Privacy Notice

Version 1.0-draft · Effective: [to be set at launch] · Reviewed at least annually and upon any change in processing.

Who we are

Aequitas EU Market Passport is operated by Digital Aequitas Strategy S.R.L., [registered office placeholder], Romania ("we"). We act as controller for the processing described here. Privacy contact: office@digitalaequitas.ro. We have not appointed a Data Protection Officer; a privacy contact is designated instead, as permitted where a DPO is not legally required.

What we process

Account data (name, business email, organisation, role); company profile data you enter about your business; assessment answers, including descriptions of goods, services, works and AI/LLM systems; uploaded documents; generated reports and risk scores; support requests; billing data; technical logs and audit trails; cookie and analytics data subject to consent.

Why and on what legal basis

Providing the service and generating assessments — performance of a contract (Art. 6(1)(b) GDPR). Security, audit logging and service improvement — legitimate interests (Art. 6(1)(f)), balanced against your rights. Optional analytics and marketing — consent (Art. 6(1)(a)), which you may withdraw at any time. Legal obligations, including accounting — Art. 6(1)(c).

AI-assisted processing

Parts of the assessment pipeline may use AI systems, including third-party large language model providers. Where this happens we tell you before input is sent, AI-generated sections of reports are marked as such, confidence levels and legal-source traceability are included, and human professional review is always recommended. Your inputs are not used to train third-party models unless the subprocessor contractually confirms no-training processing. You may request human review of any AI-assisted output that affects you.

Recipients and transfers

We use subprocessors listed at /legal/subprocessors (hosting: [hosting provider placeholder]; LLM provider: [LLM provider placeholder]; payments: [payment processor placeholder]). Where data leaves the EU/EEA we rely on adequacy decisions or Standard Contractual Clauses with transfer impact assessments; details in the International Data Transfer section of the Trust Center.

Retention

Account data: for the life of the account plus [x] months. Assessment data and reports: until you delete them or [x] months after account closure. Audit logs: [x] months. Billing records: as required by tax law. The full retention schedule is displayed in the privacy dashboard.

Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, exercisable in-app (download my data, delete my account) or via office@digitalaequitas.ro. You may lodge a complaint with your supervisory authority; our lead contact point is ANSPDCP (Romania).

Version

Version 1.0-draft. This notice must be reviewed by qualified counsel before launch.