Start free

Privacy policy

How we process personal data

Version 1.0·Updated May 5, 2026

This policy explains what data we process, why, who we share it with, and what rights you have. Written in plain language, no jargon.

The Romanian-language version is the legally binding version. This English translation is provided for convenience.

Applicable framework. We process your data under Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector. The competent supervisory authority is ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing) — see §9 for the complaint procedure.

1. Data controller

The controller of personal data for procese.online is Parma Digital SRL:

Hosting, transport, and messaging run on Parma Digital SRL's own infrastructure (a dedicated installation). The third-party technical sub-processors — the server and network provider and external relays — are listed in §6; none use your data for their own purposes.

2. Two data regimes

procese.online processes two distinct categories of data with different legal bases. We treat them separately in this policy.

2.1. Public court data (source: portal.just.ro)

This is data published by the Ministry of Justice on portal.just.ro: case numbers, courts, panels, hearing dates, parties, rulings. This data is public by law — see §4 — and does not belong to you as a user. We index it and serve it to you only if you actively subscribe to a specific case.

2.2. Your user data

This is data you provide or that we generate to operate your account: email, push device tokens, monitored cases, payments. This belongs to you and is fully protected under GDPR and Romanian law.

3. Republic of Moldova

For data about cases before the courts of the Republic of Moldova (source: instante.justice.md) and for users in the Republic of Moldova, processing is additionally governed by the Moldovan framework: Law No. 133/2011 on personal data protection, succeeded by Law No. 195/2024 (a full transposition of the GDPR) from 23 August 2026. The competent supervisory authority for the Republic of Moldova is the National Centre for Personal Data Protection (CNPDCP), based in Chișinău.

Moldovan case data is public by law; the same protection applies — party names appear only to the authenticated user within their own monitored cases, never on public pages, and criminal-offence data is shown to no one. You have the same rights (access, rectification, erasure, portability, objection) and may lodge a complaint with the CNPDCP.

4.1. For data from portal.just.ro (civil and commercial cases)

The legal basis is layered:

  • GDPR art. 6(1)(e) — processing is necessary for the performance of a task carried out in the public interest (informing citizens about the activity of courts), grounded in the public character of judicial activity: Constitution of Romania art. 127 (public hearings), Law 304/2022 (judicial organization) and Law 544/2001 (access to public-interest information);
  • GDPR Recitals 50 and 73 — further processing for public-interest tasks is permitted without a new specific legal basis.

Criminal-offence data is excluded — not "authorized". We do not display or make available any personal data relating to criminal convictions or offences (party names or the subject of a criminal case), to any user, on any surface. GDPR art. 10 reserves such data to the control of a state authority or to an express national law with adequate safeguards; a private operator does not qualify, and Romanian law has enacted no such authorization. Criminal cases are therefore reduced to non-personal information (court, number, materie, stage, hearing dates).

This position aligns with the case law of the Court of Justice of the European Union in C-398/15 Manni, which confirms that data published in public registers for legal certainty cannot be erased on "right to be forgotten" grounds automatically — public interest takes priority, subject to a case-by-case balancing test.

4.2. For your user data

The basis depends on the purpose:

  • GDPR art. 6(1)(b) contract performance — for sign-in, account management, notification delivery, billing;
  • GDPR art. 6(1)(c) legal obligation — for retaining invoices and financial records under Romanian law;
  • GDPR art. 6(1)(f) legitimate interest — for infrastructure security, abuse prevention, and bug remediation.

We don't use consent as the primary basis for service operation. The only exceptions: push notifications (granted explicitly at install time via the OS) and any product newsletter (explicit opt-in).

5. Data we collect

5.1. About you

For each category of data we name the lawful basis from §4.2 — so you can see clearly why we collect it.

  • Email — for magic-link sign-in and communication. Basis: GDPR art. 6(1)(b) contract performance.
  • Push tokens (APNS for iOS, FCM for Android) — to deliver notifications to your device. Basis: GDPR art. 6(1)(b) contract performance; OS-level consent at install time (Law 506/2004 art. 4 for electronic communications).
  • UI language and quiet hours — preferences stored at account level. Basis: GDPR art. 6(1)(b) contract performance.
  • Monitored cases — the list of cases you watch and when you added them. Basis: GDPR art. 6(1)(b) contract performance.
  • Payment data — Pro payment history (date, amount, status). Your card data never reaches us — it's processed exclusively by Revolut Business. Basis: GDPR art. 6(1)(b) contract performance; art. 6(1)(c) legal obligation for invoice retention.
  • Technical logs — IP, user-agent, response times, retained for at most 30 days for debugging and abuse prevention. Basis: GDPR art. 6(1)(f) legitimate interest.

5.2. About public cases

  • case numbers, court name, department, category, subject, stage — for civil and commercial cases;
  • parties (names), procedural role — for civil and commercial cases;
  • hearing dates, room, panel, published rulings;
  • for criminal cases we keep only the non-personal information (court, number, materie, stage, hearing dates) — no party names and no subject.

Party names never appear on the public (anonymous) pages, and the public site offers no search by name. Party names in a civil case are visible only to an authenticated user, in their own "add a case" search and in the cases they monitor. The names and subject of a criminal case are shown to no one. These restrictions are enforced in code, in the spirit of data minimization.

5.3. What we DO NOT collect

  • passwords (we use magic-link / OAuth);
  • card or bank account data;
  • social profile data beyond the email used at sign-in;
  • tracking cookies for advertising (see §12);
  • GPS location data;
  • your contacts, photos, microphone — nothing outside the procese.online context.

6. Sub-processors

To run the service we use the following sub-processors. All have contracts including GDPR clauses and, where applicable, Standard Contractual Clauses for international transfers (see §7).

  • Hetzner Online GmbH (Germany, Falkenstein) — servers and compute infrastructure.
  • Cloudflare, Inc. (US, with EU presence) — DNS, CDN, DDoS protection, edge compute for public pages.
  • Sygnal (push notification broker) — relay between platform and Apple / Google systems.
  • Apple Push Notification Service (APNS) (Apple Inc., US) — iOS push delivery.
  • Google Firebase Cloud Messaging (FCM) (Google LLC, US) — Android push delivery.
  • Resend (US) — transactional email delivery (magic link, confirmations, invoices).
  • Revolut Business (UK / EU) — payment processing. Your card data does not reach us.

This list may be updated. Changes are announced at least 30 days in advance, by email to active accounts and in the app.

7. International transfers

Most data stays on EU servers (Hetzner Falkenstein, Germany). For push notification delivery and transactional email, technical data (device token, notification content, recipient email) transits through US-based services — Apple APNS, Google FCM, Resend, Cloudflare.

These transfers are made under Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914), providing safeguards equivalent to the EU level of protection.

8. Retention

  • Your data — active account. For the duration of your account.
  • Your data — deleted account. Fully deleted within at most 30 days (the time during which safety backups cycle out). After 30 days, only anonymized system logs may remain, in accordance with legal obligations (e.g., for fraud investigation or fiscal compliance).
  • Invoices and fiscal documents. 10 years, per Romanian law (Fiscal Code, Accounting Law).
  • Technical logs. Up to 30 days.
  • Public case data. Retained while there are active subscribers. After the last subscriber unsubscribes from a case, we retain the data for another 30 days to allow re-subscription without history loss, after which the data is archived and then removed from the active database (procese.online schema). The primary source remains portal.just.ro.

9. Your rights

Under GDPR you have the following rights:

  • Right of access (art. 15) — to know what data we hold about you. On request via email to contact@procese.online we send you a copy of your data.
  • Right to rectification (art. 16) — to correct inaccurate data.
  • Right to erasure (art. 17) — to have your data deleted. Implemented via "Delete account" in settings. For data from portal.just.ro, the right to erasure is subject to a balancing test between public interest and private interest (Manni jurisprudence).
  • Right to restriction (art. 18).
  • Right to portability (art. 20) — to receive your data in a structured, machine-readable format. On request via email.
  • Right to object (art. 21) — especially for processing based on public interest or legitimate interest.
  • Right not to be subject to automated decision-making (art. 22) — we don't make automated decisions with legal effect on you.

To exercise any right, write to contact@procese.online. We respond within at most 30 days.

Right to erasure — portal.just.ro data. For a request to remove a case's data from procese.online, we evaluate case by case the public interest versus the private interest of the data subject, in line with CJEU C-398/15 Manni. If we decide not to erase (e.g., for a case of ongoing public interest), we provide written reasoning and inform you of your right to lodge a complaint with the Romanian DPA.

Complaint to the supervisory authority. You have the right to lodge a complaint with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing):

10. Security

Technical measures we apply:

  • TLS connections for all traffic to and from our servers;
  • cryptographically derived credentials, no plaintext password storage (for internal sessions);
  • pseudonymized identities for participation in notification channels (the shadow identity model);
  • administrative access limited to people who strictly need it to operate;
  • encrypted backups with limited lifetime;
  • security updates applied promptly to underlying infrastructure.

11. Breach notification

In the event of a security breach involving your personal data, we will notify the Romanian DPA within at most 72 hours of becoming aware, in accordance with GDPR art. 33. If the breach poses a high risk to your rights, we will also notify you directly under art. 34.

12. Cookies

procese.online uses a single technical cookie, procese_prefs, to remember your chosen theme and language across pages. We don't use tracking cookies, social network pixels, Google Ads remarketing, or other profiling tools.

For details, see the Cookie policy.

13. Changes to this policy

We may update this policy to reflect changes in the service or in legislation. Material changes are announced with 30 days' notice by email and in the app. Minor changes are reflected in the "Version" and "Updated" fields above. Old versions are kept for review on request.

14. Contact

For any question about data processing: