PRIVACY POLICY
This policy describes how VERGO HUB S.R.L. processes personal data, in accordance with Regulation (EU) 2016/679 ("GDPR") and Law no. 190/2018. It applies to all Users, regardless of their state of residence or establishment.
IN BRIEF
| Question | Answer |
|---|---|
| Who processes the data? | VERGO HUB S.R.L., Romania |
| What do we collect? | Account data, billing data, transaction data, minimal technical data, documents you upload |
| Do you request the Personal Numerical Code (CNP)? | No, in no form |
| What if I upload a document that contains a CNP? | It is automatically removed during processing, and the original file is not kept |
| Do you store card data? | No — payment is made entirely at the payment processor |
| Do you sell data? | No |
| Do you use the results of my analyses? | Yes, dissociated from your identity, for a reference dataset — you may object at any time, by e-mail to office@vergo.ro |
| Automated decisions with legal effects on you? | No |
| Where is data processed? | Within the European Economic Area; exceptions are in Section 7 |
| Where can I complain? | ANSPDCP or the authority in your state |
1. The Controller
VERGO HUB S.R.L. · Registered office: Str. Anton Pann 2, Et. P, Ap. 3, Sector 3, București, cod 030796, Romania · CUI (Tax ID) 51956083 · Trade Register no. J2025041968001 E-mail for data protection: office@vergo.ro · Phone: +40 723 370 162
The lead supervisory authority for VERGO's activity is the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP) (Romania). However, you may also contact the authority in your state of habitual residence.
2. Categories of data
2.1. Data provided directly
| Category | Data |
|---|---|
| Identity and contact | first name, last name, e-mail, phone |
| Billing | client type (individual/legal entity), country of residence or establishment, name or company name, full address, billing e-mail; for legal entities: tax identification code and EU VAT code |
| Uploaded content | parcel boundaries, coordinates, land identification documents |
| Correspondence | messages to support and the responses |
2.2. Data generated by use
| Category | Data |
|---|---|
| Transactions | orders, payments, credit balance and movements, subscriptions |
| Usage | analyses run, reports generated, date and time |
| Proof of consent | confirmation of acceptance of the Terms, confirmation of waiver of withdrawal, the version and text of the document, date, time, IP address |
| Technical data | IP address, system logs, device and browser type |
| Fiscal localisation elements | country declared at billing, country of the IP address at the time of the order, country of the payment instrument as communicated by the processor |
2.3. What we do NOT collect
We do not request the Personal Numerical Code (Codul Numeric Personal, CNP) or any other equivalent personal identifier in any form on the Platform.
Documents you upload. Certain land identification documents (for example, land book extracts (extras de carte funciară)) may, by their structure, contain personal numerical codes or other data that we do not need. Please redact these before uploading. Independently of this, we apply at ingestion an automated process that identifies and removes such data: we retain only the elements necessary for the analysis (cadastral number, land book number, area, land-use category, geometry), and the original file is deleted within 24 hours at the latest of processing.
Bank card data — the number, expiry date and security code are entered exclusively in the payment processor's environment. We receive the transaction status and, for subscriptions, a token that does not allow the card number to be reconstructed.
Special categories of data (art. 9 GDPR) — are not collected and must not be uploaded.
2.4. Data about third parties in uploaded documents
If you upload documents containing data about other persons — for example, landowners — you must have a legal basis for transmitting them to us. For business (legal entity) clients, this data is processed by us as a processor, under the terms of the Data Processing Agreement.
The generated reports do not display the names or other identifying data of landowners.
3. Purposes and legal bases
| Purpose | Legal basis | Notes |
|---|---|---|
| Creating and administering the account | art. 6(1)(b) contract | |
| Processing orders and payments | art. 6(1)(b) | |
| Providing analyses and delivering reports | art. 6(1)(b) | |
| Automated removal of personal identifiers from uploaded documents | art. 6(1)(c) and art. 5(1)(c) | minimisation measure |
| Issuing invoices, accounting records, transmission via RO e-Factura | art. 6(1)(c) legal obligation | |
| Determining the applicable tax regime and retaining the client's localisation elements | art. 6(1)(c) | required by the rules on the place of supply of services |
| Verifying the tax code through the public ANAF service (Romanian legal entities) | art. 6(1)(b) and (c) | data of a legal entity |
| Verifying the VAT code through the European VIES system | art. 6(1)(c) | data of a legal entity |
| Preventing payment fraud | art. 6(1)(f) legitimate interest | documented assessment (LIA) |
| Retaining proof of consent | art. 6(1)(f) and (c) | |
| Technical support and operational communications | art. 6(1)(b) | |
| Platform security, logging, backup | art. 6(1)(f) | |
| Operational access to reports (support, incidents, security, anti-fraud) | art. 6(1)(b) and 6(1)(f) | role-based access, logged |
| Quality control and calibration of the methodology, on samples | art. 6(1)(f) | documented LIA |
| Producing aggregate statistics | art. 6(1)(f) | minimum aggregation thresholds |
| Building a reference dataset on land suitability | art. 6(1)(f) | with a right to object — Section 4 bis |
| Commercial communications | art. 6(1)(a) consent | separate checkbox, withdrawable at any time |
| Defence of a legal claim in court | art. 6(1)(f) |
Consent for marketing may be withdrawn at any time, without affecting the lawfulness of prior processing and without any consequence for use of the Service.
4. Automated decisions and algorithmic systems
4.1. The Platform automatically generates a score about a plot of land, not about a person. This processing does not constitute automated decision-making within the meaning of art. 22 GDPR: it does not produce legal effects on a natural person and does not similarly significantly affect them.
4.2. We do not carry out profiling of users for behavioural marketing purposes.
4.3. Details on the automated components: Notice on Automated Systems and Artificial Intelligence.
4 bis. Use of analysis results. The reference dataset
4bis.1. What we do. The results of analyses generated through the Platform — the score, the criteria values and the geometry of the analysed parcel — are integrated into a reference dataset on land suitability, which we use to improve the model, for market statistics and to develop our services.
4bis.2. What is NOT included in the reference dataset:
- your identity or that of the account that requested the analysis;
- the time of the request, at a granularity that would allow correlation with you;
- the documents you uploaded and the data extracted from them;
- information about your portfolio, strategy or commercial intent.
4bis.3. The legal basis is our legitimate interest in developing and improving a land analysis service, under art. 6(1)(f) GDPR. We have carried out and documented a balancing assessment between this interest and the rights of data subjects, available on request in summary form.
4bis.4. Your right to object. You may object at any time, with a simple e-mail to office@vergo.ro, without having to give any reason and with no consequence for the Service, its price or its features. The objection has effect for the future. At your express request, we will also remove from the reference dataset any results previously integrated, within 30 days at the latest.
4bis.5. Important clarification on the nature of the data. The reference dataset retains the exact geometry of the parcel. Since a property may be linked to its owner through public registers, this data does not constitute anonymous data within the meaning of the GDPR. Some of it may constitute personal data relating to landowners, who are not Users of the Platform. With respect to this data we act as an independent controller, and landowners are informed through the Information Notice on the Processing of Land-Related Data, published at vergo.ro/legal/landowners.
4bis.6. Safeguards applied: technical separation of the reference dataset from the operational database; a prohibition on re-identification, enforced through internal policy and access control; minimum aggregation thresholds for any published indicator; complete exclusion of content uploaded by users; access logging.
4bis.7. What we never do: we do not disclose to a third party the fact that a given user has analysed a given parcel; we do not sell individual reports; we do not use information about one user's portfolio for the benefit of another.
5. Recipients
We do not sell data. We disclose it exclusively to the following:
| Recipient | Role | What it receives |
|---|---|---|
| PayU | independent controller for payment data | transaction data; card data is entered directly at the processor |
| ANAF | public authority | invoices transmitted via RO e-Factura; public tax-code lookup |
| European Commission — the VIES system | public verification service | the legal entity's VAT code |
| Hosting and infrastructure provider | processor | all hosted data |
| Database / authentication / storage provider | processor | account data, uploaded content |
| Transactional e-mail provider | processor | e-mail address, notification content |
| Error monitoring provider | processor | technical data |
| Invoicing / e-Factura integration provider | processor | billing data |
| Professional consultants | recipients | strictly what is necessary, under confidentiality |
| Competent public authorities | recipients | only upon a well-founded legal request |
The named and up-to-date list of processors and sub-processors, including their name, country of establishment, place of processing and service provided, is made available on request, at office@vergo.ro. For business (legal entity) clients, the list is communicated upon conclusion of the data processing agreement and upon each update to it, at least 30 days before it takes effect.
6. Processing within the European Economic Area
Processing takes place, as a rule, within the territory of the European Economic Area. The fact that you are established in a Member State other than Romania does not constitute an international transfer and does not require additional safeguards — the GDPR applies uniformly across the Union.
7. Transfers outside the EEA
7.1. Some infrastructure providers may process data outside the EEA.
7.2. In such cases, the transfer is carried out exclusively on the basis of: an adequacy decision of the European Commission; or standard contractual clauses, supplemented by a transfer impact assessment (TIA) and, if necessary, additional technical and organisational measures.
7.3. You may obtain a copy of the safeguards by writing to office@vergo.ro.
| Provider | Service | Country of processing | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | database, authentication | EU (project region) | — (within the EEA); SCCs for support access from the US |
| Cloudflare Inc. | file storage (R2) | EU / global | SCCs + Data Privacy Framework |
| Vercel Inc. | web application hosting, cookie-free traffic statistics | US / global | SCCs + Data Privacy Framework |
| Google Cloud (Google Ireland Ltd.) | application server hosting (Cloud Run, europe-west1) | EU (Belgium) | — (within the EEA) |
| PayU S.A. | payment processing | Poland (EU) | — (within the EEA) |
| Mailjet SAS | sending e-mails | EU (France) | — (within the EEA) |
| FGO (i-Tom Solutions SRL) | invoice issuance | Romania (EU) | — (within the EEA) |
| Fonticons Inc. (Font Awesome) | icons displayed in the interface (visitor's IP address) | US | SCCs + Data Privacy Framework |
8. Retention periods
| Category | Duration | Basis |
|---|---|---|
| Account and profile data | duration of the account + 30 days | contract |
| Generated reports | duration of the account + 90 days for download | contract |
| Original documents uploaded by the User | 24 hours maximum from processing | minimisation |
| Data extracted from documents (cadastral no., area, geometry) | duration of the account | contract |
| Invoices and financial/accounting records | 10 years from the end of the financial year | legal obligation |
| Transaction and credit history | 10 years | legal obligation |
| Client fiscal localisation elements | 10 years | legal obligation (justification of the applied regime) |
| Proof of consent | 3 years from the last transaction, or until the final resolution of a dispute or a payment chargeback | legitimate interest |
| Technical and security logs | 6-12 months | legitimate interest |
| Correspondence with support | 2 years | legitimate interest |
| Marketing data | until withdrawal of consent + 30 days | consent |
| Reference dataset (results + geometry, without user identity) | for the duration the dataset is in use, with review of the need for retention at least once every 5 years | legitimate interest, with a right to object |
| Log of operational access to reports | 12 months | legitimate interest |
Upon expiry, data is irreversibly deleted or anonymised.
9. Your rights
You have the right: of access · to rectification · to erasure, within the limits of the legal accounting archiving obligations · to restriction · to portability · to object to processing based on legitimate interest · to withdraw consent at any time · not to be subject to an automated decision with legal effects, a situation which, per Section 4, does not arise.
The right to object to the reference dataset is exercised with a simple e-mail to office@vergo.ro, without having to give any reason.
How to exercise them: at office@vergo.ro, in Romanian or English. We respond within one month at the latest, a period extendable by two months for complex requests, with notice to you. Exercising your rights is free of charge; manifestly unfounded or excessive requests may be charged for or refused, with reasons given.
To verify identity we may request strictly necessary additional information, without collecting copies of identity documents unless there is no other way.
Complaint:
- Romania: ANSPDCP, B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București · dataprotection.ro · anspdcp@dataprotection.ro
- Another Member State: the supervisory authority of your state of habitual residence, place of work, or the place of the alleged infringement.
You also have the right to bring proceedings before a court.
10. Data security
We apply appropriate technical and organisational measures: encryption of traffic (TLS) and of data at rest; full delegation of card data processing to the PCI-DSS certified processor; automated removal of personal identifiers from uploaded documents; role-based access control, on a least-privilege basis; two-factor authentication for administrative accounts; logging of administrative access; periodic backups and restoration testing; assessment of providers before contracting, with clauses compliant with art. 28 GDPR; an incident-management procedure, with notification to the authority within 72 hours and notification of data subjects where applicable.
11. Cookies
Described in the Cookie Policy, at vergo.ro/legal/cookies. Cookies that are not strictly necessary are installed only with your consent, which is revocable at any time.
12. Minors
The Service is not directed at persons under 18 years of age. If we become aware of the data of a minor, we delete it without delay.
13. Changes
The version in force, with its update date, is published at vergo.ro/legal/privacy. Substantial changes are communicated by e-mail 30 days in advance. Previous versions remain available at vergo.ro/legal/archive.
14. Contact
office@vergo.ro or by post at the registered office referred to in Section 1. Correspondence is conducted in Romanian or English.