Privacy Policy and Personal Data Processing

The data controller for the e-Chantier platform is MAREA INCARCARE S.R.L.

Regarding employee data entered by the Client Company, MAREA INCARCARE S.R.L. acts as Processor, and the Client Company acts as Data Controller, under Art. 28 GDPR.

• Identification data: First name, last name, phone number, email address, photograph, national ID number (optional)
• Financial data: Gross/net salary, social contributions, expenses, bonuses, deductions
• Professional data: Role, assigned site, daily attendance, hours worked, leave, absences
• H&S data (health and safety): Assigned protective equipment, H&S records, medical fitness
• Documents: Employment contracts, identity documents, certificates, authorisations
• Technical and usage data: IP address, timestamp, browser user-agent, pages/modules accessed in the app, authentication events, onboarding progress, plan/hosting preferences

• Art. 6(1)(a) — Consent: For processing photographs, biometric data and marketing communications.
• Art. 6(1)(b) — Contract performance: For providing Platform services to the Client Company.
• Art. 6(1)(c) — Legal obligation: For payroll, attendance and tax reporting data (Labour Code, Tax Code).
• Art. 6(1)(f) — Legitimate interest: For Platform security, fraud prevention, service improvement.

For special categories of data (Art. 9 GDPR — health/H&S data): basis is Art. 9(2)(a) — explicit consent, and Art. 9(2)(b) — obligations in employment law.

• User account administration and authentication
• Attendance management and payroll calculation
• Site management and resource allocation
• Protective equipment management (H&S)
• Financial and accounting reporting
• Personnel document management
• Communication with users (support, notifications, updates)
• Improving Platform functionality
• Recording in-app activity logs (security, support, abuse detection)
• Compliance with legal obligations (labour inspection, tax authority, labour inspectorate)

After the retention period expires, data is automatically deleted or irreversibly anonymised.

• Right of access (Art. 15): You may request a copy of all personal data we hold.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): You may request deletion of data, except where retained by legal obligation.
• Right to restriction (Art. 18): You may request limitation of processing in certain circumstances.
• Right to portability (Art. 20): You may request data in a structured, commonly machine-readable format (CSV/JSON).
• Right to object (Art. 21): You may object to processing based on legitimate interest.

Response deadline for requests: maximum 30 calendar days from receipt of the request.

• Encryption in transit (TLS/SSL) for all communications
• Encryption at rest for the database
• Role-based access (RBAC) — each user sees only data matching their permissions
• Secure authentication with time-limited sessions
• Regular data backups
• Access monitoring, IP logging and in-app activity logging (pages accessed, login)
• Servers are located in the European Union

Personal data is stored primarily on servers located in the European Union.

An exception applies to data strictly necessary for payment processing and secure identity verification (KYC), which are transferred and processed through Stripe's global infrastructure (including the United States).

This transfer is legally covered by Standard Contractual Clauses (SCC) approved by the European Commission and Stripe's certification under the EU-U.S. Data Privacy Framework (EU-U.S. DPF), ensuring a level of protection equivalent to that in the European Union.

We do not sell or rent personal data. Data may only be shared with:

• Cloud infrastructure providers (sub-processors with signed DPA) — for storage and processing
• Payment processors and KYC verification — Stripe Payments Europe, Ltd. (sub-processor strictly for operating subscriptions and secure verification of administrators' identity).
• Public authorities — only when legally required (tax authority, labour inspectorate, courts)
• Client Company — the company administrator has access to their employees' data

• In the event of a security breach, the National Authority (ANSPDCP) will be notified within a maximum of 72 hours.
• Affected data subjects will be notified without undue delay if the breach poses a high risk.
• The Client Company will be informed immediately of any security incident.

Consent may be withdrawn at any time without affecting the lawfulness of processing before withdrawal.

Withdrawal can be made by:

• Contacting support through the platform
• Written request to the Operator's email address

Note: Withdrawing consent for essential processing may make it impossible to use the Platform.

• Essential cookies: Required for authentication and Platform operation (no consent required)
• Functional cookies: Store preferences (language, visual theme)
• Analytics cookies: Measure usage to improve the service

Cookie preferences can be managed from the cookie banner shown on first visit.

National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest
• Website: www.dataprotection.ro

You have the right to lodge a complaint with the ANSPDCP if you believe your rights have been violated.

This policy may be updated periodically. The current version will always be available on the Platform. Significant changes will be notified and may require re-acceptance.

As part of providing the SaaS service, we process the following additional categories related to the Client Company account and its users:

• Connection data: IP address (at registration, login and use), timestamp, user-agent;
• Activity log: modules/pages visited in the app, authentication events, onboarding progress;
• Account configuration: country/city at registration, tax settings from onboarding, plan and hosting preferences.

Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(f) GDPR (legitimate interest: security, support, abuse prevention, service improvement). For certain optional processing (e.g. marketing), separate consent is requested.

Access: authorised e-Chantier staff for platform administration; not sold to third parties. The Client Company may request information about its own activity log through support.

Duration: as per the table in section 5 (activity log: max. 24 months).

To ensure a secure business ecosystem, prevent fraud and guarantee the authenticity of tenders organised on the e-Chantier platform, we require identity verification of legal representatives or company administrators. This processing is carried out on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the security of transactions on the platform.

1. Third-party operator and data collected The identity verification process is fully outsourced and performed through the secure infrastructure of Stripe Payments Europe, Ltd. (“Stripe”). For validation, Stripe will collect:

• A copy of an official identity document (national ID card or passport);
• Biometric data, through a facial scan (selfie), strictly for the physical authenticity test (Liveness Check). Biometric data processing (Art. 9 GDPR) is carried out exclusively on the basis of your explicit consent given before initiating the process.

2. “Zero-storage” guarantee at e-Chantier level e-Chantier does not store, download or view copies of your identity documents or biometric data. The flow takes place exclusively between your device and Stripe's encrypted servers. e-Chantier receives from Stripe only an electronic confirmation status (“Verified: Yes/No”).

3. Data retention by Stripe Under their security policies, Stripe retains biometric data for a maximum of 1 year, and identity documents for up to 3 years for KYC/AML legal compliance. For more details, see Stripe Privacy Policy and Stripe Identity Privacy Center.

Each user may request deletion of their personal account from Settings → Security → Delete my account. Upon confirmation:

• identification data (name, username, email, phone) are irreversibly anonymised;
• login credentials and active sessions are removed;
• an immutable entry is written to the data retention audit log (action type, anonymised fields, summary of retained records, 10-year expiry clock).

Data not deleted: under Romanian tax and accounting law, the following remain locked at company level for up to 10 years: issued invoices, invoice payments, e-Transport records, Netopia payment configuration and marketplace inquiries linked to fiscal obligations.

Company administrators may delete employee accounts subject to the same rules (e.g. cannot delete the last active administrator while the company account is active; cannot delete while unpaid Netopia payment links are pending).

After the statutory retention period, retained records are deleted or anonymised according to internal procedures. For questions: [email protected].

Portability (Art. 20 GDPR): from Settings → Security you can download a JSON file with your profile, active sessions, recent activity and retention metadata.

Online payments: invoice payment links and marketplace split payments use NETOPIA Payments; card data is not stored in e-Chantier (PCI SAQ-A).

MFA: company administrators and platform super-admins may enable two-factor authentication (TOTP) in Settings → Security.

Backups: the database is backed up periodically (local + off-server copy); retention is limited per internal policy.

Maistru AI is a conversational assistant based on large language models (LLMs) running on e-Chantier's own infrastructure; no external LLM providers act as subprocessors for this assistant. You are interacting with an artificial intelligence system; responses are generated automatically.

Purpose: operational support (sites, materials, reports, platform data) — it does not replace the judgment of an engineer, accountant, lawyer or your company's legal representative.

Human oversight: verify critical information (budget, attendance, tax, contracts) before taking action. e-Chantier does not guarantee complete accuracy of AI responses.

Classification: in its current form, Maistru AI is treated as a limited-risk system (transparency obligations); it does not make automated decisions with mandatory legal effect on individuals.

Data: questions and selected context are processed on e-Chantier's infrastructure and are not sent to external LLM providers. Conversations may be saved to your account.

Internal technical details: docs/compliance/AI_ACT_MAISTRU.md (available on request for enterprise clients).