Privacy Policy – GDPR Assistant România

1. Data Controller

The data controller for the app is GDPR Assistant România, based in Timișoara, Romania. The controller decides the purposes and means of processing the limited personal data described in this policy.

2. Contact

For any privacy request or question, contact us at gdpr.office.consult@gmail.com. We respond within 30 days for GDPR-related requests.

3. Information We Collect

a) Data stored locally on your device: your GDPR audit answers, compliance score, history, action plan, app preferences (logo/theme), and your purchase/unlock status. This data is stored only on your device using the operating system's app storage (AsyncStorage / encrypted SecureStore) and is not transmitted to our servers.

b) Technical data processed by our servers: when you load the online document library or download a document, your device connects to our backend. Standard server logs may briefly record technical data such as IP address, timestamp and the requested resource, for delivery, security and abuse prevention.

c) Purchase data: in-app purchases are processed entirely by Google Play Billing (see section 6). We do not receive or store your payment card details.

We do not collect your name, precise location, contacts, photos, advertising identifiers, or biometric data. We only receive your email address if you choose to email us directly.

4. How Information Is Used

We use information solely to: provide the on-device audit and document-library features; deliver the document templates you request from our servers; keep the service secure and prevent abuse; respond to support messages you send us; and comply with our legal obligations. We do not use your data for profiling, advertising or automated decision-making.

5. Legal Basis Under GDPR

Performance of a contract – Art. 6(1)(b): delivering the documents and features you request.

Legitimate interests – Art. 6(1)(f): maintaining the security and integrity of our service (e.g. short-lived server logs).

Legal obligation – Art. 6(1)(c): accounting/tax record-keeping for paid documents where applicable.

Consent – Art. 6(1)(a): only when you contact us voluntarily or explicitly opt in.

6. Purchases Made Through Google Play Billing

All in-app purchases (individual document unlocks and the complete premium package) are processed exclusively through Google Play Billing. Google acts as the merchant/processor and handles your payment; we never see, receive or store your card or payment details. On your device we keep only a local record that unlocks the content you purchased. Your purchases are linked to your Google account and can be restored on your devices via Google Play. Google's own Privacy Policy governs the payment processing.

7. Authentication

The app does not require you to create an account, log in, or sign in with any social provider. No username, password or authentication profile is created or stored. You can use the app's features without providing identifying information.

8. Generated Documents

The GDPR document templates you preview or download are either generated on your device (PDF) or streamed from our servers (Word/PDF). Any information you type to adapt a template to your organisation stays on your device or within the file you save locally — we do not receive, view or store your customised documents.

9. Device Information

We do not collect persistent hardware identifiers such as IMEI, MAC address or advertising ID, and we do not track your device across apps. For internal app functionality the app may store a random, locally-generated key on your device; it is not a hardware identifier, is not linked to your identity, and is not used for tracking.

10. Analiză și statistici de utilizare (Firebase Analytics)

Aplicația utilizează Google Firebase Analytics, un serviciu de analiză furnizat de Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Irlanda) și Google LLC, pentru a înțelege modul general în care este utilizată aplicația și pentru a îmbunătăți serviciul.

Evenimente standard colectate automat de SDK-ul Firebase: first_open, session_start, app_update, user_engagement. Acestea includ date agregate precum durata sesiunii, versiunea aplicației, tipul de dispozitiv și sistemul de operare, țara/regiunea aproximativă și un identificator de instanță al aplicației generat de Firebase. Aceste date sunt agregate și nu te identifică direct.

Evenimente personalizate implementate de noi: audit_started; audit_completed (parametri: score și risk_level — valori agregate); document_viewed (document_id); purchase_button_clicked (product_id/document_id, după caz); bundle_viewed; bundle_purchase_clicked (product_id); purchase_success (product_id).

Prin evenimentele personalizate NU trimitem către Firebase Analytics: numele, adresa de e-mail, CUI-ul, datele firmei, răspunsurile individuale din audit, conținutul documentelor generate sau alte date personale.

Firebase Analytics poate colecta identificatori tehnici (de ex. Firebase installation ID / app instance ID) și informații despre dispozitiv și utilizare conform configurației implicite a SDK-ului. Google, în calitate de furnizor, poate prelucra aceste date, inclusiv în afara Spațiului Economic European, pe baza unor garanții adecvate (Clauze Contractuale Standard).

Temei legal: interesul nostru legitim (art. 6(1)(f) GDPR) de a îmbunătăți și securiza serviciul; acolo unde legea impune consimțământul, acesta va fi solicitat.

Informațiile Google privind confidențialitatea sunt disponibile la: policies.google.com/privacy, modul în care Google folosește datele și firebase.google.com/support/privacy.

11. Cookies

The mobile app does not use advertising or tracking cookies. This web-hosted Privacy Policy page sets no cookies and loads no trackers. The app uses local device storage only to provide the functionality described in this policy.

12. Third-Party Services

Google Play & Google Play Billing – for app distribution and payment processing; Google's Privacy Policy applies to those activities.

Google Firebase Analytics (Google Ireland Limited / Google LLC) – usage analytics used to understand and improve the app (see section 10); Google's Privacy Policy applies.

Our backend hosting provider – serves the online document files and this policy page.

We do not share data with advertising networks or data brokers.

13. Data Retention

On-device data (audit, history, preferences, unlock status): kept until you clear the app's data or uninstall the app.

Server logs: retained only for a short period for security purposes, then deleted or anonymised.

Accounting records for paid documents: retained where legally required (up to 10 years under Romanian Law 82/1991), primarily through Google Play's billing records.

14. Security Measures

We use HTTPS/TLS encryption for all network traffic, encrypted on-device storage (SecureStore) for sensitive keys, data-minimisation (we collect as little as possible), and access controls on our backend. In the event of a data breach affecting personal data we hold, we will notify the competent supervisory authority within 72 hours as required by Art. 33 GDPR.

15. User Rights Under GDPR

You have the right to access, rectification, erasure ('right to be forgotten'), restriction of processing, data portability, objection, and to withdraw consent at any time. Because most data stays on your device, you can exercise many of these rights directly by clearing the app's data or uninstalling it.

For any data we hold, email us at gdpr.office.consult@gmail.com. You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro).

16. Children's Privacy

The app is intended for businesses and professionals and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

17. International Transfers

We process data within the EU/EEA wherever possible. Where a third-party provider such as Google processes data outside the EEA, that transfer is protected by appropriate safeguards under Chapter V GDPR (e.g. Standard Contractual Clauses or an adequacy decision).

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app and the 'Last updated' date below will be revised. Continued use of the app after an update constitutes acceptance of the revised policy.

19. Contact Information

GDPR Assistant România — Timișoara, Romania.

Email: gdpr.office.consult@gmail.com.

Supervisory authority: ANSPDCP, www.dataprotection.ro.