Privacy Policy
Effective 28 October 2026
This Privacy Policy explains how personal data is processed in connection with the procumi.com website and the Procumi platform, and sets out the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”).
This English version is provided for convenience. In the event of any inconsistency, the Romanian version prevails.
1. Controller
1.1. Personal data is processed by the company that operates the Procumi platform (“Procumi”, “we”, “us”).
The company is currently being incorporated in Romania. Its registered name, registered office, tax identification number and trade register number will be added to this section upon incorporation.
1.2. For any question about how we handle personal data, contact us at support@procumi.com.
2. Our role
2.1. As controller. We determine the purposes and means of processing for data relating to website visitors, people who contact us or book a demo, customer contacts in connection with our contractual relationship, and the login and security data of Platform users.
2.2. As processor. For data that our customers submit to the Platform, such as details of invited users, suppliers and supplier contacts, the customer that submitted it is the controller. We process that data on the customer’s behalf and instructions, under Section 9 of our Terms of Service. If your data falls into this category, please direct requests to the relevant customer. We will assist them in responding.
3. Personal data we collect
| Source | Data |
|---|---|
| Contact form | full name, email address, company, job title, phone number (optional), preferred billing option, message |
| Demo booking | name, email address, selected date and time, any information you provide through Calendly |
| User account | name, email address, role, company, password (stored only as a one-way cryptographic hash) |
| Customer relationship | customer and contact person details, billing details, correspondence |
| Suppliers and their contacts | company name, tax ID, contact name, email address, phone number, and the quotes, prices and documents submitted |
| Technical data | IP address, browser type, date and time of access, login events and error logs |
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Platform and managing accounts | performance of a contract (Art. 6(1)(b) GDPR) |
| Responding to enquiries and running demos | steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Invoicing and accounting | compliance with legal obligations (Art. 6(1)(c)) |
| Securing the Platform and preventing fraud and abuse | legitimate interests (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims | legitimate interests (Art. 6(1)(f)) |
4.1. We do not sell personal data or use it for advertising. We do not make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.
4.2. Fields marked as required are necessary for us to respond to your enquiry or to create your account. If you do not provide them, we will be unable to provide the requested service.
5. Cookies
5.1. The procumi.com website does not use analytics, profiling or advertising cookies. To know how many people visit the website, we use our own counter, without cookies and without storing anything in your browser: each page view sends only the page, the source of the visit (for example, the website you came from) and, where relevant, a click on the trial or demo button. While the page stays open, it sends a signal every 30 seconds with a random number created when the page loads and not saved in your browser, so we know how many people are on the website at that moment. From your IP address we work out your approximate city and country, on our own server and on the spot, using the DB-IP Lite database, without passing it to anyone else; the IP address is not saved. For visitors in the last minute we temporarily keep the city, country and open page in the server's memory only; the database keeps only daily totals by page, source and country, which cannot identify a visitor. The legal basis is our legitimate interest in understanding how many people visit the website and where they come from.
5.2. The Platform uses a single, strictly necessary cookie to keep you signed in. Under EU and Romanian law, this cookie does not require consent.
5.3. Demo bookings are handled by Calendly, which may set its own cookies in accordance with its privacy policy.
5.4. The Romanian home page can play a product video hosted on YouTube, a service provided by Google Ireland Limited. The player loads only after you press play, in privacy-enhanced mode (youtube-nocookie.com). During playback, Google may process your IP address and store information in your browser under its own privacy policy.
6. Recipients
6.1. We share personal data with sub-processors that provide hosting, email delivery and automated document extraction. They process it solely on our behalf, under contracts that meet the requirements of Article 28 GDPR. The full, current list, including each provider’s service and location, is published on our Sub-processors page.
6.2. When you look up a company by its tax ID, the Platform queries the public web service of the Romanian National Agency for Fiscal Administration (ANAF). Exchange rates are retrieved from the National Bank of Romania without sending any personal data.
6.3. We disclose personal data to public authorities only where required by law.
7. International transfers
Some of the sub-processors listed above are located outside the European Economic Area. We transfer personal data only with appropriate safeguards under Chapter V GDPR: the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified, or the European Commission’s Standard Contractual Clauses. You can request further information about these safeguards by contacting us.
8. Retention
- Customer account data: for the term of the contract and 30 days after it ends. Backups are deleted within a further 30 days.
- Accounting records: for the period required by Romanian Accounting Law No. 82/1991.
- Enquiries and demo bookings: up to 12 months after the last interaction, unless a contract is concluded.
- Security logs: up to 90 days, unless needed to investigate an incident.
9. Security
9.1. We implement appropriate technical and organisational measures in line with Article 32 GDPR. These include encryption in transit (HTTPS/TLS), one-way hashing of passwords, logical segregation of each customer’s data, role-based access control and regular backups.
9.2. Where required by law, we will notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it, and we will inform affected customers and data subjects without undue delay.
10. Your rights
10.1. Subject to the conditions of the GDPR, you have the right to access (Art. 15), rectify (Art. 16) and erase (Art. 17) your personal data, to restrict processing (Art. 18), to data portability (Art. 20) and to object to processing (Art. 21). Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
10.2. Please send requests to support@procumi.com. We will respond within one month of receipt. Where necessary, we may extend this period by two further months under Article 12(3) GDPR and will tell you if we do. We may ask for additional information to verify your identity.
10.3. You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28–30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, www.dataprotection.ro, or with the supervisory authority in your country of residence.
11. Changes to this Policy
We may update this Policy from time to time. The effective date of the current version is shown at the top. We will notify customers of material changes by email.
← Back to home