Privacy Notice

1. Who is responsible for your data

The data controller is RUTD CREATIVES SRL, a Romanian limited liability company (SRL) with its registered office at Str. Ajustorului nr. 12, bl. A, et. 9, ap. 103, Sector 6, București, 061041, registered with the Trade Register under no. J40/10973/2024, fiscal code 50169813.

For any question about this notice or your data, write to [email protected] or call 0729 606 685. We have not appointed a Data Protection Officer, as we are not required to; the contact details above handle all data protection requests.

2. What data we collect and why

We collect only what we need to run the service. For each category below we list the data, the purpose and the legal basis under Article 6 of the GDPR.

• Account data. Email address, password (stored only as a one-way hash by our authentication provider, never in readable form), and sign-in records. Purpose: to create and secure your account. Legal basis: performance of a contract (Art. 6(1)(b)).
• Business and card data. Business name, the email of the owner who has access to the dashboard, the Google place ID of the business, card codes and names, where each card points, and the buttons on your card page (for example links to your menu or social profiles, and Wi-Fi details you choose to show). Purpose: to provide the service. Legal basis: performance of a contract (Art. 6(1)(b)).
• Tap and click data. When someone taps or scans a card, or presses a button on a card page, we record the time, whether it came from NFC or a QR code, and the device type (iOS, Android or other), derived from the browser's user agent. We do not record names, contact details or IP addresses for taps. Purpose: to show businesses how their cards are used. Legal basis: our legitimate interest in providing usage statistics (Art. 6(1)(f)).
• Google review data. For businesses that connect their Google Business Profile, we retrieve the business's public reviews from Google: the reviewer's public name and profile photo link, the rating, the review text and the date. We process this data on behalf of the business; see section 6.
• Private messages to a business. If a customer uses the "Tell us directly what we can improve" form on a card page, we keep the message, the card it was sent from, when it was sent and, only if you chose to leave them and agreed to be contacted, your phone number and/or email together with the time you agreed. We do not ask you for a rating. Purpose: so the business learns directly what it can improve and, if you wish, can reply to you. Legal basis: the business's legitimate interest in receiving and resolving complaints (Art. 6(1)(f)) and, for contact details, your consent (Art. 6(1)(a)), which you can withdraw at any time by contacting the business or us. We process this data on behalf of the business; see section 6.
• Demo and quote requests. Name, company name, company email, phone number (optional), your message, the page the request came from and the time you gave consent. Purpose: to answer your request and prepare an offer. Legal basis: your consent and steps taken at your request before entering into a contract (Art. 6(1)(a) and (b)).
• Communications. Messages you send us by email, phone or WhatsApp, and the service emails we send you (invitations, password resets). Purpose: to answer you and operate your account. Legal basis: performance of a contract and our legitimate interest in responding to enquiries (Art. 6(1)(b) and (f)).
• Billing data. Company and invoicing details, and records of what you bought. If we take card payments online, they are processed by Stripe and we never see your full card number. Purpose: invoicing and accounting. Legal basis: legal obligation (Art. 6(1)(c)) and performance of a contract.

We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing, including profiling.

3. Cookies

We use only cookies that are needed for the site to work, which under Law no. 506/2004 do not require consent:

• Sign-in cookies (names starting with sb-), set by our authentication provider to keep you signed in. They last for your session and are refreshed while you use the dashboard.
• recenzio-theme, which remembers whether you chose the light or dark look. It lasts one year.

We do not use analytics, advertising or social media tracking cookies. If that changes, we will update this notice and ask for your consent first.

4. Who we share data with

We share personal data only with service providers that help us run Recenzio, under contracts that require them to protect it and use it only on our instructions:

• Supabase – database, authentication and service emails.
• DigitalOcean – hosting of the website and dashboard, in Frankfurt, Germany.
• Google – the Google Business Profile API (reviews of businesses that connect their profile) and the Places API (finding a business when we set up a new client).
• Stripe – online payments, if you pay by card.
• WhatsApp (Meta) – only if you choose to message us on WhatsApp.

We may also disclose data where the law requires it, for example to tax authorities or in response to a lawful request from a public authority, and to professional advisers bound by confidentiality.

5. Transfers outside the European Economic Area

Some of our providers are based in, or may access data from, countries outside the European Economic Area, such as the United States. Where this happens, the transfer is covered by an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework for certified companies) or by the Commission's Standard Contractual Clauses, together with additional safeguards where needed.

6. Data we process on behalf of businesses

For Google review data, private messages, and tap and click data shown in a business's dashboard, the business using Recenzio decides why that data is processed and is its controller; we act as its processor under Article 28 of the GDPR, on the terms set out in our Terms of Service. If you left a review or tapped a card and want to exercise your rights, you can contact that business directly, or contact us and we will forward your request.

Reviews remain published on Google under Google's own terms. Deleting data from Recenzio does not remove a review from Google.

7. How long we keep data

• Account, business, card, tap and review data – for as long as the account is active. When an account is deleted, this data is deleted from our live systems straight away and disappears from backups when they expire under our providers' backup cycles.
• Private messages from customers – 12 months after they are sent, then deleted automatically. The business can deal with them sooner from its dashboard.
• Demo and quote requests – up to 12 months after the request if no contract follows, so we can follow up; longer only if you become a customer.
• Invoices and accounting records – 10 years, as required by Romanian accounting law (Law no. 82/1991).
• Correspondence – for as long as needed to handle your request and any follow-up, and no longer than 3 years after it ends unless needed to establish or defend a legal claim.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data (the right to be forgotten), where the law allows;
• restrict processing in certain cases;
• data portability – account holders can download their data at any time with Export my data on the Account page;
• object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting processing that took place before.

To exercise any of these rights, write to [email protected]. We will answer within one month, which may be extended by two more months for complex requests; we will tell you if that happens. We may ask you to confirm your identity first.

You also have the right to lodge a complaint with the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro.

9. How we protect data

All traffic to recenzio.ro is encrypted with HTTPS. Passwords are stored only as hashes. Each business's data is isolated at database level, so one account cannot read another's. Access to production systems is limited to the people who need it, and our providers maintain industry-standard security certifications.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority within 72 hours and inform you without undue delay where required.

10. Children

Recenzio is a service for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

11. Changes to this notice

We may update this notice when our service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell account holders by email or in the dashboard before it takes effect.