Privacy policy

1. Data controller

The controller is [denumirea societății], [CUI / J...], registered office at [adresa sediului social].

For anything concerning personal data write to hello@ecomuna.ro. We reply within 30 days at the latest.

2. What data we process

The data depends on your role on the platform.

• Citizens with an account: name, email address, password (stored only as a hash), account creation date, municipalities you subscribed to.
• Announcement subscribers without an account: email address and the municipality followed.
• Local businesses: the contact and presentation details you fill in (name, address, phone, email, description, photos).
• Municipalities: contact person details and the information published on the commune page.
• Citizen reports: report content, category, any photos and the contact details you attach.
• Quote requests: commune name, county, number of inhabitants, contact person, email, phone and message.
• Technical data: IP address and browser type in server logs, needed for security and error diagnosis.

3. Purposes and legal bases

• Creating and managing the account — performance of the contract (Art. 6(1)(b) GDPR).
• Displaying public municipality and business pages — performance of the contract with them.
• Sending email notifications to subscribers — consent (Art. 6(1)(a)), withdrawable at any time from the unsubscribe link in every email.
• Handling citizen reports — performance of the contract and the municipality’s legitimate interest in answering citizens.
• Introductory emails to municipalities — legitimate interest (Art. 6(1)(f)), with a right to object by unsubscribing.
• Invoicing and accounting — legal obligation (Art. 6(1)(c)).
• Platform security and abuse prevention — legitimate interest.

4. Who else has access

We do not sell or rent personal data to anyone. We disclose it only to the providers the platform depends on, acting as processors under data processing agreements:

• The application and database hosting provider (Railway Corp., infrastructure in the European Union).
• Cloudflare R2 — storage of files and photos uploaded to the platform.
• The mail server used for transactional messages and notifications (mail.ecomuna.ro).
• Public authorities, on request, where the law obliges us.

5. Transfers outside the European Economic Area

Processing takes place, as a rule, on infrastructure within the European Union. Where a provider processes data outside the EEA, the transfer relies on the standard contractual clauses adopted by the European Commission.

6. How long we keep data

• Account data — for the life of the account and 30 days after it is closed.
• Subscriber email addresses — until you unsubscribe.
• Unsubscribed addresses — kept indefinitely, solely so that we never write to you again.
• Reports and replies — 3 years after resolution.
• Financial documents — 10 years, under accounting law.
• Server logs — 12 months maximum.

7. Your rights

Under the GDPR you have the following rights, which you can exercise by writing to our contact address:

• Right of access to the data we hold about you.
• Right to rectification of inaccurate data.
• Right to erasure (“right to be forgotten”), subject to law.
• Right to restriction of processing.
• Right to data portability in a structured format.
• Right to object to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of earlier processing.
• Right to lodge a complaint with the Romanian data protection authority (dataprotection.ro) or to go to court.

8. Data security

Traffic is encrypted over HTTPS. Passwords are stored only as hashes, so not even we can read them. Database access is limited to the people who need it to operate the platform.

In case of a personal data breach likely to create a risk to your rights, we notify the authority within 72 hours and, where the law requires, inform you directly.

9. Minors

The platform is not intended for people under 16 and we do not knowingly collect their data. If you learn that a minor has sent us personal data, write to us and we will delete it.

10. Cookies

We use only the cookies needed to run the site, plus those you consent to. Full details and the option to change your choice are in the Cookie policy.

11. Changes to this policy

If we change this policy we publish the new version on this page and update the date at the top. Material changes are also communicated by email.