fairs; introduction of recognized business process management systems (ISO 9001, 14001, etc.), investing in Hardware-Software solutions etc.
3What other types of co-financing can be ensured?
Boost also monitors co-financing services and / or alternative financial funding sources offered by the institutions such as HAMAG Bicro, HBOR, county and city funds.
4What is the funding model of project writing and project managing through EU Funds for clients?
Boost approaches to the EU funding through several steps. Primarily, client is informed about all the good and bad sides including possible consequence of such type of financing. It is clearly defined with the client what does Boost provides and performs at the operational level and given financial offer to the client can be fully or partially accepted or rejected. Boost greatly differentiates the writing service from the (already approved) project management service.
5What is Boost's success rate for withdrawing EU funds?
In a period 2014-2020. Boost has 100% success in withdrawing funds from EU fund programmes for its clients.

Useful links

IT security

Cybersecurity in times of increased digitalization of business creates great pressure on legal entities to keep data adequately and in accordance with legal obligations and international standards.

We provide a status scanning service (GAP analysis), proposals for changes in protection systems, and implementation and maintenance of the following ISO standards:

  • ISO 22301 — Business continuity Management system
  • ISO 27001 — information Security Management system
  • ISO 27017 — information technology — Code of practice for
    STANDARDS–based information security controls
  • ISO/IEC 27002 for cloud services (cloud services)
  • ISO 27018 — information technology — Code of practice for protection of personal data (PII)
  • ISO 27701 — Safety techniques — extension to ISO /
  • IEC 27001 and ISO/IEC 27002 for the management of information on privacy (GDPR)
  • ISO/DIS 31700 — consumer protection — Integrated privacy consumer goods and services (Privacy by Design)
  • IT SECURITY

ISO Consulting

Boost LLC conducts business consulting for the preparation and implementation of ISO standards:

  • ISO9001 (QMS) specifying the requirements for the quality management system
  • ISO14001 (EMS) setting out the criteria for the environmental management system
  • ISO20000 that determines the quality of IT service management
  • ISO27001 (ISMS) for information security
  • ISO26000 and with SA 8000 that determine social responsibility
  • ISO45001 determining the management of health and safety at work
  • ISO37001 (ABMS) that specifies governance to counter bribery

During the development and preparation of documentation for each ISO standard, process and procedural adjustments are made to the internal client organization.

Frequently asked questions (FAQ)

1Which ISO standards can Boost LLC implement?
Boost has the experience and expertise in the implementation of the four key international standards that are most commonly practiced in the Republic of Croatia, such as QMS (Quality Management System - ISO 9001), EMS (Environmental Management System - ISO 14001), ISMS (Information Security Management System - ISO 27001) and OH&S (Occupational health and safety management systems - ISO 45001).
2What is the process of preparation and the very act of certification?
Boost helps the client to implement and certify the ISO standard (one or more) by scanning a complete internal business, checking compliance with the legal framework, preparing documentation to demonstrate compliance, and assisting the client to implement the rules of the operating plan. Only then does the selected certification company conducts the certification.
3How long does the whole process take?
Depending on the number of standards, number of clients working locations and administrative preparedness, duration of all necessary activities is estimated at the very beginning of the project. The client is presented with the project plan including all the steps deadlines and responsible persons (KPI’s). In general, the implementation itself should not last for less than 2 months or longer than 7 months.
4What is the price model for ISO implementation?
Boost suggests to clients a commercial relationship by which most of the contracted funds are charged only upon successful certification. Pricing models and payout intensity are negotiated with each client individually.
5How long is the certificate validated?
Certified institution carries out a 2 year audit of compliance with the standard, and the third year is the so-called recertification year since the standards are changed or upgraded every couple of years.

Useful links

Business Analytics

Boost LLC performs a business analytics for client needs by providing recommendations for business improvement through the situation analysis in the customers company. Gap analysis can be provided in the following areas:

  • ICT System Effectiveness
  • Process and procedures
  • Optimizing sales channels and market segmentation
  • Branding and rebranding
  • Risk analysis

Frequently asked questions (FAQ)

1In which way are you helping companies to improve their business?
In agreement with the client, first we make the scanning of the situation and then give the recommendations for business improvement. Depending on size of the client and the industry in which he operates, steps may be proposed that will further enhance the internal and external elements of the company's business development. The focus of business consulting can be a long-term development strategy, HRM and ICT topics, as well as sales and marketing strategies.
2What are the results of scanning all or individual business segments?
The Boost Team works in a way to make clear recommendations with all the elements of a pro & contra proposals and provides clear, transparent and unambiguous recommendations for business changes. It is the client's choice to accept the recommendations in whole or partially. Upon completion of the project, the Boost team remains at client’s disposal for any interpretations, additional advice and suggestions regarding the proposed changes.
3Which models of cooperation do you offer in business consulting?
Boost team offers the possibility of project engagement, per-call access and / or monthly agreed number of working hours to the extent in which are the Boost experts available. Consumption of working hours, price models and the intensity of engagement are negotiable.
4What expertise does Boost offers?
Boost covers the following expertise among the employees, but also has a broad network of partners providing the "one-stop-shop" principle for the client: the EU and other types of co-financing for business development, legal compliance, ISO implementation, business analysis and strategic and investment studies, analysis of the effectiveness of individual business segments (such as ICT, HRM, sales, marketing, etc.) and operational assistance in public procurement. With partner institutions we are able to offer legal services, branding, ICT services and operational project management.
5To what extent do you provide international matchmaking for products and services to your customers?
For years, Boost has been systematically working to develop a network of business partners for its clients, whether they need products or services from other countries or want to place their products and services globally. In this regard, Boost has developed a network of partners in Central and Eastern Europe, in the Middle East, China and South Africa.
6To what extent is Boost LLC dedicated to both micro and small businesses?
Boost operationally assists micro and small businesses in the business development process, from the very idea of setting up a company, registering and initially complying with the legal framework, all the way to helping find alternative sources of (co) financing for development (such as EU funds, HAMAG and HBOR funds, etc.).

Useful links

HRM Consulting (Human Resources Management)

  • Defining organizational structure, work roles and organizational charts and recruiting and selection based on the above.
  • Coordination and relationship management with external HR partners.
  • Preparation of legal regulations on labor contracts and work regulations, ie. logistical coordination of compliance with legal regulations.
  • Surveying of employee satisfaction, devising and implementation of performance management system (Performance management), system of rewarding and career development plan with accompanying education plan.

Matchmaking

For our client’s needs, we can work orientation briefings, connect with local businesses, make reports about target markets, work off operational work on sales opportunities, organize seminars, conferences and other events, provide translate and transport services as needed. Service also provides basic background information on a local company such as, the address, contact person, ownership composition, year of establishment, etc. It also includes a financial report, credit performance, information on any debt, benchmarking of import amounts, company growth, years in the market, reputation etc.

Educations

  • Advisory services and education related to EU financing options, HBOR (Croatian Bank for Reconstruction and Development) and HAMAG-BICRO Loans (Croatian Agency for SMEs, Innovations and Investments)
  • Education related to the implementation and enforcement of the General Data Protection Regulation (GDPR)
  • Compliance with the legal regulations and human resource management

BOOST d.o.o.

Terms of use

Term of Use

Cookie Policy

Privacy Policy

Business principles

Equal opportunities

Social responsibility

5S-Methode

Quality Policy

Information Security Policy

Anti-Bribery Policy