Privacy Policy

1Who we are

The controller of personal data for this platform is [Denumire completă societate] S.R.L., a company registered in Romania with its registered office at [Stradă, număr, oraș, județ], entered in the Trade Register under no. [J__/_____/____], tax identification number [RO________] (“we”, “us”, “the Operator”).

For anything to do with your personal data or this policy, write to us at [contact@domeniul-tau.ro]. We haven't appointed a Data Protection Officer, as our activity doesn't fall within the cases that require one under Article 37 GDPR — your request goes straight to the team that runs the platform.

2What we collect

There are three categories, depending on how you use the platform.

Things you give us directly:

• your email address and password (stored only as a hash) when you create an account;
• your display name and, optionally, a profile picture;
• the details of a business you submit or claim: name, address, coordinates, phone, email, website, opening hours, services, description, photos;
• the content of reviews, ratings and messages you send;
• whatever you write in an email or a contact form you send us.

Things collected automatically when you visit:

• your IP address, browser type and version, operating system, language and device type;
• the pages you view, when you viewed them, and the page you arrived from;
• technical data the site needs to work: your session identifier, your language preference, and the listings you've saved as favourites.

Things from other sources: public information about businesses — name, address, opening hours, public ratings — taken from open sources or mapping platforms and used to fill out directory listings. If you own a business and want that information corrected or removed, write to us at [contact@domeniul-tau.ro].

We don't knowingly collect special categories of data (health, political or religious beliefs, ethnic origin, sex life). Please don't put anything of that kind in a review, a listing description or a message to us.

3Why we process your data, and on what legal basis

Every purpose has a specific legal basis under Article 6 GDPR:

• Running the service — showing the directory, the map, the filters and the listings, creating and managing your account, publishing reviews. Basis: performance of a contract (Art. 6(1)(b)) for account holders; legitimate interests ((f)) in providing a working directory to visitors without an account.
• Moderation and abuse prevention — reviewing submitted listings, rate-limiting automated submissions, blocking spam and unlawful content. Basis: legitimate interests ((f)) in keeping the platform accurate and safe.
• Security and reliability — technical logs, error detection, backups. Basis: legitimate interests ((f)).
• Account communications — confirming your email address, resetting your password, telling you what happened to a listing you submitted. Basis: performance of a contract ((b)).
• Marketing communications, if we ever send any — only where you've opted in, and you can unsubscribe in one click. Basis: consent ((a)).
• Legal obligations — accounting and tax records, and responses to lawful requests from authorities. Basis: legal obligation ((c)).

Where we rely on consent, you can withdraw it at any time. That doesn't affect the lawfulness of anything we did before you withdrew it.

4Cookies and similar technologies

We use a small number of cookies and browser storage entries, all of them strictly necessary: keeping you signed in, remembering the language you chose, and keeping the listings you've saved as favourites. These don't require prior consent, because without them the service can't do what you've asked it to do.

We don't use advertising cookies and we don't build advertising profiles. If we ever add analytics or marketing tools, we'll ask for your consent through a banner before switching them on, and we'll update this section.

You can delete or block cookies in your browser settings at any time — but blocking the strictly necessary ones may stop you signing in or using some features.

5Who we share it with

We don't sell, rent or trade personal data. We share it only with the providers that help us run the platform, as processors, contractually bound to handle it solely on our instructions:

• our database and authentication provider (Supabase) — hosts accounts, listings and published content;
• our hosting and delivery provider (Vercel) — serves the pages and keeps technical access logs;
• our map tile provider — delivers map tiles to your browser, which means your IP address is visible to it;
• our transactional email providers — send confirmation, password-reset and notification messages.

We may also disclose data to public authorities where the law requires it, and to our professional advisers (legal, accounting) under a duty of confidentiality. If the business is reorganised or transferred, data may pass to the acquirer, with prior notice to the people concerned.

Remember that what you publish yourself — reviews, your display name, the details of a listing you've claimed — is public by nature and visible to any visitor, search engines included.

6Transfers outside the European Economic Area

We prefer providers that store data in the European Union. Some of them may nonetheless process data outside the EEA, particularly in the United States. Where that happens, the transfer relies on the safeguards in Chapter V GDPR — usually the Standard Contractual Clauses adopted by the European Commission, or an adequacy decision covering that provider. You can ask us for a copy of the safeguards that apply by writing to [contact@domeniul-tau.ro].

7How long we keep it

Only as long as the purpose requires:

• account data — for as long as the account exists, plus 30 days after you ask us to delete it, so the deletion can be reversed if it was a mistake;
• reviews and published content — for as long as they stay published; when you delete your account we may anonymise them instead, so they remain useful to other users;
• submitted and rejected listings — up to 12 months, to stop the same content being resubmitted over and over;
• technical and security logs — normally no more than 12 months;
• email correspondence — up to 3 years after the last message;
• records required by tax and accounting law — for the periods the law prescribes.

8Your rights

As a data subject, the GDPR gives you the following rights:

9How to exercise them

Send your request to [contact@domeniul-tau.ro] from the email address linked to your account. We'll reply within one month of receiving it; for complex requests that can be extended by two months, in which case we'll tell you why within the first month. Exercising your rights is free — though for manifestly unfounded or excessive requests we may charge a reasonable fee or refuse to act, giving our reasons.

If we can't confirm who's asking, we may request further information — only as much as we need to avoid handing your data to someone else.

If you believe we've infringed your rights, you can complain to the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest) or go to court. We'd appreciate hearing from you first, though — most things we can put right directly.

10Security

We apply technical and organisational measures appropriate to the risk: all traffic is encrypted (HTTPS), passwords are stored hashed and never in plain text, database access is restricted by row-level security policies, and administrative rights are limited to the people who need them. We take regular backups.

No system is completely secure, though. If a data breach occurs that is likely to result in a high risk to your rights, we'll tell you without undue delay and notify the supervisory authority within 72 hours, as Articles 33-34 GDPR require.

11Children

The platform isn't intended for anyone under 16 and we don't knowingly collect their data. If you become aware that a child under 16 has given us personal data without a parent's or guardian's consent, write to [contact@domeniul-tau.ro] and we'll delete it promptly.

12Automated decisions and profiling

We don't make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The way directory results are sorted and filtered follows technical criteria — relevance, distance, category, public ratings — and doesn't amount to profiling within the meaning of Article 22 GDPR.

13Third-party links and services

The platform links to the websites of listed businesses and integrates third-party services such as maps. This policy doesn't cover what those sites and services do with your data — please read their own privacy policies before giving them anything.

14Changes to this policy

We may update this policy as the platform develops or as legal requirements change. When the changes are significant we'll update the “last updated” date on this page and, where it's appropriate, let you know by email or with a notice on the platform. It's worth checking back from time to time.

15Contact

Questions about your data or about this policy? We're happy to help.