GDPR Policy

1. Data controller and DPO

NOIDEEA S.R.L. acts as data controller within the meaning of Art. 4(7) GDPR for the personal data processed via the Status Dosar platform (www.statusdosar.ro and my.statusdosar.ro). The Data Protection Officer can be contacted directly and confidentially through the form above.

2. Key definitions (Art. 4 GDPR)

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data, automated or manual.
• Controller: the entity that determines the purposes and means of processing.
• Processor: the entity that processes data on behalf of the controller.
• Data subject: the natural person to whom the data relates (you, the user).
• Consent: freely given, specific, informed and unambiguous indication of will (Art. 4(11) GDPR).
• Profiling: automated processing used to evaluate personal aspects (Art. 4(4)).
• Special categories: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic, biometric, health, sex life or sexual orientation (Art. 9).
• Pseudonymisation: processing such that the data can no longer be attributed to a specific subject without additional information kept separately and protected (Art. 4(5)).

3. Categories of personal data processed

We process strictly the data needed to deliver the contracted service and to comply with legal obligations. We minimise collection (Art. 5(1)(c) GDPR, data minimisation).

We do not ask you for special categories of data under Art. 9 GDPR (health, biometrics, religion, sexual orientation and the like); no form on the platform requests them. Such data can nevertheless appear in the case data published by the courts, for example in family, health or guardianship matters. For those cases the lawful basis is the one described in §4.4, and the names of natural persons are not displayed, see the Privacy Policy, §2.5. We do not share data with advertisers, brokers or third-party marketers.

4. Purposes and lawful basis (Art. 6 GDPR)

For each processing operation we identify and document a clear lawful basis. The matrix below summarises our records of processing activities (Art. 30 GDPR).

5. Sources of personal data

• Direct from you: at signup, while configuring your account, when contacting support, when paying for a subscription.
• Generated automatically: usage logs, IP, user agent, security events.
• Sign-in with a Google account: if you choose it, Google sends only the unique identifier and the e-mail address you authorise.
• Public court data: portal.just.ro, ECRIS, public registers, on the basis described in §4.4.
• Payment processor: the confirmation of the payment and its reference, without card details.

6. Retention periods

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected (Art. 5(1)(e) GDPR, storage limitation), or for as long as required by law.

After the retention period expires, the data is irreversibly anonymised. Encrypted backups are not used to reconstruct deleted data; restoration takes place only in disaster scenarios, with a documented incident record.

7. Recipients and processors

With the providers that process data on our behalf we conclude agreements under Art. 28 GDPR. The recipients are the same as those listed in the Privacy Policy, Section 3:

Libra Internet Bank S.A. processes payment data as a controller in its own right, not on our behalf. Changes to this list are announced at least 30 days in advance.

8. International transfers (Chapter V GDPR)

The infrastructure on which the platform runs and the database are located in the European Union. Three recipients in the table above, Sentry, Google LLC and Microsoft Corporation, are established in the United States of America. Transfers to them are made under each supplier's published data processing terms, which incorporate the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, controller-to-processor module. Those terms are published by the suppliers and can be consulted directly.

9. Your rights as data subject (Art. 12-22 GDPR)

All rights below are exercised free of charge and are handled within one month of receiving a complete request. For complex requests the deadline may be extended by two further months, and we tell you within the first month (Art. 12(3) GDPR). Where we cannot identify you, we may request additional verification.

10. Automated decisions and profiling (Art. 22 GDPR)

Status Dosar does not use automated decisions producing legal or similarly significant effects against you. We do not rank, score or rate users for credit, eligibility or employment purposes. Automated processing is limited to routing notifications, checking service availability and automated measures against abusive use, none of them with binding legal effect. Where applicable, you can request human review under Art. 22(3) GDPR.

11. Children's data (Art. 8 GDPR)

The platform is for adults. Creating an account requires you to be at least 18 years old and to have full legal capacity (Terms and Conditions, Art. 4.2), so we do not knowingly collect personal data from anyone under 18. Separately, Romanian law sets the digital consent age at 16 years (Law 190/2018 art. 2); that threshold does not lower our contractual minimum. If you become aware that a minor has created an account, please notify the DPO so we can investigate and, where appropriate, erase the data.

12. Cookies and similar technologies

The complete inventory of cookies, retention and providers is available in the Cookie Policy. Strictly necessary cookies are exempt from consent (Art. 4(5) Law 506/2004); analytics, functional and marketing cookies are loaded only after explicit consent via the cookie banner. You can re-open the consent panel at any time using the Cookie Settings button in the footer.

13. Security measures (Art. 32 GDPR)

We apply technical and organisational measures appropriate to the risk, in line with Art. 32 GDPR. The concrete details are not published; the categories below describe the controls in place:

• Encryption: data is encrypted in transit, and sensitive data is protected at storage.
• Passwords: not kept in a form from which they can be reconstructed.
• Access control: internal access limited to what is strictly necessary, with two-factor authentication for staff.
• Separation: the data of each client account is kept separate from that of the others.
• Protection against abuse: automated measures against abusive use of the platform.
• Backups: periodic, encrypted, with recovery procedures.
• Logging: sensitive actions are logged, and the log is protected against modification.
• People: confidentiality agreements and restricted access to production.

14. Personal data breach notification (Art. 33-34 GDPR)

If a personal data breach occurs and is likely to result in a risk to the rights and freedoms of natural persons, we notify ANSPDCP within 72 hours of becoming aware (Art. 33 GDPR), unless the breach is unlikely to result in such a risk. Where the risk is high, we notify affected data subjects without undue delay (Art. 34 GDPR), with clear language describing the nature, likely consequences, measures taken and contact for further information. Each event is recorded in our internal breach register, regardless of notification thresholds (Art. 33(5) GDPR).

15. DPIA and accountability

For processing operations likely to result in a high risk, in particular the large-scale processing of public court data, we carry out Data Protection Impact Assessments (Art. 35 GDPR), keep Records of Processing Activities (Art. 30) and periodically review our internal data protection policy, on the review date set out in it. The documents are made available to ANSPDCP on request and, in summary form, to data subjects through the Data Protection Officer.

16. Complaint to the supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). We recommend that you first write to our Data Protection Officer, most situations are resolved within a few working days.

17. Updates to this policy

This policy may be updated to reflect legal or operational changes. Substantial changes are announced at least 30 days in advance through the cookie banner, a message in the application and / or an e-mail to active subscribers. Each version is numbered, dated and archived; previous versions are available from the Data Protection Officer. Continued use of the platform after the entry-into-force date confirms acknowledgment of the new version, without prejudice to your right to object or withdraw consent.