Privacy Notice

Version 1.0 · Effective: 4 September 2026 · Reviewed at least annually and whenever processing changes.

Who we are

Aequitas EU Market Passport is supplied by Digital Aequitas Strategy S.R.L., Trade Register no. J2026017841005, EUID ROONRC.J2026017841005, CUI 54278430, with registered office at 42A Semenicului Street, Bocsa, Caras-Severin County, Romania ("DAS", "we"). DAS is the controller for the processing described here. Privacy contact: office@digitalaequitas.ro; telephone: +40 743 006 534. DAS has not appointed a Data Protection Officer because it has not identified a statutory designation requirement for the current processing.

What we process

The current free assessment runs in your browser. Assessment answers, preliminary results and interface preferences are stored locally on your device and are not intentionally transmitted to DAS merely because you complete the assessment. If you purchase a report, request support, submit a cancellation or withdrawal request, or request expert review, we process the business contact, order, billing and correspondence data that you provide. NETOPIA Payments processes card and authentication data; DAS does not receive or store the full card number or card security code. Hosting and security providers may process IP address, device and request-log information necessary to deliver and protect the service.

Why and on what legal basis

We process order and service data to take steps requested before a contract and to perform the contract (Art. 6(1)(b) GDPR where applicable), business-representative and security data for our legitimate interests in operating, documenting and protecting a B2B service (Art. 6(1)(f)), and billing or transaction records to comply with accounting, tax and other legal duties (Art. 6(1)(c)). Optional analytics or marketing technologies, if introduced, will operate only on consent (Art. 6(1)(a)).

Browser storage, cookies and AI

Strictly necessary browser storage preserves the assessment, results and privacy choices on your device. The current public rule-based assessment does not transmit answers to a third-party large language model. If a later optional AI-assisted feature requires such transmission, we will identify the provider and purpose at the point of use and update this notice before activating that feature.

Recipients and transfers

Relevant recipients are Vercel, which hosts the application; NETOPIA Financial Services S.A., which processes card payments; the email and hosting service used for DAS business correspondence; and professional advisers or public authorities where legally required. Each recipient receives only the information necessary for its role. Where a provider processes personal data outside the EEA, DAS relies on an applicable adequacy decision or appropriate safeguards, including Standard Contractual Clauses, as required.

Retention

Assessment data kept in browser storage remains until you use the reset function, clear the website data in your browser or remove it by another device-level control. Operational logs are kept for no longer than 30 days unless a security investigation requires a documented extension. Order, invoice and payment evidence is retained for the period required by accounting and tax law. Ordinary support and contractual correspondence is retained for the applicable limitation period and then deleted or restricted, unless a dispute or legal duty requires longer storage.

Your choices and rights

Subject to the GDPR conditions, you may request access, rectification, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. Send requests to office@digitalaequitas.ro. We may need proportionate information to verify identity. You may also complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or the competent authority in your country.

Required data and automated decisions

Business and billing fields marked as required are needed to form and document the order. If they are not provided, DAS cannot complete the paid transaction. The rule-based assessment produces an informational exposure profile from the answers supplied. It does not make a decision producing legal or similarly significant effects about an individual within the meaning of Art. 22 GDPR.

Security and changes

We use transport encryption, access restrictions and data-minimisation measures appropriate to the current service. We will publish material changes before they take effect where reasonably possible.