Data Processing Addendum

Effective date: 22 October 2026 · Version: 0.1

1. Parties and Scope

1.1This Data Processing Addendum ("DPA") is entered into between IPATE LAURENȚIU-SORIN PERSOANĂ FIZICĂ AUTORIZATĂ (PFA), a Romanian sole trader (persoană fizică autorizată), with its headquarters in Bucharest, 27-33 Schitu Măgureanu Bulevard, building C, 3rd Floor, apartment 116, 1st District, Romania, registered with the Trade Registry under no. F2021002015407, EUID ROONRC.F2021002015407, having sole registration code (CUI) 44705062 operating the HowToRomania brand ("Processor", "we", "us"), and the customer identified in the applicable order, account or API key registration ("Controller", "you"). It forms part of, and is incorporated by reference into, the HowToRomania Terms of Service (the "Terms").

1.2This DPA applies only to the extent that we process Personal Data on your behalf and on your documented instructions as a processor under art. 28 of Regulation (EU) 2016/679 ("GDPR"), in particular in connection with e-Factura calls where you submit invoice content for us to validate, generate, parse or render, and any other feature we designate in our documentation as processed on your behalf. It does not apply to our processing of Personal Data appearing in public-source data (companies, representatives, court data, legislation) that we make available to you, where each of us acts as an independent controller, as described in our Privacy Policy.

2. Definitions

2.1"Personal Data", "processing", "controller", "processor", "data subject", "personal data breach" and "special categories of personal data" have the meanings given in the GDPR. "Sub-processor" means any processor engaged by us to process Personal Data in order to provide the Service.

3. Subject matter, nature, purpose and duration of processing

3.1Subject matter: the provision of the e-Factura validation, generation, parsing and PDF-rendering features of the Service (and any other feature we designate as processed on your behalf).

3.2Nature and purpose: automated technical processing of invoice content you submit via the API, strictly to return the output of the specific call you make (for example a validation result, a generated invoice, a parsed structure, or a rendered PDF).

3.3Duration: for the duration of the applicable API call only. As described in our Privacy Policy, invoice content is processed in memory and is not stored in our database, cache or logs after the response is returned, except where validation or PDF rendering requires sending the content to ANAF's public services, which then process it under their own responsibilities as a public authority.

3.4Categories of data subjects: the natural persons referenced in the invoice content you submit, which may include your own representatives, your counterparty's representatives, and other individuals named in an invoice (for example contact persons).

3.5Types of Personal Data: names, roles, contact details, and any other Personal Data that you choose to include in invoice content you submit; we do not require or request any particular category of Personal Data, and you control what you submit.

4. Our obligations as processor

4.1We will:

1. 4.2process Personal Data only on your documented instructions, including with regard to transfers of Personal Data to a third country, unless required to do otherwise by Union or Member State law to which we are subject, in which case we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;
2. 4.3ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
3. 4.4implement appropriate technical and organisational measures as described in our Privacy Policy and in Schedule 2 to this DPA;
4. 4.5respect the conditions for engaging another processor (Sub-processor) referred to in Section 5;
5. 4.6taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of your obligation to respond to requests for exercising data subjects' rights;
6. 4.7assist you in ensuring compliance with your obligations relating to security of processing, breach notification, data protection impact assessments and prior consultation with a supervisory authority, taking into account the nature of processing and the information available to us;
7. 4.8at your choice, delete or return all Personal Data to you after the end of the provision of the relevant feature, and delete existing copies unless Union or Member State law requires storage; given that invoice content is not stored after the call completes as described in Section 3, this obligation is satisfied by that design, and no further return or deletion step is normally required;
8. 4.9make available to you all information necessary to demonstrate compliance with the obligations in art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, subject to reasonable advance notice, confidentiality, and no more than once per 12-month period absent a reasonably suspected breach; we may satisfy this obligation in the first instance by providing a written summary of our security and compliance measures.

5. Sub-processors

5.1You give us general authorisation to engage Sub-processors to provide the Service, provided we impose on them the same data protection obligations as set out in this DPA. Our current Sub-processors are listed in our Sub-processors and International Data Transfers Notice (available at howtoromania.io/subprocessors) and summarised in our Privacy Policy, as updated from time to time.

5.2The relay computer described in Schedule 2 is equipment we operate ourselves in Romania; it is not a Sub-processor and does not process invoice content.

5.3We will inform you of any intended addition or replacement of a Sub-processor by updating our Privacy Policy and, for a material change, by emailing key holders, giving you the opportunity to object on reasonable data-protection grounds within 14 days. If you object and we cannot address your objection with reasonable commercial efforts, either of us may terminate the affected feature of the Service without penalty.

5.4We remain fully liable to you for the performance of a Sub-processor's obligations where that Sub-processor fails to fulfil its data protection obligations.

6. International transfers

6.1Where we or a Sub-processor transfer Personal Data outside the European Economic Area, we will ensure that the transfer is subject to an adequate level of protection, through an adequacy decision of the European Commission, Standard Contractual Clauses adopted by the European Commission, the EU-US Data Privacy Framework (where applicable to the recipient), or another valid transfer mechanism under Chapter V GDPR. Details of the transfer mechanisms relevant to each Sub-processor are set out in our Privacy Policy.

7. Security of processing

7.1Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons, we implement the technical and organisational measures described in Schedule 2 and in our Privacy Policy.

8. Personal data breach notification

8.1We will notify you without undue delay after becoming aware of a personal data breach affecting Personal Data processed under this DPA, providing the information reasonably available to us to allow you to meet your own notification obligations under art. 33 and 34 GDPR. This notification does not constitute an acknowledgement by us of any fault or liability in respect of the breach.

9. Liability and relationship with the Terms

9.1This DPA does not create, and shall not be construed as creating, any liability in addition to, or broader than, the liability described in the Terms. Our total liability arising out of or in connection with this DPA is subject to, and forms part of, the overall liability cap set out in the Terms, including the liability shift in Section 8B of the Terms for your breach of the prohibition on resale of Service data, and nothing in this DPA affects the disclaimers, exclusions or indemnity set out there. Nothing in this Section limits liability that cannot be limited or excluded as a matter of mandatory law.

10. Audits and demonstration of compliance

10.1We will make available to you such information as is reasonably necessary to demonstrate compliance with this DPA. Any on-site audit or inspection beyond a documentation review is at your cost, subject to reasonable scheduling, confidentiality and security requirements, and limited to what is proportionate given the scope of processing described in Section 3.

11. Term and termination

11.1This DPA takes effect on the date you first use a feature of the Service involving processing on your behalf as a processor and terminates automatically on termination of the Terms or when we no longer process Personal Data on your behalf, whichever is earlier. Sections 9 and 10 survive termination.

12. Governing law

12.1This DPA is governed by the same governing law and jurisdiction as the Terms.

13. Schedule 1 — Details of processing

13.1Subject matter, duration, nature, purpose, categories of data subjects and types of Personal Data are as set out in Section 3 above.

14. Schedule 2 — Technical and organisational measures

1. 14.1Access control: access to systems is limited to the operator; API keys are authenticated and stored only as SHA-256 hashes (the full key is shown once, at creation, and never stored).

14.2Encryption in transit: HTTPS/TLS only, minimum TLS 1.2 (plain HTTP is redirected to HTTPS), with HSTS enforced (max-age 180 days).

14.3Encryption at rest: database and cache encrypted at rest (AES-256) by our infrastructure provider.

14.4Minimisation: invoice content is processed in memory only and is not persisted after the call completes, as described in Section 3.

14.5Relay: public-source queries that Romanian portals only answer from Romanian IP addresses (court portal, legislation portal, ONRC open-data downloads) are fetched through a computer operated by us in Romania (the operator's own PC), connected to our Cloudflare infrastructure over an encrypted, authenticated Cloudflare Tunnel. It receives only those queries – never API keys, customer emails, IP addresses or invoice content – keeps upstream responses in memory for at most 10 minutes, and logs only time, source address, status and size. Invoice content submitted under this DPA does not pass through the relay; ANAF's public e-Factura services are called directly from our Cloudflare infrastructure.

14.6Logging: request logs are redacted of API keys and, for invoice content, do not capture request bodies.

14.7Incident response: a breach-notification process is in place as described in Section 8.

14.8Review cadence: these measures are reviewed at least annually and whenever the Service's architecture materially changes; we do not currently hold a third-party security certification or publish penetration-test results, and will update this Schedule if that changes.