Privacy Notice: Data Processing Information

Version 1.2 · Effective date: 10 September 2026

Per Art. 13 GDPR (Regulation EU 2016/679), concise notice distinct from the full Privacy Policy.

What this notice is for

This notice tells you, briefly and clearly, what personal data NOIDEEA S.R.L. collects about you, why, who else sees it, how long we keep it, and what rights you have. It is the short-form version of our Privacy Policy, both apply.

1. Who is the data controller

NOIDEEA S.R.L.

CUI: RO48069626

Trade Register: J40/8019/2023

Address: Calea Vitan 242, Corp C2 Parter Birou 17, Sector 3, București, postal code 031296

Data Protection Officer (DPO): https://www.statusdosar.ro/contact/dpo

Supervisory authority: National Authority for the Supervision of Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, Bucharest, www.dataprotection.ro.

2. What data we collect and why

Data category	Why we collect it (purpose)	Legal basis (GDPR Art. 6)
Email, name, phone, password	Account creation, authentication, service delivery	Art. 6(1)(b): contract performance
CUI, billing data	Invoice issuance, fiscal compliance	Art. 6(1)(c): legal obligation (Law 227/2015, art. 319)
CNP	Shown on the invoice, only if you ask for it	Art. 6(1)(a): consent; refusal does not prevent the invoice
IP address, user agent, login history	Security, fraud prevention, audit	Art. 6(1)(f): legitimate interest
Saved cases, alert preferences	Automatic monitoring, notifications	Art. 6(1)(b)
Analytics cookies (GA4, Clarity)	Aggregated traffic statistics	Art. 6(1)(a): consent (cookie banner)
Marketing email	Product updates, offers for your own account	Art. 6(1)(f): legitimate interest (existing customer); one-click objection in every message

Note: card details never reach us. You enter them on the page of the payment processor, an authorised banking institution. From the card we keep the last digits and the expiry date, not the full number and not the security code.

The complete description of each processing operation, with its purpose, lawful basis and retention period, is in the Privacy Policy.

3. Who else has access

All Things IT S.R.L. (TorchByte) (Romania, hosting of the infrastructure)
Scaleway SAS (France, delivery of e-mails)
Libra Internet Bank S.A. (LibraPay) (Romania, card payments)
FGO (Romania, invoicing)
Meta Platforms Ireland Ltd. (Ireland, the WhatsApp channel, for case notifications)
Sentry (USA, error telemetry)
Microsoft Corporation (USA, on-site behaviour measurement, only with consent)
Google LLC (USA, traffic statistics, only with consent; sign-in with a Google account, if you choose it)

Libra Internet Bank S.A. processes payment data as a controller in its own right. The full description is in the Privacy Policy.

4. International transfers

The infrastructure on which the platform runs and the database are located in the European Union. Three recipients, Sentry, Google LLC and Microsoft Corporation, are established in the United States of America. The safeguard invoked for those transfers is the same: the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914.

5. How long we keep your data

Account data: for the duration of the contract; after a deletion request, a 30-day grace period, then erasure of the identifying data. Accounts without an active subscription may be closed for prolonged inactivity, under the Terms and Conditions.
Technical logs and login history: at most 12 months.
Log of sensitive actions: 90 days in the system, then a compressed archive.
Invoices and accounting records: 5 years from 1 July of the year following the financial year in which they were drawn up (Law 82/1991, art. 25).
Requests received through the site forms: 12 months from the date the reply is sent; bank account details given for a refund, at most 90 days.
Consent log: at least 5 years from the date the consent was given or withdrawn, whichever is later, as proof under Art. 7(1) GDPR.
Notifications sent: 12 months.
Court case data: at most 10 years from the last change recorded on the courts portal.

6. Your rights (GDPR Art. 15-22)

Access (Art. 15): see what data we have about you
Rectification (Art. 16): fix incorrect data
Erasure / Right to be forgotten (Art. 17): request account deletion
Restriction (Art. 18): pause processing
Portability (Art. 20): export data in JSON/CSV
Objection (Art. 21): object to legitimate interest processing
Automated decisions (Art. 22): see section 10 below
Withdraw consent (Art. 7(3)): as easy as giving it

To exercise any right: https://www.statusdosar.ro/contact/dpo. We reply within one month, extendable by two further months for complex requests, with notice in the first month. Free of charge.

The complete list of rights, with a description of each, is in the GDPR Policy, section 9.

7. Stop cookies (withdraw consent) and marketing emails (object)

Cookies, withdraw consent: click "Modify cookies" in the footer or in the Cookie Policy
Marketing emails, object (Art. 21), absolute and unconditional: the unsubscribe link in the header or footer of any such email, or https://www.statusdosar.ro/setari/notificari

Objecting to marketing takes effect immediately, needs no justification and does not affect your service. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

8. Right to complain

You may complain to the Romanian supervisory authority (ANSPDCP): www.dataprotection.ro. Address: B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, București. Contact details via the official ANSPDCP website above.

9. Mandatory vs optional data

Email + password are mandatory for account creation. Without them, the service cannot be provided.
Name, phone are mandatory at registration for security and account verification.
CUI and the billing address are needed at the first paid purchase, for issuing the invoice (Law no. 227/2015, art. 319). The personal numeric code (CNP) is optional: you give it only if you want it shown on the invoice, and refusing it does not prevent the invoice from being issued.
Marketing emails are optional: they are sent on legitimate interest because you have an account with us, and you stop them with one click, at any time, with no justification.

10. Automated decisions and profiling (Art. 22)

StatusDosar.ro does NOT make automated decisions with legal effect on you. Case alerts are rule-based (a hearing change triggers a notification), not profiling. There is no automated risk scoring, no creditworthiness evaluation, no behavioral discrimination.

11. Document version & contact

Version 1.2, effective 10 September 2026. For complete details, see the full Privacy Policy.

For any questions, contact our DPO at https://www.statusdosar.ro/contact/dpo.

Last updated: 10 September 2026 · Version 1.2