General Terms and Conditions

„Certification Practice Statement" hereinafter referred to as "CPS", means the sum of practices, procedures and controls used by Simplifi in providing trust services, including certificate issuance, identity verification, key management, and certificate revocation, publicly available at www.simplifi.ro/policies.

„eIDAS" means Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;

„Electronic Document" means any content stored in electronic format, in particular text or audio, video or audiovisual recordings;

„Electronic Timestamp" means data in electronic format which links other data in electronic format to a specific point in time, establishing evidence that the latter data existed at that time;

„GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation);

„Personal Data" means any information about an identified or identifiable natural person ("Person"); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more elements specific to the physical, genetic, mental, economic, cultural or social identity of that person;

„PKI Disclosure Statement" hereinafter referred to as "PDS", means a public statement intended to be an additional and simplified instrument of Simplifi for Subjects and Subscribers, regarding the appropriate use of trust services provided by Simplifi;

„Qualified Certificate for Electronic Seals" means a certificate issued by a qualified trust service provider to a legal person, intended for the creation of qualified electronic seals and meeting the requirements set out in Annex III to eIDAS;

„Qualified Certificate for Electronic Signatures" means a certificate for electronic signatures issued by a qualified trust service provider and meeting the requirements set out in Annex I to eIDAS;

„Designated Person" means a natural person Subject identified in relation to a legal person Subject, who holds the legal right of representation of that entity and who requests the issuance of a qualified certificate for electronic seals on its behalf.

„Qualified Electronic Signature" means an advanced electronic signature that is created by a qualified electronic signature creation device and which is based on a qualified certificate for electronic signatures, issued by a qualified trust service provider;

„Qualified Electronic Signature Creation Device" means an electronic signature creation device that meets the requirements set out in Annex II to eIDAS;

„Qualified Electronic Seal" means an electronic seal created by a qualified seal creation device (QSCD) and which is based on a qualified certificate for electronic seals issued by a qualified trust service provider, in accordance with Annex III to eIDAS. A qualified electronic seal confirms the origin and integrity of electronic data associated with a legal person and benefits from the presumption of correctness under Article 35(2) of eIDAS.

„Qualified Trust Service" means all and any of the qualified trust services provided by Simplifi as a qualified trust service provider, with respect to the issuance, administration, suspension, revocation, renewal and validation of qualified digital certificates, in accordance with eIDAS and the corresponding European and/or national legislation in force, as well as all other additional services mentioned on www.simplifi.ro.

„Qualified Electronic Timestamp" means an electronic timestamp that meets the following requirements:

• it links the date and time to data in such a manner as to reasonably preclude the possibility of the data being changed undetectably;
• it is based on an accurate time source linked to Coordinated Universal Time (UTC); and
• it is signed using an advanced electronic signature or sealed with an advanced electronic seal of the qualified trust service provider, or by some equivalent method.

„Simplifi Certification Policy" hereinafter referred to as "CP", means the certification policy of the Simplifi certification authority, publicly available at www.simplifi.ro/policies.

„Subscriber" means a natural or legal person who orders and bears the cost of the trust service provided by Simplifi. The Subscriber may be the same person as the subject or may be a different entity.

„Subject" means a natural or legal person, or a natural person representing another natural or legal person, who uses trust services or electronic identification means;

All other definitions included in eIDAS apply, as well as definitions from applicable legislation and definitions mentioned in the CPS and CP.

2.1. This document presents the general terms and conditions for qualified trust services provided by Simplifi and ordered by the Subscriber and/or Subject.

2.2. Simplifi provides qualified trust services in accordance with the applicable CPS and CP, which are considered part of these terms and conditions.

2.3. By submitting a request for qualified trust services to Simplifi, the Subject / Designated Person / Subscriber unconditionally accepts these Terms and Conditions. Simplifi shall not provide the requested qualified trust service if the Subject does not comply with the identification procedures in accordance with applicable national law and/or if the Subject does not accept these Terms and Conditions. Simplifi shall also not provide the requested qualified trust service if the Subject, for objective reasons, cannot be identified or verified at the level of assurance required by applicable law, the CPS, CP, and Simplifi procedures. Such situations may arise, by way of example, where the identification data or documents provided are incorrect, invalid, expired, incomplete, or inconsistent, cannot be validated through the necessary verification checks, or do not allow the identity to be established at the required level of assurance (for example, discrepancies in identity documents or the use of an invalid personal numerical code (CNP)). In such cases, Simplifi may request that the Subject provide additional information or documents, and the service may only be provided after the issues that led to the inability to identify the Subject have been remedied. Similarly, Simplifi shall not provide the requested qualified trust service if the identified Subject cannot demonstrate their capacity as a Designated Person or their right to represent the Subject that is a legal person, in accordance with the provisions of the Simplifi Trust Services Policy, in particular Chapter 3.2.2 thereof.

2.4. By accepting these General Terms and Conditions, the Subject/Subscriber expressly confirms that:

• acknowledges that the General Terms and Conditions, the Simplifi Privacy Policy and the Privacy Notice on the processing of personal data, the applicable CPS and CP have been provided in a transparent and easy-to-understand manner before the conclusion of the Contract;
• has received, read, understood and accepted these General Terms and Conditions;
• has received, read, understood and accepted the Simplifi Privacy Policy and the Privacy Notice on the processing of personal data;
• has provided Simplifi with valid personal data and information, including the phone number and email address used on a regular basis;
• has full legal capacity and can act on his/her own behalf or on behalf of the Subscriber (if applicable);

This document shall enter into force at the moment it is signed by the Subject / Subscriber of the Qualified Trust Service Agreement, and it is valid for the entire period of the qualified certificate, not exceeding 3 years.

5.5.1. After acceptance of the certificate by the Subject, Simplifi publishes the public key of the certificate in the certificate database, so that the certificate becomes enforceable against third parties. Thus, any interested party can verify the certificate by consulting the electronic certificate database available at www.simplifi.ro.

5.5.2. In case of revocation or suspension, the revocation will be recorded in the certificate database within 24 hours.

5.5.3. Revocation becomes effective immediately after its publication. Simplifi will provide information on the validity or revocation status of qualified certificates to any interested party, for verifying a certificate issued by the Simplifi Certification Authority, by validating it in real time using the OCSP protocol.

6.1. Simplifi undertakes to comply with the provisions of the applicable CP and CPS, as well as the provisions of applicable European and national legislation.

6.2. The main obligations of Simplifi are:

• to comply with the general terms and conditions mentioned in this document, as well as all applicable policies and practices published on www.simplifi.ro
• not to issue a certificate without prior verification of the identity of the subject, in accordance with applicable national legislation, or without validation of the documents on the basis of which the certificate is issued.
• to ensure the security of computer systems used to provide certification services, using practices universally recognized in the field and recommended by international standards.
• to issue the requested certificate within 5 working days of receiving the correct and complete documentation necessary for the certificate issuance process, unless the Subject and/or Subscriber expressly requests a different date outside the 5 days.
• to create and maintain an up-to-date certificate database.
• to register and make available to any partner entity (which relies on certificates) the Certificate Revocation List (CRL), in accordance with the provisions of the applicable CP and CPS.
• to notify the Subject of (1) the rejection of the certificate issuance request and the reasons for this decision, as well as any remediation if any, (2) the issuance of the requested digital certificate, as well as instructions for its correct use, (3) the validity period of the certificate and (4) the revocation/suspension of the certificate.
• to verify the identity of the applicant requesting revocation and to process revocation and suspension requests within 24 hours of acceptance of these requests.
• to process Personal Data in accordance with the provisions of eIDAS and GDPR, as well as any other applicable legal provisions in force at the date of processing.

6.3. In case of non-compliance with the obligations provided in the applicable legislation on the provision of qualified trust services, Simplifi shall be liable for damages caused intentionally or negligently to any natural or legal person who relies on the legal effects of qualified certificates, only with respect to:

• the accuracy of the information contained in the certificate, at the time of issuance.
• at the time of issuance, the transmission to the Subject of the signature and timestamp creation and validation data.
• the immediate and permanent interruption of access to signature and timestamp creation and validation data, provided that Simplifi has been duly notified.
• all other cases provided in the applicable legislation in force, at the time of issuance.

7.1. "Confidential Information" means any data and/or information, regardless of its nature, disclosed directly and/or indirectly by the Subject to the Provider during the performance of these General Terms and Conditions / the Agreement, as well as any data and/or information that the Parties become aware of and/or have access to during or as a result of the performance of these General Terms and Conditions / the Agreement, regardless of the medium on which such data and/or information is contained or transmitted and regardless of whether or not it is expressly designated as confidential.

7.2. Simplifi undertakes to use the Confidential Information solely for the purpose of fulfilling its obligations under these General Terms and Conditions, to protect such information, and to maintain its confidentiality.

7.3. Simplifi shall be exempt from liability for the disclosure of Confidential Information if one or more of the following conditions are met:

• the information was lawfully known and not subject to any confidentiality obligation prior to being received from the Subject;
• the information was disclosed after obtaining the explicit consent of the Subject for such disclosure;
• Simplifi was legally required to disclose the information.

7.4. Simplifi acts as a controller of personal data.

7.5. Simplifi processes personal data belonging to the Designated Person for the purpose of providing trust services, in accordance with the provisions of Regulation (EU) No 910/2014, Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"), as well as other applicable provisions of European Union law or national law relating to data protection.

7.6. The processing of personal data is carried out in accordance with the Privacy Policy and the Personal Data Processing Notice, available at www.simplifi.ro/policies.

8.1. Simplifi shall in no case be liable for:

• Damages caused as a result of force majeure and/or fortuitous event, which makes it impossible for Simplifi to fulfill its obligations under this Contract. A force majeure event is any absolutely unforeseeable event, independent of the will of the parties, which cannot be prevented in any way (including war, devastating floods, natural disasters, etc., but not limited to). Simplifi will notify the Subscriber of the occurrence of such an event within 48 hours of its occurrence, providing evidence thereof. During the force majeure event, the contract will be suspended. The contract will be automatically terminated if the effects of force majeure last more than 15 calendar days. A fortuitous event is an event that cannot be foreseen or prevented by the Provider. Simplifi will notify the Subscriber of the occurrence of such an event within 48 hours of its occurrence, providing evidence thereof. During the fortuitous event, the contract is suspended. The contract shall be automatically terminated if the effects of the act of God last for more than 15 calendar days.
• damages caused by the installation and use of applications or devices used for the generation and management of cryptographic keys, encryption, creation of electronic signatures, which do not meet the conditions specified in the CPS;
• damages caused by improper use of issued certificates ("improper" means the use of a certificate that is revoked, expired or incompatible with the declared purpose of the certificate);
• damages caused by the storage of erroneous data in Simplifi databases and their inclusion in digital certificates issued to the Subscriber/Subject, where the Subscriber/Subject has declared such data to be correct;
• submission by the Subscriber/Subject of false, inaccurate, incomplete or outdated data and information or false documents and identity papers; in the event that the identity validation process is compromised by the Subject, the Subject shall be solely liable for any damages suffered by the Provider and third parties as a result of the inaccuracy and/or falsity of the information and documents provided;
• damages caused by the theft or unauthorized use of any log-in data or device, or by any kind of negligence of the Subject/Subscriber in storing and using the log-in data.

The situations in (b) – (f) above are the sole responsibility of the Subscriber/Subject.

8.2. To the extent permitted by law, Simplifi shall not be liable for consequential damages, loss of profits or loss of business, customers or data. When such liability applies, it shall be limited to the value of the services provided for each request.

8.3. Where Simplifi's liability applies, the compensation for damages for non-performance or improper performance of any of the contractual obligations assumed (including those caused to persons relying on the qualified certificates) will be limited to the RON equivalent of EUR 200 for each affected certificate or the RON equivalent of EUR 10,000 per claim, irrespective of the number of affected persons.

9.1. General Guarantees applicable to Subscribers

Simplifi offers a guarantee of conformity for the purchased services for the entire validity period. The guarantee period starts from the date of delivery of the digital certificate, i.e. from the date on which the Subscriber can access or use the digital certificate, even if he has not started using it yet. The warranty period offered is 12 months, or throughout the contract period, should such a period be shorter than 12 months.

9.2. Special provisions for the consumer Subscriber

The services covered by this contract comply with the compliance requirements set out in GEO 141/2021 on certain aspects of contracts for the provision of digital content and digital services.

Thus, the services meet the following compliance requirements:

1. comply with the description, quantity and quality, including in terms of functionality, compatibility, interoperability, accessibility, continuity and security or any other characteristic provided for in these General Conditions or normal for services of the same type and which the consumer can reasonably expect;
2. correspond to the purpose for which the consumer requests them, known and accepted by the Service Provider, as well as to the purposes for a normal use of digital services of the same type, taking into account, where applicable, legal provisions or applicable standards;
3. are supplied with all the accessories, provided for in these General Conditions and which the consumer may reasonably expect;
4. are provided with updates in accordance with these General Conditions and which the consumer can reasonably expect to have;
5. are provided in the latest version available at the time of conclusion of these General Conditions;
6. are in conformity throughout their period of performance.

However, Simplifi shall not be liable for non-compliance of the services with the above statements under the conditions set out in Article 7 para. (2), (4) and (6) of GEO 141/2021.

The Subscriber has the right to invoke the legal guarantee of conformity if a lack of conformity occurs within a period of one (1) year from the time of service. The Subscriber shall cooperate with Simplifi to the extent reasonably possible and necessary to determine whether the non-conformity was caused by the Subscriber's digital environment or misuse.

The guarantee of conformity shall entitle the Subscriber to have the service brought into conformity within a reasonable timeframe, not exceeding 15 calendar days from the date of the request, at no cost to and without major inconvenience to the consumer. The consumer has the right to terminate the contract if: i) Simplifi does not bring or refuses to bring the service into conformity, ii) the noncompliance is so serious as to justify the termination of the contract, iii) the service is not yet in conformity despite Simplifi's unsuccessful attempt to bring it into conformity or iv) the bringing into conformity is impossible or disproportionate.

In case of termination of these General Conditions, the consumer no longer has the right to use the service.

9.3. Inapplicability of the withdrawal right

Considering that the qualified digital certificate is both a customized product with a limited validity period, as well as digital content that is not delivered on a material support, the Subscriber expressly acknowledges that they were informed, and they accepted that the withdrawal right provided under Articles 9 – 15 of the GEO 34/2014 shall not apply.

10.1. By signing these Terms and Conditions, the Subject/Subscriber declares that they acknowledged and undertakes the following obligations:

• To provide Simplifi with accurate, complete, and up-to-date information when registering a request for issuing a qualified digital certificate.
• To provide Simplifi with a phone number that will remain exclusively under their control and possession for the validity period of the qualified digital certificate. The Subject is responsible if the mobile phone containing the declared phone number is transferred, lost, or accessed by another person.
• To use only those secure cryptographic devices and software applications approved and recommended by Simplifi.
• To use the qualified digital certificate issued in their name only for its declared purposes and according to its scope, in compliance with the Simplifi CP/CPS. Qualified digital certificates for electronic signature or seals can only be used to perform cryptographic operations such as authentication, electronic signature/sealing, only by the certificate holder. The use of the qualified digital certificate for electronic signatures or seals is prohibited for purposes other than those indicated and permitted by Simplifi, and it is forbidden to use an expired, suspended, or revoked qualified certificate to create electronic signatures or seals.
• To adhere to Simplifi's guidelines and instructions regarding the proper use of qualified digital certificates and the secure cryptographic devices on which they are stored, not to exceed the limitations imposed by these general conditions, and not to transfer the qualified digital certificate to third parties.
• To take all necessary measures to securely store the code and authentication and authorization credentials to prevent their loss, compromise, alteration, and unauthorized use.
• To possess and use the necessary hardware and software resources for using the qualified digital certificates, assuming responsibility for their proper configuration, operation, and compatibility.
• To immediately request the revocation or suspension of the qualified digital certificate from Simplifi in the event of any event specified in chapters "Revocation of a qualified digital certificate" or "Suspension of a qualified digital certificate".
• To securely store the authentication data and devices used for applying the qualified or advanced electronic signature and to refrain from disclosing such data to third parties.
• To request the revocation of the certificate within 24 hours in the following situations: Subject has lost the data used for creating the electronic signature; Subject has reason to believe that the data used for creating the electronic signature has been disclosed to an unauthorized third party; the essential information contained in the certificate no longer corresponds to reality (including any changes in their identification data).
• To comply with these general conditions, as well as the current Simplifi CP/CPS, published at www.simplifi.ro/policies.
• To verify the content of the qualified digital certificate upon receipt and, in case of any discrepancies, to request immediate revocation of the certificate. The certificate is considered accepted by the Subject once it has been issued.
• Not to attempt unauthorized access or any IT intervention on Simplifi's database or equipment in any way or by any means.
• To use qualified trust services in good faith and not to hold Simplifi accountable if such services are used improperly and/or fraudulently.

10.2. Any failure by the Subject to fulfill their obligations will be considered a breach of the general conditions and will result in the revocation of the qualified digital certificates, and Simplifi reserves the right to claim damages.

10.3. The Subject/Subscriber is responsible for the content and nature of the documents on which the qualified electronic signature will be applied.

10.4. By signing / accepting these General Terms and Conditions, the Subject/Subscriber understands and agrees that Simplifi may use the certificate data and make such data available to the public through the public electronic certificate register for the purpose of providing trust services.

10.5. The Subject/Subscriber is personally responsible if the information provided regarding their identity and/or other Personal Data is false, inaccurate, incomplete, or expired, or if they use false identification documents. In such cases, the Subject will be personally liable for all violations mentioned above and agrees to compensate and protect Simplifi, its representatives, successors, and assigns against all liabilities, costs, claims, and direct or indirect damages arising from claims or actions brought by third parties against Simplifi or its representatives, caused by the Subject's actions.

These terms and conditions shall cease in any of the following situations:

1. upon expiration or revocation of the qualified digital certificate;
2. upon rejection of certificate application;
3. upon failure to accept the certificate by the Subject;
4. within 30 (thirty) days of receipt of a notice sent by Simplifi regarding the breach of the obligations assumed by the Subject under the general terms and conditions, provided this violation has not been remedied within this interval.
5. in case of termination of the qualified trust service contract between Simplifi and the Subscriber. If these terms and conditions cease, the revocation of the qualified certificate is being entailed, in the case the certificate remains active.

Termination of the Contract has no effect on the pending obligations between the parties.

Simplifi ensures working days from Monday to Friday between 9 AM and 5 PM, with the exception of Romanian legal holidays.

Any interested party may contact the HelpDesk department available at the number +4 031 82 81 141 or by e-mail at easy@simplifi.ro regarding any information about the qualified trust services provided by Simplifi, as well as for any relevant additional services.

1. All disputes or conflicts arising from the Contract or its execution shall be amicably settled by representatives of the Parties, as per the civil law.
2. In case the amicable settlement of disputes or conflicts fails, the cause shall be referred for settlement to the competent Romanian courts of justice at Simplifi headquarters as per the applicable Romanian legislation in force.
3. The Subject/Subscriber declares they fully understand all the provisions contained in this Contract and expressly accept the clauses under 7, 8.2, 8.3, 9.3 and 13.2.

Any notifications between Parties shall produce legal effects only if made in writing, as follows: by e-mail, by registered mail or by facsimile with delivery confirmation report.