Privacy Policy

2.1. Account, authentication and service performance (Art. 6(1)(b) GDPR)

Purpose: Account creation and management; authentication (including 2FA TOTP); identifying Account Type (PF / PJ / AV); provision of contracted services; technical support.

Data processed: email, password (kept in a form from which it cannot be reconstructed), first name, last name, phone, CUI and billing data (PJ), account type, IP address and user agent at registration, the external account identifier if you choose to sign in with a Google account.

Retention: for the duration of the contract. On account deletion: a 30-day grace period in which the account can be recovered, then erasure of the identifying data; a record of the deletion is kept as proof. Accounts without an active subscription may be closed for prolonged inactivity, under the conditions set out in the Terms and Conditions.

Order without an account: If you give your details for an order without an account (the monthly subscription included) and do not pay, we delete them after 7 days. If you pay and do not set a password, we keep them for 12 months after the end of the last paid month, then anonymise them; invoice data stays as long as the law requires.

2.2. Case monitoring and notifications (Art. 6(1)(b))

Purpose: Automatic periodic checks of the status of saved cases, on the official portal portal.just.ro, and delivery of notifications. We do not guarantee any particular interval between checks, nor real-time updates: we depend on when the courts publish the information in the official source.

Data processed: case identifier (number, court), notification preferences, the label you give a case, the devices linked to the account, the history of changes recorded on the cases you follow.

Retention: saved cases, for the duration of the contract; case change history: 12 months; notifications sent: 12 months.

Monitoring without an account: for the paid monitoring of a single case without a user account we process first and last name, e-mail, phone, county, town and the case followed. The phone number identifies the sign-up uniquely and lets us reach you about the payment or the case; it is not used for marketing. The data is kept for the paid period and for another 12 months after the last paid period ends, then anonymised; a sign-up for which no payment was ever made is deleted after a few days. The invoice follows the statutory retention period set out in 2.3.

2.3. Payments, invoicing and fraud prevention (Art. 6(1)(b) + (c))

Purpose: Card payment processing, issuing the invoice and filing it with the tax system, accounting records, fraud prevention.

Data processed: amount, currency, transaction date, client name, email, phone, billing address, CUI/CNP, transaction history. Card details never reach us: you enter them on the page of the payment processor, which is an authorised banking institution. From the card we keep only what we need in order to renew your subscription and to let you recognise the card in your account: the last digits and the expiry date. We do not keep the full number or the security code. For a refund paid by bank transfer we additionally process the IBAN, the account holder's name and the bank, as given by you in the refund request, used exclusively for that payment.

Retention: supporting documents and transaction records, the statutory retention period of 5 years, counted from 1 July of the year following the financial year in which they were drawn up (art. 25 of Law no. 82/1991); data used for fraud prevention is kept for as long as it is necessary for that purpose and for the establishment or defence of a legal claim; the bank account details given for a refund, at most 90 days from the resolution of the request, after which those fields are emptied and the payment remains recorded only in the accounting documents.

2.4. Security, audit and attack protection (Art. 6(1)(f))

Purpose: Platform security and integrity; fraud prevention; incident investigation; protecting other users' accounts.

Data processed: technical application logs (action, user identifier, IP address, request identifier); the log of sensitive actions; login history, the devices linked to the account and the country derived from the IP address at each login.

Country derived from the IP address: at each login we derive the country of the IP address, so that we can warn you by e-mail if someone signs in to your account from a country other than the one used at the previous login. The lookup runs on our own server, against a geographic database stored on disk: your IP address is not sent to anyone for this purpose. We keep only the two-letter country code, next to the login record and with the same retention as that record. The source and update cadence of the geographic database are shown on Data sources and updates.

Retention: technical application logs and login history, at most 12 months; the log of sensitive actions: 90 days in the system, then a compressed archive.

Balance of interests: the Provider's legitimate interest in protecting the Platform against attacks and abuse, plus the obligation to protect other Users' accounts, prevails over the minimal impact on the data subject (pseudonymized data, limited retention).

2.5. Search by company or CUI (Art. 6(1)(f))

Purpose: Displaying, upon a search by name or CUI, the public court cases in which a legal entity, a public institution or another party not recorded in the case as a natural person appears, based on public data (ECRIS, ANAF, data.gov.ro / ANFP, ICCJ). The public party pages (/parte/…) have been withdrawn.

Data processed: name, CUI, associated public cases, ANAF published debts (if any), alternate names.

Natural persons: the company search does not search for natural persons, and the Platform does not generate public pages dedicated to natural persons. On certain categories of cases, in particular criminal cases involving natural persons, and cases that may reveal sensitive data (minors and family matters, health, medical confinement, adoption, guardianship and curatorship, medical malpractice), the names of natural persons are not displayed; they are replaced. This rule applies to everyone, whether you are a visitor, hold an account or hold a paid subscription, and whether or not you are a party to that case. The names of institutions and legal entities remain displayed.

Retention: for the duration of public data existence in official sources, with cache invalidation upon source update or objection request; associated court case data follows the rule in Section 4.5 (maximum 10 years from the last change recorded on portal.just.ro).

Balance of interests: public legitimate interest in centralized access to information already public by law, plus the Provider's legitimate interest in offering a transparency service, prevails over the reduced impact on the entity (data already published by the state). Legal entities and public institutions contesting or requesting take-down can use the mechanism described in Section 7.

2.6. Commercial communications, analytics and cookies: two distinct legal bases

(a) Commercial communications to users with an account (Art. 6(1)(f) GDPR, legitimate interest, in conjunction with Law no. 506/2004 art. 12(2), the existing-customer exception)

Purpose: Informing people who already have an account on the Platform about our own similar services, offers and commercial changes affecting their account. We send commercial communications to people without an account only if they agreed to it in the questionnaire on the case page (section 2.10).

Data processed: the email address associated with the account; communication preferences; account status (strictly so that you are not sent a message that does not apply to you).

Retention: for as long as the account exists, or until objection (unsubscribe), whichever comes first.

Right to object, absolute and unconditional (Art. 21(2)-(3) GDPR): every commercial message contains an unsubscribe link. The objection takes effect immediately, needs no justification, is free of charge and does not affect the contracted service. It may also be exercised through the DPO form.

Balance of interests: the Provider's legitimate interest in informing its own users about its similar services prevails over the reduced impact on the data subject: the address comes from the already existing relationship, the messages concern strictly the service the account was created for, and objection is one click away and absolute. We do not build behavioural profiles for this purpose and we do not transfer data to third parties for marketing.

(b) Traffic analytics and marketing cookies (Art. 6(1)(a) GDPR, consent)

Purpose: Aggregate traffic analysis (Google Analytics 4); functional and marketing cookies.

Data processed: analytics cookies (with anonymized IP); UTM data at registration.

Retention: cookies, per Cookie Policy; UTM data, for contract duration.

Consent withdrawal: anytime, via the cookie banner ("Modify Cookies" footer link) or by request to DPO form. Withdrawal does NOT affect the contracted service and does not affect the lawfulness of prior processing.

2.7. GDPR consents: immutable register (Art. 6(1)(c), legal obligation of proof)

Purpose: Demonstrating consent given by the data subject (T&C, cookies, marketing, profiling) per art. 7 GDPR.

Data processed: consent type, document version, acceptance or refusal, timestamp, IP address and user agent, kept as proof of consent. They are accessible to the account holder in the data export.

Retention: for the duration of the proof obligation, at least 5 years from the date the consent was given or withdrawn, whichever is later.

2.8. Requests received through the site forms (Art. 6(1)(b) and (f))

Purpose: Receiving and handling support requests, complaints, refund requests and requests concerning personal data.

Data processed: name, e-mail address, phone, the content of the message and, where the request requires it, the bank account details described in 2.3.

Retention: 12 months from the date the reply is sent; bank account details, at most 90 days.

2.9. Searches by visitors without an account (Art. 6(1)(f))

Purpose: Operating the search function and protecting it against abusive use.

Data processed: the search terms and technical data about the request, kept in a pseudonymised form from which we do not identify you in day-to-day operations.

Retention: at most 90 days.

2.10. Addresses left in the questionnaire on the case page, without an account (Art. 6(1)(a) GDPR, consent; Law no. 506/2004, art. 12(1))

Purpose: sending you by e-mail the procedure for access to the court's electronic case file, which you requested in the questionnaire, and the Platform's offers; for lawyers, announcing the law firm module and its offers; for companies, announcing the company module and its offers.

Data processed: the e-mail address, the text of the consent you ticked and its time, the case on whose page you sent the address, and the page language.

Retention: 12 months from the last consent; unsubscribing deletes the address immediately.

Withdrawal of consent: through the unsubscribe link in every message or through the DPO form; it takes effect immediately, is free of charge and does not affect the lawfulness of earlier processing.

2.11. Copies of the messages we send you (Art. 6(1)(f) GDPR)

Purpose: proof of the communications we sent and the handling of complaints or disputes about them.

Data processed: a full copy of every e-mail sent from the Platform's servers, including notifications, alerts and replies: the recipient's address, the subject, the content, the attachments and the time of sending.

Retention: 3 years from sending, including for the copy of the notification e-mails described in 2.2 and after the account is closed; the copy is then deleted automatically.

Where: on our servers, encrypted and kept separately from ordinary correspondence; only the Platform's administrators have access, and every access is recorded.

2.12. Requests sent to the partner lawyer (Art. 6(1)(a) GDPR, consent)

Purpose: forwarding to the partner lawyer presented on the Platform the initial assessment request you send through their form (on their profile or on a case page), so that they can contact you.

Data processed: the topic you chose, your name, your company (if you write it), your e-mail address or phone number, the description of the situation, the case number (if you choose to attach it), the text of the consent you ticked and its time, and the page language.

Recipient: the partner lawyer you write to, who receives the request by e-mail and uses it as an independent controller, under their own responsibility; from then on, the correspondence and any contract are between you and them.

Where: the request is kept encrypted on the Platform's servers; in the administration panel it can be opened only by the Platform's administrators who hold this right, to check the forwarding and to handle your requests about your data. The e-mail notice that a request has arrived does not contain your data.

Retention: at most 12 months from sending, after which the request is deleted automatically. The copy of the e-mail sent to the lawyer is kept separately, for 3 years, in the archive described in 2.11.

Withdrawal of consent and your rights: through the DPO form, free of charge. Once we receive the withdrawal, we delete the request from the Platform without delay; the withdrawal does not affect the lawfulness of the earlier forwarding and does not delete the copy of the e-mail in the archive described in 2.11, kept as proof of the communications, to which you may object through the same form. For data the lawyer has already received, you exercise your rights towards them: their e-mail address is not public, so you can send us the request through the same form and we forward it to them.