SpotShare Website Privacy Policy

1. Who is responsible for your data?

The data controller for personal data processed through the website spotshare.ro (the "Site") is SPOTSHARE S.R.L., a Romanian limited liability company (societate cu răspundere limitată).

Under GDPR and Romanian law, we will publish on this page, before commercial launch of services beyond this presentation website, our complete company identification: registered office address, fiscal identification number (CUI), and Trade Register (ONRC) reference. Until that information is added here, you may still reach us using the contact details in sections 8 and 13.

2. Scope of this notice

This Privacy Policy applies to visitors of the SpotShare website (the Site) only. It is not the primary privacy notice for the mobile application. If you use the SpotShare app, open the App tab on this page first—do not rely on this Website tab for app processing.

3. What data we collect on the Site

When you browse the Site, our systems may process technical data needed to operate and secure the Site. If you consent to analytics where we are required to ask, our analytics tools may also process usage data, including: pages viewed, approximate location derived from IP address (typically at regional level), device and browser type, operating system, referral information, timestamps, and online identifiers (such as cookies and similar technologies) as further described below. If you contact us by email, we process the content of your message and your email address.

We do not intentionally collect special categories of personal data (sensitive data) through the Site.

The Site is not directed to children under 16, and we do not knowingly collect personal data from children.

4. Purposes and legal bases (GDPR)

We process personal data from the Site to operate the Site, deliver pages you request, keep the Site secure, and respond to enquiries. Strictly necessary processing (such as security or delivering requested content) is based on our legitimate interests. Where you contact us or request information, we may also process data to take steps at your request prior to entering into a contract. For analytics and any other non-essential cookies or similar technologies, we obtain your consent before placing or accessing them, using a consent management platform (cookie banner or preference centre) on the Site that records your choices.

5. Cookies, consent, and Google Analytics

We use a cookie notice and, where required by law, a consent management platform to manage your consent choices. Non-essential analytics tags (including Google Analytics) are delivered through Google Tag Manager and wired to Google Consent Mode so that analytics storage is not used for measurement until you have accepted analytics cookies where we are required to ask—consistent with our testing to ensure tags do not run for that purpose before consent. Strictly necessary operations may use essential cookies without that consent. You can change your choices at any time using the same tool or your browser settings, within technical limits.

We use Google Analytics 4 (or a comparable configuration) to understand traffic on the Site. We configure Google Analytics to limit identification risk by enabling IP anonymisation or equivalent controls offered in the product and by disabling Google advertising features (such as remarketing) and Google Signals on the Site unless you have given separate consent where the product allows. Analytics event data in Google is typically retained for up to 14 months (the shortest practical setting in the tool), after which it is deleted automatically according to Google's retention settings for our property; we review these settings periodically.

Google's processing is described in its documentation. You can read how Google uses information from partner sites at https://policies.google.com/technologies/partner-sites and review https://policies.google.com/privacy. You may use Google's browser add-on to decline Google Analytics in supported browsers, in addition to choices you make in our cookie tool.

6. Recipients and international transfers

We share usage data from the Site with Google Ireland Limited (and, where applicable, other Google affiliates). Google Ireland Limited may act as an independent controller for certain processing activities related to its analytics services, as described in Google's documentation and terms. When personal data is transferred to countries outside the European Economic Area, including the United States, we rely on the European Commission's Standard Contractual Clauses (SCCs) and on supplementary measures described in Google's public documentation, as required by EU law. Laws in some destination countries may allow public authorities to request access to data in ways that do not exist in the EU; we follow regulatory guidance and product updates in this area.

7. Retention periods

Unless a shorter or longer period is required by law, we generally apply the following retention periods: Google Analytics event data—up to 14 months in the analytics product (see section 5); server and security logs for the Site—typically between 30 and 90 days; emails you send to us—long enough to handle your request and then up to 24 months for follow-up and accountability unless a longer retention is justified for legal claims or compliance. When retention ends, we delete or irreversibly anonymise data where possible.

8. Your rights and how to exercise them

Where applicable under EU/EEA data protection law, you may have the right to access, rectify, erase, restrict or object to certain processing, to data portability, and to withdraw consent where processing is based on consent. You may have additional rights under other applicable laws. To exercise GDPR rights in relation to processing through the Site, email contact@spotshare.ro and include the words "Data protection request" in the subject line and describe your request clearly; we may request additional information to verify your identity where necessary. We will respond within the time limits set by law. For formal legal or regulatory correspondence (not routine rights requests), you may use legal@spotshare.ro.

You may lodge a complaint with a supervisory authority—in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), at https://www.dataprotection.ro/.

9. Security

We use appropriate technical and organisational measures designed to protect personal data processed through the Site, including access controls and encryption where appropriate. No method of transmission over the Internet is completely secure.

10. Automated decisions

We do not use the Site to make solely automated decisions, including profiling, that produce legal effects concerning you or similarly significantly affect you.

11. Hosting and other processors

The Site is hosted by an infrastructure provider that processes limited technical data (for example server logs and TLS metadata) strictly to make the Site available. We use written agreements with processors that require them to protect personal data and act only on our instructions. The current provider name and primary processing region are available on request at contact@spotshare.ro for legitimate transparency enquiries.

12. Data Protection Officer

We are not currently required to appoint a Data Protection Officer under Article 37 GDPR. If that obligation arises or if we voluntarily designate a DPO, we will publish the relevant contact details on this page.

13. Changes to this notice

We may update this Privacy Policy from time to time. The current version will always be posted here with the "Last updated" date at the top of this page. For general privacy questions about the Site: contact@spotshare.ro.

14. Related documents

For terms of use of the Site, see our Terms of Service. The SpotShare mobile app will have its own terms and privacy notice under the App tab on this page when published—not under this Website tab.

You are viewing the privacy notice for the SpotShare mobile app. For the website only, use the Website tab.