Last updated: [TO BE COMPLETED: publication date]
Courtesy translation under legal review. The Romanian version is the reference text. Items marked [TO BE COMPLETED: ...] are facts not yet known. Retention periods marked "(proposal)" are business choices to be confirmed.
1. Who we are (data controller)
The controller of personal data is [TO BE COMPLETED: company name], CUI [TO BE COMPLETED: CUI], Trade Register No./EUID [TO BE COMPLETED: number], registered office [TO BE COMPLETED: address], email [TO BE COMPLETED: contact email], phone [TO BE COMPLETED: phone] ("fairlyhome", "we"). Site: [TO BE COMPLETED: domain].
We process data under Regulation (EU) 2016/679 (GDPR), Law no. 190/2018 and Law no. 506/2004 (electronic communications).
Data Protection Officer (DPO): [TO BE COMPLETED/confirmation: not appointed, as not mandatory under art. 37 GDPR; contact for data matters: email].
2. What data we process, why and for how long
| Data category | Examples | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account data | email, password (stored only as a hash), name, profile photo, sign in method and the Google/Facebook account identifier with the data received from them, creation date and date of last sign in, IP address at sign in (security logs), preferred language | creating and managing the account, authentication | contract, art. 6(1)(b) | while the account is active; deleted immediately on account deletion (backup copies within at most [TO BE COMPLETED: 7 days]); authentication security logs: [TO BE COMPLETED: X days] |
| Report requests | property address, map pin, generated reports, details you enter (for example property type, estimated rent) | generating and delivering the report | contract, art. 6(1)(b) | while the account is active; deleted immediately on account deletion (backup copies within at most [TO BE COMPLETED: 7 days]) |
| Orders and invoices | billing name, address, CUI (companies), email, pack, amount, discount and discount code, Stripe identifiers, consents given at payment | order fulfilment, invoicing, accounting records, defending disputes | contract, art. 6(1)(b); legal obligation, art. 6(1)(c) (Law 82/1991, Tax Code); legitimate interest, art. 6(1)(f) (defending rights) | accounting documents: 10 years from the end of the financial year in which they were prepared (art. 25 of Law 82/1991) [TO BE COMPLETED: accountant confirmation]; order email: [TO BE COMPLETED: 3 years] from the order, then deleted |
| Payment data | transaction identifiers, status; we may receive from Stripe the card type and the last 4 digits | payment processing, refunds, fraud prevention | contract, art. 6(1)(b); legitimate interest, art. 6(1)(f) | accounting documents: 10 years from the end of the financial year in which they were prepared (art. 25 of Law 82/1991); full card data never reaches us |
| Partner discount codes | code used, order to which it was applied | applying the discount, calculating the partner's commission, preventing abuse | contract, art. 6(1)(b); legitimate interest, art. 6(1)(f) (settlement with partners) | for as long as the order is kept. The partner does not receive your name or email |
| Communications | name, email, topic, message from the contact form; support correspondence | answering requests, support, defending rights | legitimate interest, art. 6(1)(f); contract, art. 6(1)(b) | [TO BE COMPLETED: 24 months] after last interaction (proposal) |
| Technical data | IP address, date and time, request address, browser and system (user agent), referring page, error codes; in error reports, the account identifier, without passwords, tokens or form contents | security, abuse and fraud prevention, diagnosing errors | legitimate interest, art. 6(1)(f): security and operation of the Service | logs: [TO BE COMPLETED: 30 days]; error reports: [TO BE COMPLETED: 90 days] |
| Cookie choices | choice made in the consent banner | respecting your choices | legal obligation, art. 6(1)(c), read together with art. 4(5) of Law 506/2004 (proof of choice) | 180 days (fh_consent cookie) |
| Marketing (consent only) | email, newsletter subscription | sending commercial communications | consent, art. 6(1)(a) | until consent is withdrawn; proof of consent: [TO BE COMPLETED: 3 years] after withdrawal (proposal) |
| Optional analytics | usage data | statistics | consent, art. 6(1)(a) | not used today (see Cookie Policy) |
| Partners (affiliates) | name, email, phone, partner code, attributed sales; for commission payments: IBAN and, for individuals, CNP and address | running the program, paying commissions, tax obligations | contract, art. 6(1)(b); legal obligation, art. 6(1)(c) (Tax Code, Law 82/1991) for CNP and payment documents | for the duration of participation; tax and payment documents: 10 years from the end of the financial year in which they were prepared (art. 25 of Law 82/1991) |
We ask for your CNP only when you add the details for commission payments. It is stored encrypted and is accessible only to the people who make payments and tax reports. Details in the Affiliate Program Terms. [TO BE COMPLETED: lawyer confirmation on art. 4 of Law 190/2018 and the tax regime.]
We do not use your data for automated decisions that produce legal effects on you (art. 22 GDPR). The report is generated automatically from data sources, but does not include an assessment of you as a person.
Your email, password or Google/Facebook sign in, and your billing data, are needed to create the account, conclude the contract and meet tax obligations. Without them we cannot create the account or issue the invoice. Your display name and profile photo are optional.
3. Where the data comes from
Most data comes from you. If you sign in with Google or Facebook, we receive from them the profile data you allow (usually email, name and photo). Payment data comes from Stripe.
A property address can be personal data when linked to you (for example, where you live or which property interests you). We therefore treat it as such.
If you paste a link to a property listing (Storia, OLX or imobiliare.ro) on the search page, the link is sent to our server, which reads that public page once to prefill the property details (area, rooms, floor, year, address). We keep only these property details, not the seller's contact data, and we cache them for up to one hour. If you paste the text of a listing instead, it is read in your browser and never leaves it.
We do not search for, or show in reports, data about the owners or tenants of properties.
4. Who we share data with (recipients and processors)
We use providers that process data on our behalf under contracts compliant with art. 28 GDPR:
| Provider | Role | Location / notes |
|---|---|---|
| Supabase | database and authentication; authentication emails, until our own email provider is set up | EU region, Frankfurt |
| Google Cloud (Cloud Run, Cloud Logging) | application hosting and its logs | region [TO BE COMPLETED: e.g. europe-west3 Frankfurt] |
| Stripe Payments Europe, Ltd. | card payment processing | Ireland; Stripe may act as an independent controller for its own legal obligations (anti-fraud, AML) |
| [TO BE COMPLETED: SmartBill or Oblio] | invoicing, e-Factura | [TO BE COMPLETED: location] |
| [TO BE COMPLETED: Resend or Brevo] | transactional email | [TO BE COMPLETED: location] |
| Cloudflare | CDN, security, possibly Turnstile (anti-spam) | global, possible transfers outside the EEA |
| Sentry | error monitoring: when the site or the application fails, a technical error report (error message, technical location, browser and system type, page address without parameters) is sent. It contains no cookies, no IP address, no email address, no form content and no identifiers stored in your browser; personal data that may appear in an error text is removed automatically before sending. Legal basis: legitimate interest in the security and stability of the service, art. 6(1)(f) [TO BE COMPLETED: lawyer to confirm] | EU region (Germany); data processing agreement required [TO BE COMPLETED] |
| [TO BE COMPLETED: map provider; under development OpenStreetMap Foundation] | maps and geocoding: your browser downloads map images directly from the provider, which sees your IP address and the area shown; our server sends the provider only the address you entered | [TO BE COMPLETED; OSMF: United Kingdom, adequacy decision] |
| Google and Meta (Facebook) | only as sign in providers, if you choose that method | may act as independent controllers for their own account data |
Payment data goes to Stripe and to the card issuing bank, if a payment is disputed (chargeback). If you use the photo from your Google or Facebook account, your browser loads it directly from their servers, which can see your IP address.
We may also disclose data: to authorities (tax authority ANAF, courts, police) when the law requires; to our advisers (accountant, lawyer), under confidentiality; in a merger or sale of the business, with equivalent safeguards. We do not sell your data.
[TO BE COMPLETED: final list of providers, confirmed before launch.]
5. Transfers outside the European Economic Area
Some providers (Stripe, Google, Meta, Cloudflare, Sentry, Supabase, [TO BE COMPLETED: email provider]) may transfer or access data from outside the EEA, including the USA, for example through technical support or subcontractors, even when the data is hosted in the EU. For the United Kingdom, the European Commission's adequacy decision applies.
We rely on GDPR safeguards: the adequacy decision on the EU-US Data Privacy Framework for certified providers, or the European Commission's standard contractual clauses (SCCs), supplemented with additional measures where needed. You can request a copy of the safeguards at the contact address.
6. Security
We apply reasonable technical and organizational measures: encrypted connections (HTTPS), restricted access, authentication managed by Supabase, environment separation, monitoring. No system is perfectly secure. In case of a data breach presenting a risk, we notify ANSPDCP within 72 hours and inform you where the risk is high (arts. 33 and 34 GDPR).
7. Your rights
Under the GDPR (arts. 15-22) you have the right:
- of access to your data (art. 15);
- to rectification (art. 16);
- to erasure, the "right to be forgotten" (art. 17);
- to restriction of processing (art. 18);
- to data portability (art. 20);
- to object, especially to processing based on legitimate interest and to direct marketing (art. 21);
- not to be subject to a solely automated decision with legal effects (art. 22);
- to withdraw consent at any time, without affecting the lawfulness of earlier processing (art. 7).
How to exercise them: write to [TO BE COMPLETED: personal data email] or use account settings (change name, email, password, photo; delete account). We may need to verify your identity. We reply within one month (art. 12 GDPR), extendable by up to two months for complex requests, with notice to you. The service is free, except for manifestly unfounded or excessive requests.
Limits: we cannot delete data in invoices and accounting records that the law requires us to keep (art. 17(3)(b) GDPR).
Right to object. You can object at any time, on grounds relating to your situation, to processing based on our legitimate interest. We stop, unless we have compelling legitimate grounds or the data is needed for a legal claim. You can object at any time, without giving a reason, to direct marketing.
Facebook users
To delete your data, delete your account in settings or write to us at [TO BE COMPLETED: email]. You can also remove the app's access in your Facebook settings (Apps and websites); this step does not delete your fairlyhome account.
8. Account deletion
You can delete your account in settings. Deletion is permanent and takes effect immediately: the sign in account, profile, profile photo, credit history and reports are removed from active systems. Backup copies are overwritten automatically within at most [TO BE COMPLETED: 7 days].
Orders and payments (pack, amount, discount, data, Stripe identifiers, email used for the order) are kept, detached from your account, for accounting obligations and for defending possible payment disputes, for the periods in section 2. Data on the invoice required by law cannot be removed from the fiscal document. [TO BE COMPLETED: lawyer confirmation.]
9. Cookies and local storage
Details in the Cookie Policy. We do not use statistics or advertising cookies.
10. Children
The Service is not intended for persons under 18 and we do not knowingly collect data from minors. If we learn that we have, we delete the data. If you are a parent and believe a minor gave us data, write to us.
11. Links to other sites
The Service may contain links to third-party sites (for example data sources). We are not responsible for their policies.
12. Complaints to the authority
You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, postal code 010336; website: www.dataprotection.ro; email: [email protected]. [TO BE COMPLETED: verify current address and contact details.] Please contact us first so we can solve the issue, but you are not required to.
13. Changes
We may update this policy. The current version is published on the site with its update date. For important changes we notify you in your account or by email.
14. Contact
[TO BE COMPLETED: company name], [TO BE COMPLETED: address], email [TO BE COMPLETED: personal data email], phone [TO BE COMPLETED: phone].