Privacy Policy

1.1 Data provided directly by you

• Identification data: name, surname, company name, Tax ID, registered office address
• Contact data: email address, phone number, mailing address
• Financial data: banking information for payment processing, invoice history
• Authentication data: email address, encrypted password
• Preferences: account settings, communication preferences, preferred language

1.2 Automatically collected data

• Technical data: IP address, browser type and version, operating system, screen resolution
• Usage data: pages visited, time spent on site, actions taken, products viewed
• Cookie data: unique identifiers, session preferences
• Location data: country and city based on IP address (without precise location)

1.3 Data from third-party sources

• Social authentication: data from Google or Facebook account (if you choose this authentication method)
• Payment services: transaction confirmations from Stripe
• Public registries: company data verification from official sources (Tax Authority, Trade Registry)

We use your data for:

2.1 Service provision

• Creating and managing your account
• Processing orders and transactions
• Facilitating communication between Suppliers and Buyers
• Providing technical support and customer assistance
• Issuing and managing invoices

2.2 Platform improvement

• Analyzing user behavior
• Personalizing experience (product recommendations, relevant content)
• Identifying and resolving technical issues
• Developing new features

2.3 Communication and marketing

• Sending notifications regarding account and orders
• Sending marketing communications (only with your consent)
• Conducting satisfaction surveys

2.4 Security and compliance

• Preventing and detecting fraud
• Compliance with legal and tax obligations
• Protecting our legal rights and interests

We process your personal data based on the following legal grounds under GDPR:

We may share your data with the following categories of third parties:

4.1 Business partners on the platform

Data necessary to complete transactions is shared between Suppliers and Buyers (contact details, delivery addresses, billing information).

4.2 Service providers

• Payment processors: Stripe, PayPal
• Hosting services: furnizor VPS, Upstash
• Email services: Resend
• Analytics services: Google Analytics, Sentry
• Authentication services: Google, Facebook
• Stocare imagini: Cloudinary

We use the following processors with appropriate GDPR safeguards (EU Standard Contractual Clauses or the EU-US Data Privacy Framework):

• Stripe (Ireland) — card payments and subscriptions
• PayPal (Luxembourg) — alternative payments
• Cloudinary (US, DPF) — storage and delivery of user-uploaded images
• Self-hosted SMTP (mail.e-furnizori.ro / VPS) — transactional email
• Sentry (US, DPF) — application error monitoring
• Upstash (EU - AWS Ireland) — rate limiting and caching
• Google / Google Analytics (US, DPF) — social login, Consent Mode v2 enabled
• Meta / Facebook (US, DPF) — social login
• ANAF (Romania) — electronic invoice filing as required by Romanian tax law

4.3 Authorities

We may disclose data to authorities (Tax Authority, courts, police) when legally required or to protect our rights.

4.4 Contractual guarantees

All our service providers are contractually obligated to comply with GDPR standards and implement adequate security measures.

Your data is primarily stored in data centers within the European Union. If data transfer outside the EU is necessary (for example, for Google or Stripe services), we ensure that:

• The destination country benefits from an adequacy decision from the European Commission, or
• EU-approved standard contractual clauses are implemented, or
• The recipient is certified under the EU-US Data Privacy Framework

For more information about the safeguards applied, you can contact our Data Protection Officer.

We implement technical and organizational measures to protect your data:

6.1 Technical measures

• SSL/TLS encryption for all communications with the platform
• Password encryption using modern algorithms (bcrypt)
• Firewalls and intrusion detection systems
• Regular backups and data redundancy
• 24/7 infrastructure monitoring

6.2 Organizational measures

• Role-based data access restrictions
• Staff training on data protection
• Internal security policies and procedures
• Confidentiality agreements with employees
• Periodic security audits

6.3 Incident notification

In case of a data security breach that may affect you, we will notify you without undue delay, in accordance with GDPR requirements.

Under GDPR, you have the following rights regarding your personal data:

How to exercise your rights: You can send a request to dpo@e-furnizori.ro or through your account settings. We will respond within 30 days.

Right to lodge a complaint: If you believe your rights have been violated, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): www.dataprotection.ro

The e-furnizori platform uses cookies and similar technologies to improve user experience.

8.1 Types of cookies used

8.2 Cookie management

On your first visit to the platform, you will be asked about your cookie preferences. You can change these preferences at any time from your browser settings or account control panel.

8.3 Disabling cookies

Most browsers allow disabling cookies from settings. Note that disabling essential cookies may affect platform functionality.

We keep your data only as long as necessary for the purposes for which it was collected:

After the retention period expires, data is permanently deleted or irreversibly anonymized.

For any questions or concerns regarding the protection of your personal data, you can contact the Data Protection Officer (DPO):

We will respond to your requests within a maximum of 30 days. In complex cases, this period may be extended by an additional 60 days, with prior notification.