EXPATIO privacy policy — how we protect your personal data

Automatic translation, for informational purposes. The Romanian version prevails.

PRIVACY INFORMATION NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

Expatio Platform (Beta-Group) — https://expatio.ai

I. WHY YOU ARE RECEIVING THIS NOTICE

Expatio is an online platform through which Romanians living abroad can find jobs, housing, services, passenger and parcel transport between countries, events, and community support for one another. For it to function, the platform processes information about you.

This notice shows you what data we collect, for what reason, on what legal basis, to whom we transmit it, how long we keep it, and what you can request from us. It is drafted in fulfillment of the information obligation provided for in Articles 12, 13, and 14 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR" or the "Regulation").

This notice applies to all natural persons who interact with the platform: unregistered visitors, account holders, people who post or respond to listings, people mentioned in listings or messages by other users, people who contact us via published forms or email addresses, representatives of contractual partners, and people who purchase listing promotion services.

It does not apply to processing carried out by other users for their own purposes after they contact you through the platform. From the moment a user takes over your data and uses it for their own purposes (for example, an employer who keeps your CV, a carrier who notes your delivery address, a landlord who enters into a lease agreement with you), that user becomes an independent controller and is solely responsible for compliance with data protection legislation.

II. WHO PROCESSES YOUR DATA

The controller is MED TIMES ONLINE S.R.L., a Romanian legal entity, with its registered office in Bucuresti, Sectorul 3, Bd. Poet Octavian Goga Nr 4, Bloc M26 scara 3 Ap 60 camera 1, Cod Postal 030982, registered with the Trade Register Office under no. J40/13641/31.07.2017, sole registration code 38043734, contact e-mail [email protected], phone +40739053737.

The controller determines the purposes and means of processing, within the meaning of Article 4 point 7 of the GDPR.

The Data Protection Officer (DPO), respectively the person designated to manage data protection requests, can be contacted at the address [email protected] or by registered letter at the registered office, with the mention "to the attention of the Data Protection Officer".

Users located outside Romania. The Platform is available in Romanian and is addressed to the community of Romanians settled abroad, without targeting a specific state. However, some users are located in states outside the European Union, in which case local data protection rules may also apply. Section IX bis describes how we handle this situation, with reference to Switzerland, the state from which, at this stage, the majority of users come.

III. APPLICABLE LEGAL FRAMEWORK

The processing is carried out with the observance, mainly, of the following normative acts:

Regulation (EU) 2016/679 (GDPR);
Law no. 190/2018 regarding enforcement measures of the GDPR;
Law no. 506/2004 regarding the processing of personal data and the protection of privacy in the electronic communications sector, in particular Article 4 paragraph (5) regarding the storage of information in terminal equipment and Article 12 regarding commercial communications;
Law no. 365/2002 on e-commerce;
Regulation (EU) 2022/2065 on a Single Market For Digital Services (Digital Services Act, "DSA") and Law no. 50/2024 on the establishment of measures for its application;
Government Emergency Ordinance no. 34/2014 on consumer rights in contracts concluded with professionals, as amended by Government Emergency Ordinance no. 58/2022;
Law no. 207/2015 on the Fiscal Procedure Code, including annex no. 5 (platform operators reporting, DAC7), to the extent it becomes applicable;
Accounting Law no. 82/1991 and Law no. 227/2015 on the Fiscal Code, for supporting documents related to promotion services.

IV. WHAT THE TERMS USED MEAN

Personal data: any information regarding an identified or identifiable natural person, directly or indirectly, in particular by reference to a name, an identification number, location data, an online identifier (including the IP address or device identifiers) or to one or more specific elements of their identity.

Processing: any operation performed on data, with or without automated means, including collection, recording, organization, storage, consultation, use, disclosure by transmission, alignment, restriction, erasure or destruction.

Data subject: the natural person whose data is processed.

Processor: the entity that processes data on behalf and for the account of the controller, based on a contract concluded in accordance with article 28 of the GDPR (for example, the hosting provider).

User: any person who accesses the platform, with or without an account.

User-generated content: community feed posts, comments, reactions, listings in the Jobs, Rentals, Services, Events and Transport categories, ride requests, private messages, reviews and uploaded photos.

V. CATEGORIES OF DATA WE PROCESS

V.1. Account and identification data

E-mail address, also used for authentication; display name or pseudonym; password or, where applicable, the one-time code sent by email (passwords are stored exclusively as derived cryptographic hash values, not in plain text); account creation date; account status; selected language and country; notification settings.

V.2. Profile data

Profile picture, if you upload one; city and country of residence; the short description you choose to fill in; phone number, if you add it to be contacted; links to accounts on other platforms, if you enter them; professional or individual status, when publishing ads.

Profile elements, except for the email address, are displayed publicly or to other registered users, depending on platform settings. Do not enter information in your profile that you do not want to be made public.

V.3. Content you publish

Text of posts and comments, reactions, attached photos and files, as well as ad content: job description and conditions offered, housing description, address or indicated area, price, surface area, service description and rates, event details, route, departure date and time, number of available seats, rate per seat or per kilogram, type of package accepted.

Content may include personal data of yours or of other persons. Responsibility for publishing other people's data rests with you, as the author of the content.

V.4. Communications between users

Private messages exchanged through the platform, their metadata (sender, recipient, transmission timestamp, read status) and attached files.

The regime of access to the content of these messages, their retention and disclosure is described in section V bis, which applies equally to messages and calls.

V.4bis. Audio and video calls between users

The platform allows the initiation of audio and video calls between accounts, without using phone numbers, in a manner similar to calls in messaging applications.

In connection with this functionality, we process:

1. traffic data and call metadata: identifiers of the calling and called accounts, time of initiation, time of acceptance or refusal, duration, type of call (audio or video), final status (completed, missed, rejected, dropped);

2. technical data necessary for establishing the connection: public and local IP addresses of the participants and ports used, network type, information transmitted to connection relay servers, as well as quality indicators (packet loss, jitter, resolution, codec);

3. device configuration data related to granted microphone and camera permissions;

4. data resulting from reporting an abusive call: time, participants, invoked reason and description provided by the complainant.

5. audio or audio-video recording of accepted calls, under the conditions described in section V bis point 4.

Voice and image circulate between participants through the Operator's call server and, for accepted calls, are saved on our servers as a recording, under the conditions of section V bis.4. We do not currently listen to calls, transcribe them or automatically analyze them for general surveillance purposes; access to recordings is limited to the specific cases described in section V bis.3.

The technical data from letter b) are necessary for the operation of the technology used (WebRTC or equivalent technology). By its very nature, a participant's IP address may become visible to the other participant when the connection is established directly between devices. When using relay servers, this exposure is limited. Applied configuration: calls pass through the Operator's call server (LiveKit, hosted on the Operator's servers), without an external provider and without a TURN server; each participant connects to this server, and the connection is not established directly between the participants' devices.

The confidentiality of communications is protected by Article 3 of Law no. 506/2004 and Article 5 of Directive 2002/58/EC. The interception, eavesdropping, storage, or monitoring of communications without the consent of the participants is prohibited, except in cases expressly provided by law.

V.5. Ratings, reviews and reputation

Given and received ratings, review text, number of completed transactions, displayed badges (for example, indication of holding a transport license or the mark granted to accounts with a good history), complaints received regarding your account.

V.6. Location data

Locality or country declared in the profile or selected in filters; approximate location deduced from the IP address; exact device position, when you enable the distance display feature relative to ads and grant permission at the device or browser level.

The exact location is processed exclusively based on your consent, expressed through the permission granted in the browser or operating system. You can revoke the permission at any time from the device settings, without affecting the rest of the functionalities.

V.7. Data regarding paid ad promotion

When purchasing the promotion of an ad on the main feed or within a category: the selected package, promotion period, price, currency, order date, payment status, transaction identifier assigned by the payment processor, the last four digits and type of the payment instrument, as well as billing data (first and last name or company name, address, tax identification code, trade registry registration number, as applicable).

We do not collect or store the full card number, expiration date, or security code. As of the date of this version, the platform does not collect payments and does not issue invoices. At the time of payment activation, these elements will be entered directly into the secure interface of the payment processor Viva Wallet (Viva Payment Services S.A., European Union), which will process them as an independent controller, according to its own privacy policy.

V.8. Technical and usage data

IP address; browser type and version; operating system; device type and screen resolution; session identifiers; date and time of access; pages and ads viewed; search terms and filters applied; actions performed on the platform; traffic source; security logs, including successful and failed login attempts.

V.9. Data resulting from moderation and the application of rules

Reports you submit or that concern you; measures taken (warning, content removal, visibility limitation, account suspension or closure); the justification for these measures; complaints filed against moderation decisions and the solutions given; correspondence with competent authorities.

V.10. Data from third parties or other users

The data that other users enter about you (a review, a mention in a post, contact details included in a transport request, information transmitted by a contractual partner about its representatives); data received from authentication service providers, if we enable authentication via external accounts (at the date of the present version we do not use such providers); information received from the payment processor regarding the result of a transaction or a dispute; data received from authorities within the framework of legal requests.

This section constitutes the notice provided by article 14 of the GDPR for data that is not obtained directly from you.

V.11. Special categories of data

We do not request data regarding racial or ethnic origin, political opinions, religious confession, trade union membership, genetic or biometric data, data concerning health, sex life or sexual orientation.

However, the content you publish may reveal such information by its very nature. A post about participating in a pilgrimage, an announcement regarding a religious event, a request for a recommendation for a doctor or a mention regarding a medical condition fall into this category. When you voluntarily publish such information in a visible area of the platform, the processing is based on article 9 paragraph (2) letter (e) of the GDPR, namely data manifestly made public by the data subject. We recommend that you avoid publishing such details and use private messages when necessary.

The voice and image transmitted during a call are not processed by us as biometric data. We do not apply facial recognition, voice recognition, speaker identification or other techniques for the unique identification of a person based on their physical or behavioral characteristics.

We do not process data regarding criminal convictions or offenses, unless we receive a request from a competent authority or this information is necessary for the establishment, exercise or defense of a legal claim in court.

V BIS. PLATFORM COMMUNICATIONS: ACCESS, RETENTION AND DISCLOSURE

This section applies equally to chat messages and calls and complements points V.4 and V.4bis.

V bis.1. What we process

Depending on the functionality used, we process messages sent via chat and data associated with calls made through the platform, including participant identifiers, the date and duration of the communication, and the audio or audio-video recording of accepted calls.

V bis.2. For what purposes

These data may be processed for:

1. providing and administering the platform services;

2. ensuring platform security;

3. preventing and investigating fraud, abuse, and unauthorized or illegal use of services;

4. resolving reported complaints and incidents;

5. resolving disputes between users;

6. establishing, exercising or defending legal rights;

7. complying with applicable legal obligations.

The legal bases corresponding to these purposes are indicated in the table in section VI.

V bis.3. What we do not do. Limits of human access

We do not discretionarily access private conversations and we do not perform generalized human reading of all conversations for purposes of curiosity, general surveillance or individualized commercial analysis.

Human access to content is limited to situations where it is necessary for one of the purposes described in point V bis.2, is granted only to authorized persons and is recorded in internal access logs.

In practice, this means that:

1. access is usually triggered by a report, a complaint, an incident or a legal request, rather than by the general initiative of the staff;

2. the relevant conversation thread or call for the specific case is examined, and not the user's entire history;

3. access is granted on a role-based basis, only to designated persons, and is logged in a journal indicating the person, time, object, and reason for access;

4. to understand how the platform is used, we use aggregated, anonymized data or metadata, rather than reading individual conversations.

V bis.4. Call recording

The call recording functionality is active as of the date of this version: accepted calls are recorded (audio and, for video calls, image) from the moment the callee accepts the call, and the recording is kept on the Operator's servers for the period indicated in section X. The following rules apply.

Prior notice. Participants are informed that accepted calls are recorded, the purpose of the recording, and the applicable retention period through this notice and through the Terms and Conditions of Use (article 18¹.6), brought to attention before using the functionality.

The purposes of the recording are platform safety, resolving reported incidents, and defending legal rights, and the recording is kept for the period indicated in section X.

Consent and alternative. By accepting the Terms and Conditions and by initiating or accepting a call, participants agree to its recording. A participant who does not wish to be recorded can refuse the call and use, as an unrecorded alternative, the platform's written messaging.

Termination of recording. Recording ceases upon the termination of the call by either participant.

Scope. The ongoing call is recorded from the moment of its acceptance. We do not record unaccepted calls (missed, refused, or canceled) and we do not record retroactively.

V bis.5. Retention. Preservation for incidents and disputes

Messages and recordings are kept only for the period necessary for the purpose for which they were collected, according to the periods and criteria in the table in section X. The periods are distinct for regular conversations, call recordings, and data preserved in connection with an incident or litigation.

In the event of a complaint, an incident, litigation, or a legal request, strictly relevant data may be retained for an additional period, limited to the duration necessary for the investigation, resolution, or exercise or defense of legal rights. This preservation measure:

1. targets the conversation thread, call, or segment relevant to the case, and not the user's entire communication archive;

2. applies specifically, upon the initiation of the case, and is lifted upon its closure, unless another legal reason for retention persists;

3. is logged, indicating the case, the targeted data, the time of implementation, and the time of removal.

V bis.6. Disclosure to authorities

We may disclose relevant data to competent authorities only when disclosure is required or permitted by applicable law, based on a valid legal request, a court order, a legal obligation, or, in individual cases, when disclosure is necessary and permitted for reporting possible criminal acts or threats to public safety.

We limit disclosure to the data necessary and relevant for the purpose of the request and evaluate the requirements applicable to international data transfers, when applicable. Procedure details can be found in point VIII.4.

We do not retain user communications for the purpose of making them generally and proactively available to law enforcement agencies. Cooperation takes place on a case-by-case basis, under the law.

V bis.7. Impact assessment

Since processing may involve the content of communications and, when the functionality is enabled, volumes of audio recordings, we conduct a data protection impact assessment under Article 35 of the GDPR before processing begins. The assessment does not replace the legal basis and does not validate excessive retention.

V bis.8. References

Retention periods, recipients, international transfers, and the rights of data subjects are described in sections X, VIII, IX, and XIII of this note.

VI. PURPOSES AND LEGAL BASES OF PROCESSING

1 — Purpose of processing: Creating and managing the account, authentication, access recovery · Data categories: V.1, V.2, V.8 · Legal basis: Art. 6 para. (1) lit. b) GDPR: execution of the platform usage contract
2 — Purpose of processing: Providing platform functionalities: publishing and displaying ads and posts, searching, filtering, messaging, ratings · Data categories: V.2 - V.5, V.8 · Legal basis: Art. 6 para. (1) lit. b) GDPR
2bis — Purpose of processing: Establishing and maintaining audio and video calls between users, signaling calls, displaying call history · Data categories: V.4bis · Legal basis: Art. 6 para. (1) lit. b) GDPR
2ter — Purpose of processing: Diagnosing connectivity and call quality issues, preventing abusive calls and harassment by call · Data categories: V.4bis, V.9 · Legal basis: Art. 6 para. (1) lit. f) GDPR: legitimate interest in maintaining the service functional and secure
3 — Purpose of processing: Displaying the distance to ads and relevant results for your location · Data categories: V.6 · Legal basis: Art. 6 para. (1) lit. a) GDPR: consent, expressed through location permission
3bis — Purpose of processing: Access to the microphone and camera to initiate or accept a call · Data categories: V.4bis · Legal basis: Art. 6 para. (1) let. a) GDPR: consent, expressed through the permission granted at the device level, revocable from its settings
4 — Purpose of processing: Sale and delivery of ad promotion services, collection of the price, issuance of the invoice · Data categories: V.1, V.2, V.7 · Legal basis: Art. 6 para. (1) let. b) GDPR for the execution of the order; art. 6 para. (1) let. c) GDPR for tax and accounting obligations
5 — Purpose of processing: Keeping supporting documents and accounting and tax records · Data categories: V.7 · Legal basis: Art. 6 para. (1) let. c) GDPR: Law no. 82/1991, Law no. 227/2015, Law no. 207/2015
6 — Purpose of processing: Content moderation, handling reports, enforcement of Terms and Conditions, motivation of decisions, and resolution of internal complaints · Data categories: V.3 - V.5, V.9 · Legal basis: Art. 6 para. (1) let. c) GDPR, in relation to the obligations under Regulation (EU) 2022/2065; art. 6 para. (1) let. f) GDPR: legitimate interest in maintaining a safe environment
7 — Purpose of processing: Prevention and investigation of fraud, fake accounts, spam, abuse, and unauthorized or illegal use of services · Data categories: V.1, V.4, V.4bis, V.8, V.9 · Legal basis: Art. 6 para. (1) let. f) GDPR: legitimate interest in protecting users and infrastructure
7bis — Purpose of processing: Investigation of reported incidents and resolution of disputes between users, including by examining the conversation thread or the relevant call · Data categories: V.3, V.4, V.4bis, V.9 · Legal basis: Art. 6 para. (1) let. f) GDPR: legitimate interest in ensuring the proper functioning of the platform and resolving received complaints
7ter — Purpose of processing: Recording accepted calls, for the safety of the platform, resolving reported incidents and defending legal rights · Data categories: V.4bis lit. e) · Legal basis: Art. 6 para. (1) lit. a) GDPR when applicable law requires the consent of participants; art. 6 para. (1) lit. f) GDPR in other situations, with prior information in the call; art. 9 para. (2) lit. a) or f) GDPR for any special categories of data
7quater — Purpose of processing: Timely retention of relevant data for an incident, a complaint, a dispute, or a legal request · Data categories: V.3, V.4, V.4bis, V.9 · Legal basis: Art. 6 para. (1) lit. f) GDPR; art. 6 para. (1) lit. c) GDPR when retention is mandated by an act of a competent authority
8 — Purpose of processing: Ensuring information security, logging, backups, testing, and troubleshooting · Data categories: V.1, V.8 · Legal basis: Art. 6 para. (1) lit. f) GDPR; art. 32 GDPR
9 — Purpose of processing: Operational communications regarding the account, announcements, received messages, and changes to contractual documents · Data categories: V.1, V.2 · Legal basis: Art. 6 para. (1) lit. b) GDPR; art. 6 para. (1) lit. c) GDPR for notifying the change of Terms
10 — Purpose of processing: Sending commercial communications, newsletters, advertisement recommendations via email or notifications · Data categories: V.1, V.2, V.8 · Legal basis: Art. 6 para. (1) lit. a) GDPR: consent; art. 12 of Law no. 506/2004
11 — Purpose of processing: Measuring audience, usage statistics, improving functionalities · Data categories: V.8 · Legal basis: Art. 6 para. (1) lit. a) GDPR for cookies that are not strictly necessary; art. 6 para. (1) lit. f) GDPR for aggregate analyses performed on data already collected
12 — Purpose of processing: Organizing content on the community feed and within categories, including highlighting promoted announcements · Data categories: V.2, V.3, V.6, V.8 · Legal basis: Art. 6 para. (1) lit. b) GDPR for the operation of the service; art. 6 para. (1) lit. f) GDPR for optimizing relevance
13 — Purpose of processing: Resolving complaints, managing requests regarding the rights of data subjects and proof of compliance · Data categories: V.1 - V.9 · Legal basis: Art. 6 para. (1) lit. c) GDPR: art. 5 para. (2), art. 12 and art. 30 GDPR
14 — Purpose of processing: Establishing, exercising or defending a right in court, before authorities or in alternative dispute resolution procedures · Data categories: V.1 - V.9 · Legal basis: Art. 6 para. (1) lit. f) GDPR; art. 9 para. (2) lit. f) GDPR for special categories
15 — Purpose of processing: Responding to requests from public authorities, including orders issued under articles 9 and 10 of Regulation (EU) 2022/2065 · Data categories: V.1 - V.9 · Legal basis: Art. 6 para. (1) lit. c) GDPR
16 — Purpose of processing: Reporting information regarding sellers, if and to the extent that the platform falls within the scope of Annex No. 5 to Law No. 207/2015 (DAC7) · Data categories: V.2, V.7 · Legal basis: Art. 6 para. (1) lit. c) GDPR
17 — Purpose of processing: Reorganization of the company, merger, division or transfer of assets · Data categories: V.1 - V.9 · Legal basis: Art. 6 para. (1) lit. f) GDPR: legitimate interest in continuing operations

When we invoke legitimate interest, we have conducted or will conduct a documented assessment weighing this interest against your rights and freedoms. You can request information about the outcome of the assessment at the DPO's contact address.

VII. NATURE OF DATA PROVISION

The e-mail address is required for account creation. Without it, we cannot offer you access to the features reserved for registered users.

Billing data is required for purchasing a promotion service. Without them, we cannot issue the tax document and we cannot execute the order.

The rest of the data is optional. Failure to provide them limits certain functions, without preventing the use of the platform. If you do not add a profile picture, the account remains functional. If you do not enable location, you will not see the distance to ads, but you will be able to search by locality.

VIII. WHO RECEIVES THE DATA

VIII.1. Other platform users

By the nature of the service, some of the data is visible to other users: the displayed name, profile picture, locality, content of posts and ads, ratings received, approximate time of publication. Direct contact data that you include in an ad or a message become accessible to recipients.

Content published in the public areas of the platform may also be accessible to unregistered persons and may be indexed by search engines, to the extent that the respective pages are open to public access.

VIII.2. Processors

Service providers who process data on our behalf, based on contracts concluded according to Article 28 of the GDPR:

Hosting, infrastructure and databases — Role: Running the application, data storage, backups · Provider: D-SOFT-RO S.R.L. (Hypen), România — own servers, located in the European Union
Content delivery network and protection against attacks — Role: Page delivery, traffic filtering · Provider: Cloudflare, Inc. (Statele Unite ale Americii) — traffic to expatio.ai passes through the Cloudflare network; the transfer outside the European Union is covered by Cloudflare's standard contractual clauses
Transmission of transactional e-mails — Role: Authentication codes, notifications · Provider: SendMachine (Romania)
Transmission of transactional SMS — Role: Authentication and registration codes · Provider: SendSMS (sendsms.ro, Romania)
Transmission of marketing communications — Role: Newsletter · Provider: No marketing communications are currently sent; upon activation, via SendMachine (Romania), only with your consent
Payment processing — Role: Collection of the price for ad promotion · Provider: The platform currently does not collect payments; at the time of payment activation, Viva Wallet (Viva Payment Services S.A., European Union)
Invoice issuance and accounting — Role: Supporting documents, records · Provider: The platform currently does not issue invoices; this row will be filled in upon payment activation
Audience measurement — Role: Usage statistics · Provider: No external provider (no Google Analytics, no Meta, no third-party cookies): only technical server logs and internal measurements, without advertising identifiers
Signaling and relay servers for calls — Role: Establishing audio and video connections between users · Provider: Operator's own infrastructure (self-hosted LiveKit server on the Operator's servers), without an external provider and without a TURN server
Maps and geocoding — Role: Displaying locations and distances · Provider: Background maps: OpenStreetMap Foundation (tile.openstreetmap.org), which receives the browser's IP address upon loading the map; address search: Operator's own servers (Photon, based on OpenStreetMap data)
Support and moderation services — Role: Responses to reports · Provider: Internal, by the Operator, with technical support from D-SOFT-RO S.R.L.
Legal and audit services — Role: Consultancy, representation, checks · Provider: Not applicable currently

The updated list of authorized persons is available upon request at the DPO's contact address.

VIII.3. Independent controllers

The payment processor, with regard to payment instrument data and its anti-money laundering obligations; banking institutions; external authentication service providers, if we enable them; public authorities to which we transmit data in the execution of a legal obligation.

VIII.4. Authorities and courts

The National Supervisory Authority for Personal Data Processing, the National Authority for Consumer Protection, the National Authority for Management and Regulation in Communications as the coordinator for digital services, tax authorities, criminal prosecution bodies, courts of law, court bailiffs, when there is a legal obligation or a well-founded request.

Disclosure takes place only when required or permitted by applicable law, based on a valid legal request, a court order, a legal obligation or, in individual cases, when necessary and permitted for reporting potential criminal acts or threats to public safety.

We verify each request regarding its issuing authority and its jurisdiction, the invoked legal basis, the form and reasoning, the territorial scope and proportionality. We challenge or request clarification for requests that do not meet these requirements. We transmit only the data necessary and relevant for the purpose of the request.

When the request comes from an authority in a state outside the European Union and the European Economic Area, we separately analyze the existence of a basis recognized by Union law and the fulfillment of the requirements regarding international transfers provided in Chapter V of the GDPR.

We inform you about such a transmission when the law allows us to do so and when the authority has not ordered otherwise for reasons of public order or safety.

Starting with 18 august 2026, Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence in criminal matters applies, together with Directive (EU) 2023/1544. The concerned providers shall designate an establishment or a legal representative to receive these orders and shall respond within the deadlines provided by the regulation. The designated establishment of the Operator will be communicated by updating this document, upon registration in the European Commission portal.

VIII.5. Potential acquirers

In the event of a merger, demerger, asset sale or similar operation, data may be transmitted to the acquirer or the consultants involved, subject to confidentiality obligations and with prior notification of the data subjects when required by law.

IX. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Data is hosted on servers located in the European Union. The only provider based outside the European Economic Area is Cloudflare, Inc. (Statele Unite ale Americii), for the content delivery network and protection against attacks.

For these situations, the transfer is carried out on the basis of one of the following mechanisms provided for in Chapter V of the GDPR:

the adequacy decision of the European Commission, when the recipient is located in a country recognized as offering an adequate level of protection. Switzerland benefits from such a decision, which is of practical relevance for the community served by the platform. For the United States, the decision applies to organizations certified under the EU-US Data Privacy Framework;
the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, accompanied by a transfer impact assessment and, where necessary, additional technical and organizational measures such as encryption and pseudonymization;
the exceptions provided for in Article 49 of the GDPR, in specific and limited situations.

You can obtain a copy of the applicable safeguards or information on where they are available by sending a request to [email protected].

IX BIS. USERS LOCATED OUTSIDE THE EUROPEAN UNION. THE SITUATION OF SWITZERLAND

IX bis.1. General Framework

flash is established in Romania and operates under the GDPR, regardless of where the users are located. The platform is available in Romanian, is accessible from any country, and is not targeted at the public of a specific country.

In practice, at this stage, a significant portion of users are located in Switzerland. Switzerland is not a member state of the European Union and has its own data protection legislation, namely the revised Federal Act on Data Protection, in force since September 1, 2023.

This section addresses two distinct questions that receive different answers:

First: does Swiss law apply to processing concerning individuals located in Switzerland? The answer is, as a rule, affirmative, for the reasons set out in point IX bis.2.

Second: are we obliged to appoint a representative in Switzerland? The answer is, in the current configuration, negative, for the reasons set out in point IX bis.3.

The two questions have different legal criteria. The applicability of the law follows a broad criterion, based on the effects produced on Swiss territory. The obligation to appoint a representative follows a narrower criterion, which requires targeting the activity towards the public in Switzerland and three additional conditions. The fact that the law applies does not automatically entail the obligation of representation, just as the absence of the obligation of representation does not mean that the law does not apply.

IX bis.2. Swiss law applies to processing with effects in Switzerland

Swiss law follows the effects principle, provided for in Article 3 thereof: it applies to situations that produce effects in Switzerland, even if they were initiated from abroad. The criterion is broader than that used by GDPR for controllers established outside the Union. The data processing of individuals located in Switzerland produces effects on the territory of this state, so Swiss law applies to such processing, regardless of the question whether our activity is directed or not towards the Swiss public.

Therefore, processing concerning individuals located in Switzerland is simultaneously subject to GDPR, because the Controller is established in Romania, and Swiss law, for the effects produced in Switzerland. We apply the more protective standard of the two. The practical differences are small, as Swiss law has been revised to maintain equivalence with European law, an equivalence confirmed by the adequacy decision of the European Commission.

One difference is worth noting: Swiss law does not provide for administrative fines applicable to the company, but criminal sanctions applicable to individuals in management or within the organization, of up to 250,000 Swiss francs, especially for the intentional violation of information obligations and the handling of data subjects' requests.

IX bis.3. The obligation to appoint a representative has its own, higher threshold

The appointment of a representative is not an automatic consequence of the applicability of the law. It is a distinct obligation, with its own triggering conditions.

Article 14 of the Swiss law requires operators based abroad to appoint a representative in Switzerland only when four conditions are cumulatively met:

1. the processing is related to the offering of goods or services to persons in Switzerland or to the monitoring of their behavior;

2. the processing is on a large scale, going beyond isolated cases;

3. the processing is of a regular nature, not being occasional or limited in time;

4. the processing presents a high risk to the personality of the data subjects, assessed according to the volume and type of data, especially sensitive data, the purpose of processing, the technologies used, the intention of international disclosure, and the extent of access rights.

The first condition is not met by the mere accessibility of the platform from Switzerland. It implies a targeting of the activity towards the public in this state. The elements that indicate such targeting are, mainly: the availability of the interface in German, French, or Italian; the display of prices in Swiss francs; the use of a .ch domain name; advertising campaigns or search optimization for the public in Switzerland; functionalities built for Swiss specifics; the mention of local contact details.

The current situation, namely the exclusively Romanian-language interface, the absence of a local domain, and the lack of targeted promotion, supports the conclusion that this condition is not yet met. The conclusion changes if any of the above elements appear.

We recommend the documented reassessment of the four conditions before each development stage concerning the public in Switzerland, as well as the monitoring of the proportion of users from this state. The assessment and its result are kept as proof of the analysis performed.

When the designation becomes mandatory, the name and address of the representative shall be published in an easily findable and permanently accessible manner, in accordance with Article 14 paragraph (3), and the representative shall keep the register of processing activities concerning individuals in Switzerland and make it available to the Swiss authority upon request. The designated representative, if applicable, is: Bucataru Camelia Gabriela.

IX bis.4. Romania-Switzerland Transfers

Switzerland is included in the list of states with an adequate level of protection, according to the European Commission's adequacy decision. Conversely, the Swiss Federal Council recognizes the states of the European Economic Area, including Romania, as offering adequate protection. Data transfers between the two jurisdictions are therefore carried out without additional safeguards.

IX bis.5. Where individuals located in Switzerland should address

Rights. Individuals located in Switzerland benefit both from the rights provided in Articles 15-22 of the GDPR, described in Section XIII, and those provided by Swiss law, in particular the right to information, the right of access (Article 25) and the right to rectification, erasure and the handover or transfer of data (Article 28). Their content is essentially the same. Requests shall be sent to [email protected], regardless of the legal basis invoked, and shall be resolved within the shortest timeframe provided by the two laws.

Complaints. There are two paths, and the choice belongs to the data subject:

1. The National Supervisory Authority for Personal Data Processing in Romania is the competent authority in relation to the Controller, since the latter is established in Romania, and the GDPR applies to all its processing activities. This is the main and most efficient path, as the Romanian authority has direct investigation and sanctioning powers towards the Controller. Contact details can be found in Section XIII;

2. The Federal Commissioner for Data Protection and Transparency (Préposé fédéral à la protection des données et à la transparence / Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter), Feldeggweg 1, 3003 Bern, Switzerland, www.edoeb.admin.ch, for the processing activities to which Swiss law applies according to point IX bis.2. The competence of this authority derives from the applicability of Swiss law, and not from the existence of a representative in Switzerland. The absence of a representative does not close this avenue.

The mention of the Swiss authority does not constitute an acknowledgment of directing activities towards Switzerland and does not affect the analysis in point IX bis.3.

Security breaches. We notify the National Supervisory Authority for Personal Data Processing under Article 33 of the GDPR. For incidents affecting individuals in Switzerland that pose a high risk to their personality or fundamental rights, we also notify the Swiss authority as soon as possible, according to Article 24 of Swiss law. The two notifications have different thresholds, and the existence of one does not automatically imply the existence of the other.

IX bis.6. Commercial communications to recipients in Switzerland

Sending mass advertising messages to recipients in Switzerland without their prior consent constitutes unfair commercial practice according to Article 3 paragraph (1) letter o) of the Swiss Federal Act against Unfair Competition. Consequently, we apply the same requirements for prior consent, correct identification of the sender, and a simple and free option to refuse for all recipients, regardless of their state of residence.

X. HOW LONG WE KEEP DATA

Account and profile data — Retention period: For the duration of the account existence, plus 30 days from its closure, for the possibility of restoration at your request.
Active posts, comments and announcements — Retention period: For the duration of publication; expired announcements are archived for 6 months and then deleted.
User-deleted content — Retention period: Removed from the interface immediately; removed from backups within a maximum of 90 days.
Private messages — Retention period: For the duration of the participating accounts' existence, except for messages subject to a report or procedure, which are kept until its completion
Chat messages — Retention period: 180 days, calculated from the completion of the ride or the last relevant interaction between participants, except for threads subject to a preservation measure.
Accepted call recordings — Retention period: 90 days, except for recordings subject to a preservation measure
Call metadata (call history displayed in the account) — Retention period: For the duration of the account's existence or until the history is deleted by the user
Technical call logs (IP addresses, quality indicators) — Retention period: 30 days, extended only for calls subject to a report.
Data preserved in connection with an incident, complaint, dispute or legal request (preservation measure under point V bis.5) — Retention period: Until the case is resolved and, if necessary, until the expiration of the relevant term for bringing or defending a claim. Applies only to data relevant to the respective case
Log of authorized personnel access to communication content — Retention period: 12 months.
Ratings and reviews — Retention period: For the duration of the rated account's existence; upon account closure, reviews may be kept in an anonymized form for the integrity of the reputation system
Data regarding promotion orders and supporting documents — Retention period: 10 years from the end of the financial year, in accordance with art. 25 of Law no. 82/1991; 5 years for the tax prescription period, in accordance with art. 110 of Law no. 207/2015, the terms running in parallel
Security logs and IP addresses — Retention period: Between 6 and 12 months
Data regarding reports and moderation decisions — Retention period: 6 months from resolution, or until the completion of any appeal procedure.
Marketing consent and proof thereof — Retention period: Until the withdrawal of consent, plus 3 years from withdrawal, as proof of compliance with art. 7 para. (1) GDPR
Requests regarding the exercise of rights and responses — Retention period: 3 years from resolution
Data necessary for the defense of a right in court — Retention period: Until the expiration of applicable prescription periods, generally 3 years in accordance with art. 2517 of the Civil Code, and in the case of a dispute, until final resolution and the expiration of legal remedies
Cookies and similar technologies — Retention period: The durations indicated in the Cookie Policy

Additional retention horizons configured in the platform (the values displayed are those in force at the date of consulting this page):

Previous versions of edited posts: 90 days
Evidence for serious moderation cases (text, image fingerprints, IP): 365 days
Log of operator actions on accounts and content: 1825 days
Delivery log for browser push notifications: 14 days
Notifications read from the notification center: 365 days
Files sent in "view once" messages, after they have been viewed: 7 days
Files from disappearing messages, kept for moderation after expiry: 30 days
Identity documents uploaded for profile verification: 365 days
The archive with your personal data, after the download link expires: 72 hours
The e-mail address fingerprint of an account deleted during a suspension: 365 days
The account’s GPS positions (if you allowed location): 90 days
Recordings of audio/video calls: 90 days

Upon the expiration of the terms, the data is deleted or irreversibly anonymized, so that identification is no longer possible.

XI. DATA SECURITY

We apply technical and organizational measures appropriate to the risk, in accordance with Article 32 of the GDPR, including:

encryption of traffic via the TLS protocol between your device and our servers;
storage of passwords exclusively as derived values with cryptographic-resistant functions;
role-based access control, granting permissions on a need-to-know basis;
restricting access to communications content to a limited number of designated persons, without permanent administrator-type access to user conversations and without open access for company management except in specific cases;
two-factor authentication for administrative accounts;
logging access to user data and, separately, each access to communications content, indicating the person, time, object, and reason;
periodic review of the content access log;
periodic backups, with restoration testing;
separation of development, testing, and production environments, prohibiting the use of real data in testing;
confidentiality clauses in contracts with staff and service providers;
security incident management procedures;
periodic evaluation of measures and providers.

No measure completely eliminates the risk. We recommend that you use a unique password, not share codes received via email with other persons, and report any suspicious activity to [email protected].

In the event of a personal data breach that presents a risk to your rights and freedoms, we notify the National Supervisory Authority for Personal Data Processing within 72 hours of becoming aware of it, in accordance with Article 33 of the GDPR, and we inform you without undue delay when the risk is high, in accordance with Article 34.

XII. AUTOMATED DECISION-MAKING AND PROFILING

We use automated processing to:

order content on the community feed and within categories based on novelty, declared or detected location, selected category, past interactions, and the existence of paid promotion;
display promoted ads, marked as such;
automatic detection of rule-violating content, spam messages, and atypical account behavior;
reputation calculation based on received ratings.

These operations involve profiling within the meaning of Article 4 point 4 of the GDPR.

Measures affecting your account, such as limitation of visibility, suspension, or closure, are not taken exclusively based on automated processing. An automated system may flag a situation, but the final decision involves human review, except in cases of obvious and repeated abuse, where the measure is applied automatically to limit imminent harm. Even in these cases, you have the right to obtain human intervention, to express your point of view, and to contest the decision, in accordance with Article 22 paragraph (3) of the GDPR and Article 20 of Regulation (EU) 2022/2065. The appeal procedure is described in the Terms and Conditions of Use.

The main parameters of the recommendation system and how you can influence them are presented in the Terms and Conditions of Use, section regarding content ranking.

XIII. YOUR RIGHTS

You have the following rights:

Right of access (Art. 15 GDPR): you can find out if we process data about you and you can obtain a copy of them, along with information about purposes, categories, recipients, durations, and source.

Right to rectification (Art. 16 GDPR): you can request the correction of inaccurate data and the completion of incomplete data. Some of the data can be modified directly from your account settings.

The right to erasure (Art. 17 GDPR): you can request the deletion of data when they are no longer necessary, when you withdraw your consent and there is no other legal basis, when you object to processing based on legitimate interest and there are no overriding legitimate grounds, or when the processing was unlawful. The right does not apply when processing is necessary for compliance with a legal obligation, for the exercise of the right to freedom of expression and information, or for the establishment, exercise or defense of a legal claim.

The right to restriction of processing (Art. 18 GDPR): you can request the limitation of processing during the verification of data accuracy, when you object to processing, or when the processing is unlawful and you prefer restriction instead of erasure.

The right to data portability (Art. 20 GDPR): you can receive the data you have provided to us, processed on the basis of consent or contract and by automated means, in a structured, commonly used and machine-readable format, and you can request their direct transmission to another controller, when this is technically feasible.

The right to object (Art. 21 GDPR): you can object at any time to processing based on legitimate interest, invoking reasons related to your particular situation. In the case of processing for direct marketing purposes, the objection produces unconditional effects, and the processing ceases.

The right to withdraw consent (Art. 7 para. (3) GDPR): the withdrawal produces effects for the future and does not affect the legality of the processing carried out previously. It applies to exact localization, marketing communications and cookies that are not strictly necessary.

The right not to be subject to a decision based solely on automated processing (Art. 22 GDPR), under the conditions described in section XII.

The right to lodge a complaint with a supervisory authority (Art. 77 GDPR) and the right to an effective judicial remedy against the controller or the authority (Art. 78 and 79 GDPR), as well as the right to compensation for damages suffered (Art. 82 GDPR).

How to exercise your rights

Send a request to [email protected] or, in writing, to the registered office. The request must contain its subject matter and sufficient elements to identify the account. If we have reasonable doubts about the identity of the applicant, we may ask you for additional information, strictly necessary for verification, in accordance with Article 12 paragraph (6) of the GDPR.

We respond within one month of receiving the request. The deadline may be extended by two months in the case of complex or numerous requests, in which case we will inform you within the first month about the extension and the reasons for it.

Exercising your rights is free of charge. In the case of manifestly unfounded or excessive requests, in particular due to their repetitive nature, we may charge a reasonable fee or refuse to act on the request, stating the reasons for the refusal.

Supervisory authority

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, cod poștal 010336, București Telefon: +40.318.059.211 | E-mail: [email protected] | Web: www.dataprotection.ro

If you have your habitual residence or place of work in another Member State of the European Union, you can also lodge a complaint with the supervisory authority in that State.

XIV. MINORS

Platform is addressed to persons who have reached the age of 18. Persons aged between 16 and 18 can use the platform only with the consent of the legal representative and without concluding transactions.

In Romania, the age at which a child can independently express consent for information society services is 16 years, according to Article 8 paragraph (1) of the GDPR, as the Romanian state has not made use of the possibility to lower this age.

We do not knowingly collect data from persons under 16 years of age. If we learn that an account belongs to a person under this age, we will close it and delete the associated data. If you are a parent or legal representative and believe that a minor has provided us with data, please contact us at [email protected]

XV. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and equivalent technologies for the operation of the platform and to remember preferences; we do not currently use audience measurement or marketing cookies. The categories, purposes, durations, and how consent is managed are described in the Cookie Policy, available at https://expatio.ai/cookies, which is an integral part of this notice.

XVI. LINKS TO THIRD-PARTY SITES

The platform contains links to websites and social networks managed by third parties. We are not responsible for their data processing practices. We recommend that you consult their privacy policies before providing them with data.

XVII. MODIFICATION OF THIS NOTICE

We may update this notice when platform features, service providers, the legal framework, or our practices change.

The updated version is published at https://expatio.ai/confidentialitate indicating the effective date. In case of substantial changes, we will inform you at least 15 days in advance, by e-mail or through a visible notification in the platform. If the change concerns processing based on consent, we will request your new consent.

Previous versions are kept and can be consulted upon request.

XVIII. CONTACT

For any questions regarding data processing:

Operator: MED TIMES ONLINE S.R.L. Adresă: Bucuresti, Sectorul 3, Bd. Poet Octavian Goga Nr 4, Bloc M26 scara 3 Ap 60 camera 1, cod poștal 030982. E-mail general: [email protected] Responsabil cu protecția datelor: [email protected] Telefon: +40739053737