PeFirma / Legal

Privacy Policy

How MRD TECH HOLDINGS S.R.L. processes personal data within the PeFirma platform (pefirma.ro and the PeFirma mobile app), in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018.

Last updated: 8 September 2026Versiune în limba română

Language. This is an English translation provided for convenience. The policy is drawn up in Romanian and the Romanian version published at pefirma.ro/privacy is the binding text. In the event of any inconsistency or conflict between the Romanian version and this translation, the Romanian version prevails.

Contents

1. Data controller and contact

The controller of personal data for the PeFirma platform is MRD TECH HOLDINGS S.R.L., CUI 46370311, J40/12152/2022, with its registered office at Str. Covasna nr. 17, Bl. F3, Sc. 1, Ap. 6, Sector 4, Bucharest, Romania (the "Operator", "we", "us"). The Operator also provides, on the same technical infrastructure, the related services Factur (factur.ro), Contabil (contabil.pefirma.ro) and DateFirma (datefirma.ro); this policy concerns PeFirma (pefirma.ro and the PeFirma mobile app).

For any question about data processing or to exercise your rights, you may write to us at gdpr@factur.ro or by post to the registered office address. You can also reach us by telephone at +40 746 666 068.

Data protection officer (DPO). The Operator has not designated a data protection officer, as it does not fall within any of the situations set out in article 37(1) GDPR: it is not a public authority or body, its core activities do not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data or of data relating to criminal convictions. All data-protection requests are to be addressed to gdpr@factur.ro, an address managed by the person internally responsible for data protection, shared by PeFirma and the Related Services (Factur, Contabil, DateFirma).

This policy forms part of the PeFirma Terms and Conditions. Capitalised terms not defined here have the meaning given in the Terms.

2. Our roles: controller and processor

We are a controller for:

the data of your Account and of the other users of the Workspace (identification, authentication, preferences);
billing and payment data for PeFirma subscriptions and data relating to App Store / Google Play purchases;
usage, technical and security data of the Platform and the App;
communications with you (support, notifications, marketing);
data of legal representatives and contact persons of companies, obtained from public sources (for example the Trade Register, ANAF, the Official Gazette) and displayed in the prospect, watch-list and feed sections.

We are a processor (article 28 GDPR) for:

personal data contained in User Data: customers, suppliers, contact persons, document signatories, employees (including data submitted to REGES), persons appearing in fiscal receipts, invoices, bank statements and uploaded documents.

For this data, the controller is the company (entity) that owns the Workspace, which decides why and how it is processed. We process it only on that company's instructions, under the Data Processing Agreement in section 14. Data subjects wishing to exercise their rights in respect of this data should contact the company concerned; we will help them, as far as we can, to identify the controller.

3. Categories of data processed

Account data: first name, surname, e-mail address, password (stored exclusively in encrypted/hashed form), telephone number (optional), identifiers supplied by Sign in with Apple or Google Sign-In (unique identifier, e-mail — including the Apple relay address —, name), role in the Workspace, invitations sent and accepted, preferences, account activity log.

Company data: name, CUI, registration number, address, bank account, details of representatives and directors, logo, invoicing settings, document series, SPV access data (the ANAF authorisation token), REGES connection data.

Billing and payment data: the billing details of the entity or person, payment history, invoices issued by us, the identifier (token) of the card stored with Netopia Payments for recurring payments (we do not store the card number), the transaction and subscription identifiers from the App Store / Google Play (transaction identifier, original subscription identifier, status and expiry date; we do not receive the payment details of the store account).

User Data (as processor): issued and received invoices, pro-forma invoices, customers, suppliers, products, fiscal receipts and their photographs, external supplier invoices and their images, bank statements and transactions, uploaded documents and signed documents (including signatory details and the signing log), employee and employment-contract data (including personal identification number (CNP), salary, position, contract duration — for REGES and timekeeping), human-resources data.

Company data from public sources (prospects, watch-lists, feed): identification details of companies and their representatives, published financial indicators, public events (incorporations, changes, insolvencies), to the extent available in public registers or through DateFirma.

Technical and usage data: IP address, device type, operating system, App or browser version, the device identifier generated by the App for notifications (if you enable notifications), session data, pages and features accessed, access times, error and security logs.

Communications: messages sent to support, complaints, our replies, communication preferences.

Special categories of data: we do not request and do not intentionally process special categories of data (article 9 GDPR). Documents you upload may contain such data (for example, medical certificates in an employee's file); in that case the company that owns the Workspace is responsible for the basis of processing, and we process the data only as a processor.

4. Purposes and legal bases of processing

Purpose	Data	Legal basis (GDPR)
Creating and managing the Account, authentication (including Sign in with Apple / Google), invitations and roles in the Workspace	Account data	Performance of the contract — article 6(1)(b)
Providing the Platform's features (invoicing, e-Factura, documents, REGES, reports, API, etc.)	Company data, User Data	Performance of the contract — article 6(1)(b); for User Data we act as processor
OCR/AI processing of receipts, invoices and documents (data extraction)	Images and text of uploaded documents	Performance of the contract — article 6(1)(b), at your request (the feature is user-triggered)
Collecting subscription fees, recurring payments, issuing invoices, bookkeeping	Billing and payment data	Performance of the contract — point (b); legal obligation (Tax Code, Accounting Law no. 82/1991) — point (c); consent for storing the card — point (a)
Validating and linking subscriptions purchased through the App Store / Google Play to the Workspace	Store transaction and subscription identifiers	Performance of the contract — point (b)
Submitting data to ANAF (e-Factura, e-Transport, SPV) and the Labour Inspectorate (REGES), at your initiative	User Data, SPV/REGES access data	Performance of the contract — point (b); the legal obligations belong to your company, we act as processor
Displaying company information (prospects, watch-lists, feed)	Company data from public sources	Legitimate interest — point (f): transparency of the business environment and informing business partners, using data that is already public
Platform security, fraud and abuse prevention, logging, backups	Technical data, Account data	Legitimate interest — point (f); legal obligation (article 32 GDPR) — point (c)
Error monitoring and improvement of the Service	Technical data, error logs (pseudonymised where possible)	Legitimate interest — point (f)
Support, responding to requests and complaints, contractual notices (payments, changes to the Terms, incidents)	Account data, communications	Performance of the contract — point (b); legitimate interest — point (f)
Commercial communications (newsletter, product news)	E-mail address, name	Consent — point (a) and article 12 of Law no. 506/2004; for existing customers, legitimate interest with a right to object (article 12(2) of Law no. 506/2004). You can unsubscribe at any time from every e-mail.
Non-essential cookies and similar technologies (statistics, marketing) on the website	Online identifiers	Consent — point (a) and article 4 of Law no. 506/2004; details in the Cookie Policy
Compliance with legal obligations (responding to requests from authorities, tax and accounting archiving)	As applicable	Legal obligation — point (c)
Establishment, exercise or defence of legal claims, debt recovery	As applicable	Legitimate interest — point (f)

Providing Account and billing data is necessary for the conclusion and performance of the contract; without it we cannot create the Account or activate a subscription. Where we rely on legitimate interest, we have assessed that it is not overridden by your rights; you have the right to object (section 9). We do not sell personal data and do not use it for behavioural advertising.

Legitimate interest assessment (LIA) — data about companies and their representatives (prospects, watch-lists, feed)

We have carried out the balancing test required by article 6(1)(f) GDPR for the display, in the prospect, watch-list and feed sections, of data about companies and their representatives sourced from public registers and from DateFirma. Its conclusions are as follows:

Purpose: to enable PeFirma users to identify and verify their business partners (customers, suppliers, prospects) and to follow public events concerning them — a legitimate interest of the Operator and of its users, recognised by the principle of transparency of the business environment (Law no. 265/2022 on the trade register, formerly Law no. 26/1990, the Tax Code) and by recital 47 GDPR.
Necessity: the purpose cannot be achieved without displaying the persons who represent the company; processing is limited to what is necessary.
Data — minimal and already public: exclusively the name and role (capacity) of company representatives — director, shareholder, authorised representative — as published in the Trade Register, in ANAF databases or in the Official Gazette. We do not process the personal identification number, home address, personal contact details or other data of these persons, and we do not build profiles.
Reasonable expectations and impact: persons who take on the capacity of company representative can reasonably expect their name and position to be known in connection with the company, that information being public by law; the impact on private life is low and the data is not sensitive.
Safeguards: the data is displayed only to authenticated users, in the context of the company; it is not enriched with data from private sources; systematic extraction is prohibited by the Terms (article 6.2); the data is refreshed from the public sources and removed when it no longer appears there; rectification and erasure requests are handled as a priority.
Right to object: any data subject may object at any time to this processing, on grounds relating to their particular situation, at gdpr@factur.ro; we will cease displaying the data unless we demonstrate compelling legitimate grounds that override (article 21 GDPR).
Consistency with DateFirma: the processing is aligned with the terms and privacy policy of the DateFirma service (datefirma.ro), operated by the same company, from which part of the data originates; the same assessment applies to both services.

5. Recipients of data and processors

We use providers that process data on our behalf (processors / sub-processors) under contracts compliant with article 28 GDPR. Current list:

Provider	Purpose	Country / safeguards
Own servers (MongoDB and Redis databases) managed by the Operator	Hosting of the Platform and the data	European Union
Hetzner Online GmbH	Object storage: invoice archive, documents, images, logos	Germany (EU) — Nuremberg data centre; no transfer outside the EU
Resend, Inc.	Sending transactional e-mails (confirmations, notifications, invoices)	USA — standard contractual clauses (SCCs) and the EU-US Data Privacy Framework, where applicable
Namecheap, Inc. (Private Email)	SMTP server for sending e-mails (notifications, correspondence)	USA — standard contractual clauses (SCCs) adopted by the European Commission
NETOPIA FINANCIAL SERVICES S.A. (Netopia Payments / mobilPay), CUI RO43131360, J2020012763401	Processing card payments and recurring payments for web purchases	Romania (EU); Netopia is an independent controller for payment data
Apple Inc. / Apple Distribution International Ltd.	Sign in with Apple; in-app subscriptions through the App Store (Apple is the seller and issues the receipt)	Ireland (EU) / USA — standard contractual clauses; Apple is an independent controller
Google LLC / Google Ireland Ltd.	Google Sign-In; in-app subscriptions through Google Play (Google is the seller); Google Gemini API for OCR/data extraction from receipts and documents	Ireland (EU) / USA — standard contractual clauses and the EU-US Data Privacy Framework. For authentication and Play, Google is an independent controller. For the Gemini API, Google acts as a processor: the Operator's API account is configured (paid service, with the data-processing terms for the Gemini API) so that the data transmitted is not used to train or improve Google's models
OpenAI, L.L.C. / OpenAI Ireland Ltd.	API for extracting and analysing data from documents	USA / Ireland — standard contractual clauses. OpenAI acts as a processor under the data processing agreement for the API; the Operator's API account is configured so that the data transmitted is not used to train or improve OpenAI's models
Functional Software, Inc. (Sentry)	Monitoring technical errors of the servers and applications	Sentry EU region — data is hosted and processed in the European Union; no transfers to the USA take place for this processing
Google Analytics, Microsoft Clarity, Google Ads (website only, with consent only)	Traffic statistics and campaign measurement	See the Cookie Policy

Public authorities, as independent controllers: ANAF (the RO e-Factura, RO e-Transport and SPV systems) and the Labour Inspectorate (REGES) receive the data you submit through the Platform, at your initiative. We may also disclose data to other authorities (courts, prosecution bodies, ANSPDCP, ANPC) where the law requires us to do so.

Other users of the Workspace: your name, e-mail address and actions within the Workspace are visible to its other members (including the accountant), according to the roles set by the owner. The recipients of the documents you send (customers, suppliers, signatories) receive the data contained in them.

Advisers and successors: we may disclose data, under a duty of confidentiality, to our lawyers, accountants and auditors, and to a potential successor in the course of a reorganisation, merger or sale of assets, with notice to you.

6. International transfers

Data is stored in the European Union (the Operator's own servers and the Hetzner data centre in Nuremberg, Germany; error monitoring through the Sentry EU region). Certain providers (Resend and Namecheap for e-mail, OpenAI and Google Gemini for the OCR/AI features, and Apple and Google for authentication and the stores) may process data in the United States of America or in other third countries. In those cases we ensure that the transfer is based on a European Commission adequacy decision (including the EU-US Data Privacy Framework, for certified providers) or on the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. You may obtain a copy of the applicable safeguards by writing to us at gdpr@factur.ro.

We transmit to the AI providers only the images and text of the documents you choose to process with the OCR/AI features, for the time needed to extract the data; we do not transmit the entire Workspace database.

7. Retention periods

Account and Workspace data: for the term of the contract and 30 days after termination (the export period), then deletion or anonymisation within 90 days at most, subject to the exceptions below. Inactive accounts (no paid subscription and no login) may be closed after 24 months, with prior notice.
User Data (as processor): for the term of the contract and during the export period; then deletion in accordance with section 14. The obligations to archive accounting and tax documents belong to your company, which must export its data before deletion.
Invoices issued by us and our own accounting and tax records: for the period required by Accounting Law no. 82/1991 and the Tax Code (currently, as a rule, 5 years from the end of the financial year, or the longer period provided by law for certain categories of documents).
Payment and subscription data (including App Store / Google Play identifiers): for the term of the contract and thereafter for the general limitation period (3 years) and the applicable tax periods.
Technical and security logs: 12 months from recording, except those needed to investigate an incident, which are kept until the investigation is closed.
Backups: overwritten cyclically; deleted data may persist in backups for no more than 90 days and is not used to restore deleted data on request.
Support communications and complaints: 3 years from closure of the request.
Marketing consent: until withdrawn; the record of withdrawal is kept for 3 years.
Data needed to defend a legal claim: until the dispute is finally resolved or the limitation period expires.

8. Data security

We apply technical and organisational measures appropriate to the risk (article 32 GDPR), including:

encryption of data in transit (TLS) for all communications with the Platform, the API and the App;
storage of passwords exclusively as salted hashes; time-limited token authentication; the option of authentication through Apple and Google;
storage of secrets and access keys in a dedicated key vault, separate from the application and the source code, with restricted access;
logical separation of each Workspace's data and role-based access control;
staff access to production data only on a need-to-know basis, under a duty of confidentiality, with logging;
periodic backups, monitoring of errors and incidents, regular updating of software components;
processing contracts with all providers and assessment of their safeguards.

In the event of a personal data breach likely to result in a risk to your rights, we will notify ANSPDCP within 72 hours and, where the risk is high, inform you without undue delay. Where we act as processor, we notify the company that owns the Workspace without undue delay.

9. Your rights

As a data subject you have the following rights, under articles 15–22 GDPR:

Right of access

To obtain confirmation of processing and a copy of your data.

Right to rectification

To correct inaccurate data or complete it; most data can be edited directly from the account.

Right to erasure

To request deletion of data, except data we must retain by law. You can delete the account from the Platform or the App (Profile → Delete account).

Right to restriction

To restrict processing in the situations set out in article 18 GDPR.

Right to portability

To receive the data you provided in a structured, commonly used format (the Platform's export features).

Right to object

To object to processing based on legitimate interest and, at any time, to direct marketing.

Withdrawal of consent

At any time, without affecting the lawfulness of prior processing (for example, the stored card, the newsletter, cookies).

Automated decisions

The right not to be subject to a decision based solely on automated processing which produces legal effects (we make no such decisions).

To exercise your rights, write to us at gdpr@factur.ro from the e-mail address associated with your account, or by post to our registered office. We respond within one month at most, which may be extended by two months in complex cases, with notice to you. We may request additional information to verify your identity. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

If you consider that your rights have been infringed, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro, and to bring proceedings before the competent courts. We encourage you to contact us first so that we can resolve any issue directly.

10. Automated processing and artificial intelligence

The recognition features for fiscal receipts, invoices and documents use OCR and artificial-intelligence models supplied by Google (Gemini) and OpenAI. When you photograph or upload a document and request processing, its image and text are transmitted to the provider for data extraction (supplier, amount, VAT, date, etc.). The result is displayed as a proposal and requires your validation before it is recorded; it may contain errors.

We do not make decisions based solely on automated processing which produce legal effects or similarly significant effects concerning you or the data subjects (article 22 GDPR). We do not use User Data to train artificial-intelligence models. Our API accounts with Google (Gemini API) and OpenAI (OpenAI API) are configured so that the data transmitted is not used by the providers to train or improve their models; both providers act as processors of the Operator (sub-processors in relation to your company) under the data-processing terms applicable to the API, and process the data only to return the requested result, for the time needed to extract the data. We do not carry out profiling for marketing purposes.

11. Minors

The Platform is intended for professionals and persons aged at least 18 and is not directed at persons under 16. We do not knowingly collect data from minors. If we learn that an account has been created by a person under 16, we will close it and delete the data. Data about minors may appear in User Data (for example, dependants of employees) — for such data the owning company is the controller and we act as processor.

12. Cookies and similar technologies

The pefirma.ro website uses essential cookies (authentication, preferences, consent) and, only with your consent, statistics and marketing cookies, in accordance with Law no. 506/2004. The full list, durations and how to manage your preferences are set out in the Cookie Policy. The mobile app does not use tracking cookies. Pages opened from the PeFirma mobile app set no analytics or marketing cookies and display no cookie consent banner.

13. The PeFirma mobile app (iOS and Android)

Camera and photos: the App accesses the camera or photo library only when you choose to photograph or upload a fiscal receipt or a document, through the operating system's camera app. Images are transmitted to our servers (and, at your request, to the OCR/AI providers) and are not accessed for any other purpose. We do not access the rest of your photo library.
No advertising or tracking SDKs: the App contains no advertising, behavioural-analytics or cross-app tracking SDKs and does not use the device's advertising identifier.
Technical errors: errors occurring in the App's communication with our servers are recorded on the servers and monitored through Sentry (EU region, data hosted in the European Union), with minimal technical data (error type, app version, operating system), in order to fix them.
Notifications: if you enable notifications, we store a device identifier needed to send them; you can disable them from the device settings.
Local session: the App keeps the authentication token and preferences on the device so that you are not asked to sign in on every launch; these are deleted on sign-out or uninstall.
Sign in with Apple / Google: we receive from Apple or Google a unique identifier, the e-mail address (for Apple, possibly a relay address) and the name, solely for authentication. We do not receive the password of your Apple or Google account.
In-app subscriptions: Apple or Google, respectively, processes the payment as an independent controller under its own privacy policies. We receive only the transaction identifiers and the subscription status, to link them to the Workspace and activate the plan.
Account deletion: available from the App (Profile → Delete account) and from the web Platform, as well as by e-mail at gdpr@factur.ro.

14. Data Processing Agreement (DPA) — article 28 GDPR

This section constitutes the data processing agreement between the company that owns the Workspace (the "Customer", as controller) and MRD TECH HOLDINGS S.R.L. (the "Processor") for the personal data contained in User Data. The agreement forms part of the Terms and applies from their acceptance. A signed version may be requested at gdpr@factur.ro.

14.1. Subject matter, nature, purpose and duration of processing

Storage, organisation, display, transmission (to recipients chosen by the Customer and to authorities, at the Customer's initiative), data extraction (OCR/AI), generation of documents and reports, backup and deletion of data, for the purpose of providing the Platform features described in the Terms, for the term of the contract and the export and deletion period.

14.2. Categories of data subjects and data

Customers, suppliers and their contact persons; employees and contractors of the Customer; document signatories; persons appearing in receipts, invoices, bank statements and uploaded documents. Identification and contact data, tax data (CUI, CNP where required by law), financial data (invoices, payments, bank accounts), employment-contract and payroll data, document content, signatures.

14.3. Obligations of the Customer

The Customer warrants that it has a legal basis for processing the data entered in the Platform and for transmitting it to the Processor, that it has informed data subjects in accordance with articles 13–14 GDPR, that its instructions are lawful, and that it is responsible for the accuracy of the data, the configuration of its users' roles and access, and the exercise of data subjects' rights.

14.4. Obligations of the Processor

processes the data only on the Customer's documented instructions (the Terms, the settings and actions in the Platform, written requests), including with regard to international transfers, and informs the Customer if, in its opinion, an instruction infringes the law;
ensures that persons authorised to process the data have committed themselves to confidentiality;
applies the security measures in section 8;
complies with the conditions in 14.5 regarding sub-processors;
assists the Customer, through the Platform's features and, where necessary, through additional reasonable measures, in fulfilling its obligation to respond to data subjects' requests;
assists the Customer in ensuring compliance with the obligations under articles 32–36 GDPR, taking into account the nature of processing and the information available to it; notifies the Customer without undue delay after becoming aware of a personal data breach;
on termination of the services, deletes the data in accordance with article 15.4 of the Terms, after the Customer has had the opportunity to export it, except for data whose retention is required by law;
makes available to the Customer the information necessary to demonstrate compliance with article 28 GDPR and allows for audits, including inspections, conducted by the Customer or an auditor mandated by it, with at least 30 days' notice, at most once a year (or after an incident), during working hours, without affecting the security of other customers, at the Customer's expense; available independent reports and certifications are deemed sufficient to the extent they cover the subject of the audit.

14.5. Sub-processors

The Customer gives general authorisation for the use of the sub-processors listed in section 5 (hosting and storage, e-mail, OCR/AI, monitoring). The Processor will inform the Customer, by e-mail or notification in the Platform, at least 15 days before adding or replacing a sub-processor; the Customer may object, on reasonable grounds relating to data protection, within that period, and if the parties cannot find a solution the Customer may terminate the contract, with a proportionate refund of amounts paid in advance for web purchases. The Processor imposes on sub-processors, by contract, the same data-protection obligations and remains liable to the Customer for the performance of their obligations.

14.6. Liability

The parties' liability under this agreement is subject to article 13 of the Terms, to the extent permitted by article 82 GDPR. Each party is responsible for the administrative fines imposed on it by the supervisory authority for its own infringements.

15. Changes to this policy

We may update this policy when the processing operations, the providers or the legal requirements change. The version in force is published at pefirma.ro/privacy, with the date of last update in the header. Significant changes will be communicated by e-mail or by notification in the Platform or the App at least 15 days before they take effect, except for changes required by law. Previous versions may be requested at gdpr@factur.ro.

Language. This policy is drawn up in Romanian. This English version, available at pefirma.ro/en/privacy, is provided for information purposes. In the event of any inconsistency or conflict between the Romanian version and any translation, the Romanian version prevails.

MRD TECH HOLDINGS S.R.L.

CUI: 46370311 | Trade Register no.: J40/12152/2022

Registered office and place of business: Str. Covasna nr. 17, Bl. F3, Sc. 1, Ap. 6, Sector 4, Bucharest, Romania

Data protection: gdpr@factur.ro

General enquiries: contact@factur.ro

Telephone: +40 746 666 068

← Back to the home page