Privacy policy

1 Data controller

The website eVOUCHER is operated by SMART MARKETING CONCEPT S.R.L. (the "Controller").

This Policy explains how we process personal data when you use the Platform, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

2 Processing principles

• Lawfulness, fairness and transparency
• Purpose limitation and data minimisation
• Accuracy and keeping data up to date
• Storage limitation
• Integrity and confidentiality
• Accountability

3 Data we collect

3.1. Provided directly by you:

• Email address (required for an account)
• Name (optional)
• Password (stored encrypted)
• Company data (for company accounts): name, tax ID, trade registry number, website, phone

3.2. Collected automatically:

• IP address, user agent (browser, device)
• Pages visited, time spent, actions (clicks, code copies)
• Cookie identifiers and consent preferences
• Technical events (errors, security logs)

4 Processing purposes and legal bases

5 Cookies and similar technologies

We use cookies for site functionality, preferences, analytics and (optionally) marketing. You can manage your preferences via the consent banner or your browser settings.

Useful links: Chrome • Firefox • Safari • Edge

6 Comunicări (newsletter, notificări)

• You can subscribe to the newsletter (e.g. via the form on the homepage). You can unsubscribe from any email or from your account settings.
• Notificările despre magazine preferate sunt trimise doar dacă ați optat pentru ele și pot fi oprite oricând.
• We do not send commercial communications without your consent.

7 Analytics and advertising

We may use analytics services (e.g. Google Analytics) to measure site usage. The data is aggregated and anonymised. If advertising services are used, they will only be enabled with your consent.

8 Affiliate links and tracking

When you follow a link to a partner store, that store or the affiliate network may place tracking cookies to attribute commissions to eVOUCHER. These cookies do not increase the price you pay and are used for the transparency of our business model.

9 Recipients and processors

• Infrastructure providers (hosting), email services, analytics
• Public authorities, where required by law
• Affiliate networks and partner stores (when accessing links)

We do not sell your personal data and do not share it for marketing purposes without consent.

10 Data retention

• User account: for the lifetime of the account; upon deletion, data is removed within 30 days
• Security logs: 6-12 months, based on legitimate interest
• Cookie preferences: up to 12 months
• Newsletter: until you unsubscribe

11 Data security

• Encrypted transport (SSL/TLS) on all pages
• Passwords stored using modern cryptographic algorithms (bcrypt)
• Role-based access control and the principle of least privilege
• Regular updates of software and dependencies
• Active monitoring of security incidents
• Regular backups with secure storage
• Protection against common attacks (CSRF, XSS, SQL injection)

11.2. Notification of security breaches

In accordance with Art. 33 and 34 GDPR, in the event of a personal data breach posing a risk to the rights and freedoms of data subjects:

• We will notify the ANSPDCP within 72 hours of becoming aware of it
• If the breach poses a high risk, we will inform the affected individuals directly, without undue delay
• We will document all incidents and the corrective measures taken

12 Transfers outside the EEA

If we use providers outside the European Economic Area, transfers will be made with appropriate safeguards (e.g. the European Commission's Standard Contractual Clauses) and risk assessments.

13 Minors

The Platform is not intended for persons under 16. We do not knowingly collect data about minors. If you become aware that a minor has provided us with data, please let us know so we can delete it.

14 Rights of data subjects

• Access — obtaining a copy of your data
• Rectification — correcting inaccurate data
• Erasure — under certain conditions
• Restriction — temporarily limiting processing
• Portability — receiving your data in a structured format
• Objection — to processing based on legitimate interest or marketing
• Withdrawal of consent — for processing based on consent

You can exercise these rights by contacting us at contact@evoucher.ro or via the contact form. We will respond within 30 days.

15 Complaints to the supervisory authority

If you are unhappy with the way we process your data, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): https://anspdcp.ro.

16 Changes to this policy

This policy may be updated from time to time. For significant changes, we will display notices on the site and/or email users subscribed to the newsletter.

17 Automated decisions and profiling

In accordance with Art. 22 GDPR, please note that:

• eVOUCHER does not use fully automated decision-making processes that produce legal effects or similarly significant effects on you.
• We may use algorithms to personalise voucher recommendations based on your preferences and activity, but these recommendations are purely informative and have no legal effects
• You have the right to request human intervention, to express your point of view and to contest any automated decision

18 Digital Services Act (DSA)

In accordance with Regulation (EU) 2022/2065 on Digital Services, we comply with the transparency requirements relating to data processing in the context of content moderation and algorithmic recommendations. For full details on DSA obligations, see the DSA section of the Terms and Conditions.

19 Contact

For any questions regarding the processing of personal data:

Operator: SMART MARKETING CONCEPT S.R.L.