PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

Registered Office: Titeica Office Building, 3rd floor, District 2, Bucharest
Email: easy@simplifi.ro

Simpliworks SRL, operating under Simplifi brand, having its main place of business in Bucharest, 142 Gheorghe Titeica Street, District 2, registered with the Trade Registry Office under no. J2022006777401, tax code 45938180, is a data controller under Article 4, paragraph 7 of Regulation (EU) 679/2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and the subsequent laws on the matter.

For the purpose of this Privacy Notice on the Processing of Personal Data, "Personal Data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

This note has the purpose of informing you, as data subject, on who we are, how we collect Personal Data, how we share and use Personal Data and how you can exercise your rights regarding the protection of your Personal Data.

Processing involves operations such as data collection, registration, organization, storage, modification, retrieval, search, use, transmission, combination, blocking, limitation, erasure, destruction, archival.

Simplifi may process the following categories of Personal Data, depending on the service:

• Identification Data: name, surname, personal numerical code, identity card number and serial number, address, nationality, expiry date, address and all other Personal Data included in your identity card, a copy of your identity card
• Contact Data: email address, phone number (if applicable);
• Financial Data: such as IBAN, bank services provider (if applicable);
• Employment or representation status: (for seal issuance, if case may be);
• Technical Data: Metadata related to certificates, timestamps, and signature events, authentication and activity logs (IP, timestamps, device IDs);
• Special Category Data: biometric data such as image, voice/video recordings (where applicable for remote identification)
• Any other similar categories of Personal Data derived from the enforcement of signed contractual documentation, the enforcement of the law and any other related processing, regardless of the underlying reason for processing

The processing of your Personal Data as a data subject shall be carried out for the following intents and purposes:

• To provide trust services for the issuance of digital certificates (initial/renewed), the use of the certificate for the electronic signing/sealing of documents by the certificate holder, to deliver the digital certificate, as well as to provide services for the automatic validation of qualified electronic signatures and seals, including the payment of the trust service if applicable, according to Article 6 (1) (b) of GDPR;
• To publish digital certificate data in the Electronic Certificate Database in accordance with Article 6 (1) (b) and (c) of the GDPR, in conjunction with Article 14 of Law 214/2024;
• To confirm validity of an electronic signature certificate, at the request of the holder or at the request of a person whose conduct is based on the trust services provided by Simpliworks or within a judicial procedure, as applicable, pursuant to:
  • article 6 (1) (b) of GDPR for the validation at the request of a data subject or
  • article 6 (1) (c) of GDPR in conjunction with Article 24 (2) (h), (3) (4) of the eIDAS for the validation in other situations;
• To revoke/suspend a certificate according to contractual conditions, according to article 6 (1) (b) of GDPR or as a result of a legal obligation as per article 6 (1) (c) GDPR in conjunction with article 24 (3) (4) of eIDAS;
• To issue the report of automatic validation of qualified electronic signatures and seals;
• To ensure the security of systems and databases according to Article 6 (1) (c) of GDPR in conjunction with Article 24 (2) (e), (f), (i) of the eIDAS;
• To ensure the prevention and/or identification of frauds according to Art. 6 para. (1) letter (c) GDPR in conjunction with Art. 24 para. (2) letter (g) of the eIDAS;
• To comply with regulatory obligations imposed by eIDAS and Romanian law in respect with identity proofing, in the context of processing the biometric information, in accordance with Article 9(2)(a) and Article 9(2)(g) GDPR.
• To ensure compliance with the legal obligations of the Data Controller (e.g. transmission of information that represents Personal Data at the request of the competent state authorities, establishment and permanent update of the database of electronic signature certificates according to Article 6 (1) (c) GDPR in conjunction with the provisions of the eIDAS (Article 24 (2) k);
• To ensure storing the data, for a period of 10 years and 6 months after the expiry of the digital certificate. This data may also be used in the context of legal proceedings, in addition to the purpose of ensuring the continuity of the trust services provided by the Data Controller in accordance with Art. 6 para. (1) lit. (c) GDPR in conjunction with Art. 24 para. (2) lit. (h) of the eIDAS Regulation the Romanian Law no. 214/2024 on the use of electronic signature, time stamp and the provision of trust services based on them, as well as art. 16 paragraph (2) and art. 22 of the ADR Norm;
• To send out newsletters, promotional materials, marketing communications, commercial offers or any other relevant information regarding Simplifi products and services of if you have given your consent in this regard, or recording phone calls to improve our services, according to art. 6 (1) (a) GDPR;
• To pursue the legitimate interests of the Data Controller or a third party, such as for:
  • management of contracts or supporting and accounting documents,
  • audit or verification of internal processes,
  • sending commercial communications relating to products or services similar to those you purchased
  • conducting activities aimed at increasing customer satisfaction and, to this end, questionnaires on customer satisfaction with the services offered by our company and our products or services, sending customer satisfaction surveys by sms or e-mail, to carry out internal performance and efficiency studies, cost studies, to establish performance indicators, studies on the allocation of resources in the relevant markets,
  • resolving requests or complaints and defending the rights of the Data Controller, such as the recovery of claims held by the Data Controller, as per art. 6 (1) (f) of GDPR

The Personal Data processed by Simplifi belong to the following categories of data subjects:

• customers or prospects whose data we shall use to draft offers, execute and perform the contract and provide the services requested by them;
• contact persons designated by contractual partners, their legal or contractual representatives;
• contractors, employees, staff of a public authority, the data of which we shall use to meet our legal obligations;
• candidates to a vacancy in Simplifi;
• visitors of our website www.simplifi.ro or individuals who interacted with any of our social media accounts, and/or other categories of individuals with whom we carry out business (hereinafter collectively referred to as "Data Subjects").

Such Personal Data are contained in the documents submitted to Simplifi when initiating the contractual relationships with contractual partners or in the course thereof.

As a rule, Simplifi does not disclose to other entities the Personal Data it holds and processes about all categories of data subjects.

For the purpose of issuing qualified digital certificates, the Controller may disclose Subjects' Personal Data to third parties relying on the certification services provided by Simplifi, consultants or professional advisers (e.g., accountants, auditors, lawyers), to bailiffs for contractual communications or the enforcement of any court judgments, to debt collection companies, to contractual partners of Simplifi (courier companies, etc), to affiliates of Simplifi, to outsourced service providers, partners who assist the Controller in providing, managing, and improving the services (including but not limited to IT service providers and/or specialized software providers, troubleshooting services, etc.), and/or to other external professional staff, who will be bound by legal or contractual confidentiality obligations.

Subjects' Personal Data may also be disclosed to requesting public authorities, where such disclosure is necessary to comply with an obligation under applicable law, to banking institutions acting as financiers in relation to the Controller, as well as to potential acquirers of the Controller (in the context of audit/due diligence processes), etc.

Disclosure of Subjects' Personal Data for the purposes listed above will be carried out only to recipients who provide sufficient guarantees for the implementation of appropriate technical and organizational measures and for ensuring the protection of the rights of Data Subjects, so that the processing complies with the requirements set out in this Privacy Notice, the applicable legal provisions, and ensures the protection of the rights of Data Subjects.

Currently, we do not transfer data outside the European Economic Area (EEA); our data is kept in storage locations in Romania. In cases that shall require Subjects' Personal Data to be transferred outside EU/EEA, it will be primarily done in manners ensuring adequate protection, and only under GDPR-compliant safeguards. All such transfers shall be carried out securely, and details about the destination countries are available in the Simplifi Privacy Policy or upon request at easy@simplifi.ro.

To meet the goals above, Personal Data will be processed by Simplifi throughout the contractual relationship and after its termination in order to comply with the statutory obligations applicable to this matter, including, but not limited to, provisions on data filing.

We have the legal duty to store data for 10 years and 6 months from the expiry of the qualified digital certificate, in accordance with the applicable legislation in force. Upon expiry of the filing period, data will be irreversibly deleted. Uncompleted applications to obtain / renew certificates shall be kept throughout the said period.

As a data subject, you have the following rights provided by the General Data Protection Regulation (art. 13 – 22 of GDPR):

In most cases, data subjects are under no obligation to disclose their Personal Data. However, your refusal to communicate your Personal Data will make it impossible for us to provide services related to Simplifi's core activities, including the provision of qualified digital certificates.

The rights above may be exercised through an email to easy@simplifi.ro or by submitting a written, dated and signed request to the Personal Data Protection Department of Simplifi, at the address 142 Gheorghe Titeica Street, Titeica Office Building, 3rd Floor, District 2, Bucharest.

To ensure the efficient handling of requests, the context in which the Personal Data was provided to the Controller and the subject of the request should be described in as much detail as possible.

To ensure that the person contacting us is indeed the Data Subject, we reserve the right to verify the identity of the applicant before issuing any type of response regarding the processed Personal Data, in order to maintain the confidentiality of all Personal Data and reduce the risk of unauthorized disclosure.

We will make every effort to respond to any request made under this Privacy Policy within one month from the date of receipt of the request. This period may be extended by an additional two months if necessary, taking into account the complexity and number of requests, in which case you will be informed of any such extension and the reasons for the delay.

The Controller will not charge any fee for handling requests to exercise Data Subject rights under this Section, except where the request for access to information is manifestly unfounded, repetitive, or excessive (even in such cases, the Controller reserves its right to charge the administrative costs associated with such requests).

By using the Simplifi services, you confirm that you have fully read and understood this Privacy Notice regarding the processing of Personal Data, that you agree to the processing of your Personal Data by Simplifi under the conditions described herein, and that you understand and accept that, in certain situations, the exercise of some rights may be limited in accordance with the legal obligations applicable to Simplifi as a Qualified Trust Service Provider under eIDAS Regulation No. 910/2014 and Law No. 214/2024, as well as under GDPR. Continued use of the service constitutes your full acceptance of this Privacy Notice.