Privacy Policy

This Privacy Policy explains how we process personal data in connection with the Service.

Effective date: 22 October 2026 - Version: 1.1

1. Who is responsible

1.1The controller is IPATE LAURENȚIU-SORIN PERSOANĂ FIZICĂ AUTORIZATĂ (PFA), a Romanian sole trader, with its headquarters in Bucharest, 27-33 Schitu Măgureanu Boulevard, building C, 3rd Floor, apartment 116, Romania, registered with the Trade Registry under no. F2021002015407, EUID ROONRC.F2021002015407, having sole registration code (CUI) 44705062, operating the HowToRomania brand ("we", "us").

1.2Privacy contact: hello@howtoromania.io.

1.3We have assessed that we are not required to appoint a Data Protection Officer under art. 37 GDPR: our core activity does not involve large-scale, regular and systematic monitoring of data subjects, nor large-scale processing of special categories of personal data. We keep this assessment under review as the Service evolves and will appoint a DPO if our processing activities change in a way that triggers the requirement.

1.4This policy covers two groups of people:

• 1.5Customers: people who use the website or API (section 2).
• 1.6People who appear in public data returned by the API, such as company representatives and sole traders (section 3).

2. Customers

What we collect

• 2.1Card data: handled by Stripe. We never see or store full card numbers.
• 2.2Demo key (htr_demo): we process the IP address only to apply the 20 calls/day limit.
• 2.3Cookies: neither howtoromania.io nor the API (including the docs at api.howtoromania.io/docs) sets cookies, and neither loads scripts, analytics or third-party resources. Cloudflare may set a strictly necessary security cookie (such as __cf_bm) only if its bot protection challenges a visitor.
• 2.4Invoice content (e-Factura): processed only in memory to answer the call and not used for anything else. We do not store invoice XML, generated invoices or PDFs in our database, cache or logs. Validation and PDF rendering use ANAF’s public services, so the invoice content is sent to ANAF for that purpose.

2.5For invoice content submitted in e-Factura calls, we act as your processor under art. 28 GDPR. Our Data Processing Addendum (available at howtoromania.io/dpa and incorporated by reference into our Terms of Service) sets out the terms of that processing, including the subject matter, duration, nature and purpose of processing, the type of personal data and categories of data subjects, and our and your respective obligations.

How long we keep it

3. People in public data returned by the API

What and where from

3.1API responses can contain personal data that is already public in official sources:

• 3.2Company representatives (name, role, and any other fields present in the source) from ONRC open data published on data.gov.ro under CC-BY 4.0.
• 3.3Sole traders (PFA) and individual enterprises (II): names, which are part of the business name, from ANAF, ONRC and court data.
• 3.4Court cases from portal.just.ro: names of natural-person parties are masked; PFA/II names are shown. For criminal cases we show only company-level information (case number, court, category, procedural stage, dates and the queried company's own role); the case subject, hearing outcomes and all other parties are withheld before anything is cached (art. 10 GDPR).
• 3.5Legislation from legislatie.just.ro (may include names of signatories of official acts).

3.6We do not collect personal data from private sources, social media or data brokers.

3.7Most data is fetched live from the official source when a customer asks for it, and kept briefly in a cache (Cloudflare Workers KV) to spare the sources: ANAF company records for 6 hours, BNR exchange rates for 1 hour, financial statements for 30 days (1 day for recent years not yet published), and court-portal results for 24 hours (natural-person names are masked, and criminal-case details withheld, before results are cached). Our relay keeps upstream responses in memory only, for 10 minutes (court-portal responses there are not yet masked; they are never written to disk or logs), and legislation texts on disk, refreshed every 6 to 24 hours. Representatives come from a snapshot of the ONRC open dataset (currently dated 3 September 2026), stored as files on Cloudflare and replaced when we rebuild it. We keep only company-level fields and representative names and roles, without birth dates or personal addresses.

Why and on what basis

3.8We make this public data available to businesses for know-your-business (KYB) checks, supplier and partner verification, fraud prevention, invoicing and legal compliance.

3.9Legal basis: legitimate interest (art. 6(1)(f) GDPR), ours and our customers’, in providing transparent, efficient access to official company information for know-your-business, supplier and partner verification, fraud prevention and legal compliance purposes. We have assessed that this interest is not overridden by the interests or fundamental rights of the people concerned, taking into account that: (a) the underlying data is already lawfully public in an official source; (b) reuse of this category of public-sector data is expressly supported by the reuse framework in Law no. 179/2022 and Directive (EU) 2019/1024, which provide that re-use of in-scope documents shall not be subject to conditions beyond those that are objective, proportionate, non-discriminatory and justified by a public-interest objective; (c) ONRC open data is published under an open licence (CC-BY 4.0) designed for reuse, including commercial reuse; (d) we limit the data we show to what is in the official source and do not add profiling fields; (e) we mask natural-person parties in court data and do not enable search by natural-person name; and (f) our Terms of Service prohibit customers and their Agents from unlawful profiling and from building an index of all entities linked to a natural person. We have documented this analysis in a dated, standalone Legitimate Interest Assessment and DPIA Screening Record, reviewed at least annually and whenever the scope of processing materially changes, available on request to a supervisory authority or, in summary form, to an affected data subject who contacts us.

3.10We treat PFA/II names appearing in court results or in the automated risk score as personal data and have limited their use accordingly: the risk score is a company-level indicator, not a profile of the named individual, and our Terms of Service prohibit customers from using it to profile natural persons unlawfully or to make legal or similarly significant decisions about a natural person without meaningful human review. We include only the ONRC open-data fields necessary for business identification (name and role); we do not display home addresses or other sensitive identifiers beyond what the source itself designates as public register information.

3.11Former administrators and representatives: company representative data is refreshed from the ONRC open-data snapshot each time we rebuild it (see "Why and on what basis" above); a person who is no longer a current representative according to the latest snapshot is removed from our current-representative results at the next rebuild and is not retained or shown as a current office holder afterwards. We do not separately retain or expose a historical "former administrator" record as part of the standard Service. We have assessed that a full Data Protection Impact Assessment (art. 35 GDPR) is not currently required, given the limited scope and public nature of the data processed, the exclusion of special categories of data and the safeguards described in this Policy; we will revisit this assessment, and update the LIA/DPIA Screening Record referred to above, if the scope of processing materially expands (for example if the "all entities linked to a person" index referred to in our Terms is ever introduced, or if a historical representative record is introduced). Consistent with art. 14(5)(b) GDPR, we rely on this public Privacy Policy, rather than individual notices, to inform data subjects whose data we obtain from Source Sites rather than directly from them, because individual notification would require disproportionate effort relative to the scale of the public data involved.

Who receives it

3.12Our customers, who receive it in API responses. Each customer is an independent controller for its own use and must have its own legal basis. Our Terms of Service contractually prohibit customers from reselling, redistributing or sublicensing data obtained through the Service to third parties; a customer who does so anyway is acting in breach of its contract with us and bears sole responsibility, including liability to us, for that breach.

Your rights and how to object

3.13If you appear in data we return, you can:

• 3.14ask whether we process data about you and get a copy (access);
• 3.15ask us to correct data we have changed or added (rectification). Errors at source must be corrected at the source authority (e.g. ONRC); we will tell you where;
• 3.16object to the processing (art. 21). We will stop, unless we have compelling legitimate grounds or the data is needed for legal claims;
• 3.17ask for erasure or restriction where the law allows.

3.18Email hello@howtoromania.io with subject “Data subject request”, your name, the company or case concerned, and what you want. We may ask for information to confirm your identity. We reply within one month (extendable by two months for complex requests, with notice).

3.19If you successfully object under art. 21 GDPR to our processing of your data, we will stop showing your name or other personal data in our own compiled results and risk indicators going forward, and will instead show that the field has been withheld following a data-subject request. We do not alter, and cannot alter, the official record held by the source authority (for example ONRC or the courts); if you believe the source record itself is inaccurate, you must contact that authority directly, and we will tell you how. Suppressing a field in our results may reduce the completeness of a know-your-business check performed by one of our customers; we consider this an acceptable consequence of honouring your objection, and our customers remain independently responsible for carrying out any further verification they consider necessary.

4. Service providers (sub-processors)

4.1We have data processing agreements or equivalent contractual protections in place with Cloudflare and Zoho, incorporating Standard Contractual Clauses or relying on the EU-US Data Privacy Framework for any transfer outside the EU/EEA, as applicable. Stripe acts as an independent controller for payment, fraud-prevention and compliance purposes under its own privacy notice, and as merchant of record for the purchase transaction itself; Stripe is not our processor for those purposes, and you should also review Stripe's own privacy notice. ANAF is a recipient of invoice content you submit for e-Factura processing, not our sub-processor: ANAF receives and processes that content under its own legal basis and responsibilities as a public authority, independently of our processing on your behalf.

4.2We do not sell personal data and do not use it for advertising.

5. Security

5.1API keys are required for paid services. We store keys only as SHA-256 hashes (the full key is shown once, when it is created; we keep its first 12 characters to help with support), and keys are redacted from request logs. Traffic is encrypted in transit with TLS 1.2 or higher (HTTPS); the Service enforces HTTPS-only access (plain HTTP is redirected to HTTPS) and sends an HSTS header. Cloudflare encrypts our database (D1) and cache (KV) at rest with AES-256. The relay accepts only authenticated requests from our API, for an allow-list of public sources. Access to systems is limited to the operator. We maintain an internal Personal Data Breach Response Procedure and a Record of Processing Activities (ROPA) under art. 30 GDPR, which we keep current and can make available to a supervisory authority on request. No system is perfectly secure; if a breach is likely to put your rights at risk, we will tell you and the authority as the GDPR requires.

6. Your rights as a customer

6.1You can request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest. Email hello@howtoromania.io. We reply within one month.

7. Complaints

7.1You can complain to the Romanian supervisory authority: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro, or to the authority in your EU country of residence. We would appreciate the chance to fix it first at hello@howtoromania.io. Please note that a complaint about the accuracy of data at its official source (for example ONRC or the courts) should be directed to that source authority; we will help you identify the right contact, but as explained in Section 2 we do not control, verify or guarantee the accuracy of data obtained from Source Sites.

8. Children

8.1The Service is for businesses and adults. We do not knowingly collect data from anyone under 18.

9. Automated decisions

9.1We do not make decisions with legal or similarly significant effects about you. The KYB risk score is an automated indicator about a company that customers use as input; our Terms forbid customers from using it for such decisions about natural persons without human review. See Section 3 above for how we treat PFA/II names in this context.

10. Changes

10.1We will post updates here with a new effective date and email key holders about material changes.

11. GDPR at a glance

• 11.1Controller: IPATE LAURENȚIU-SORIN PERSOANĂ FIZICĂ AUTORIZATĂ (PFA), Romania. Contact hello@howtoromania.io.
• 11.2Customer data: minimal (email, key, usage, signup IP for 30 days, payment records; error logs without IPs). Contract, legal obligation and legitimate interest.
• 11.3Public registry data: reused under legitimate interest and open-data rules; natural-person court parties masked; right to object via hello@howtoromania.io.
• 11.4Processors: Cloudflare, Zoho Mail EU, our own relay in Romania. Stripe acts as an independent controller / merchant of record, not our processor. A separate Data Processing Addendum applies to e-Factura processing (see howtoromania.io/dpa).
• 11.5Transfers outside the EU: only with GDPR safeguards (DPF / SCCs).
• 11.6No selling, no ads, no tracking cookies.
• 11.7Authority: ANSPDCP, www.dataprotection.ro.