Legal

Privacy Policy

Last updated: 29 September 2026 · Versiunea în limba română

1. Who we are and how to contact us

The controller of the personal data processed through Cecomand is MRD TECH HOLDINGS S.R.L., with the identification details above ("Cecomand", "we"). This policy explains what data we process, where we get it from, why and on what legal basis, to whom we disclose it, how long we keep it and what rights you have, under Regulation (EU) 2016/679 (the "GDPR"), Law no. 190/2018 and Law no. 506/2004.

The policy applies to the cecomand.ro website, to the horeca.cecomand.ro app for venues, to the Cecomand apps for iOS and Android, when available (the "Apps"), and to our communications — together, the "Platform" — as well as to everyone who uses it: visitors, Account holders, contributors, people who propose or claim a Venue, members of venue teams and people who contact us.

How to contact us. For any question about your data or to exercise your rights, write to us at [email protected], call us on +40 746 666 068 or send us a letter at our registered office. You get a reply from a person, in Romanian or in English.

Data protection officer (DPO). We have not designated one, because the law does not require us to: we are not a public authority or body; our core activities do not currently consist of regular and systematic monitoring of individuals on a large scale, nor of large-scale processing of special categories of data or of data relating to criminal convictions (article 37(1) GDPR); we do not process personal identification numbers (CNP) or other national identification numbers on the basis of legitimate interest (article 4 of Law no. 190/2018) — we ask you to redact them in the files you send, we do not extract them, and we replace claim documents in which they were left unredacted with redacted versions (section 3.6). We reassess this conclusion periodically, especially as the service grows (for example, when Loyalty Programmes operate at scale). For data protection matters, use the same e-mail address.

This policy supplements the Cecomand Terms and Conditions (the "Terms"); capitalised terms (for example, "Account", "Venue", "Contribution", "Venue Team") have the meaning given to them in the Terms. It is an information document: it does not ask for your consent to anything, and when we need your consent we ask for it separately. The exception is section 17, which forms part of our contract with venues.

2. Our roles

Our role depends on who decides why and how the data is used, and it tells you whom to contact.

2.1. We are a controller

We make those decisions for: the Account and sign-in (including through Google or Apple); venue discovery (search, the map, Venue Pages, the features that use location); Contributions, their review by the community, moderation, the trust level, points and badges; proposals for new venues; venue claims; the „Pentru restaurante” ("For restaurants") form; recording QR code scans and the statistics calculated from them; Platform security, abuse prevention and technical logs; our communications; traffic analytics tools, if we use them, with your consent; our own purposes concerning members of venue teams (account security, Pro Plan billing, defending our rights).

2.2. We are joint controllers with a Venue for its Loyalty Programme

When a Venue offers a Loyalty Programme or a Prepaid Balance through Cecomand, Cecomand and the Venue will be joint controllers (article 26 GDPR) for the Programme data: enrolment, points or stamps, rewards, the balance and their history. The essence of the arrangement between us: Cecomand operates the Platform and the Account, ensures security, handles security incidents and responds to your data requests; the Venue sets the Programme rules, uses members' data at the venue (for example, when granting rewards) and answers questions about points, rewards and the balance; you can contact either of us, and if you write to us about something that concerns the Venue, we pass your request on to it. What the Venue later does with the data in its own systems (for example, in its cash register) is its responsibility, as an independent controller, and the Venue may send you marketing messages only with your separate consent.

2.3. We are the Venue's processor

For the data that each Venue manages in horeca.cecomand.ro about its team and its activity, we act on behalf of the Venue and on its instructions (article 28 GDPR): team members and their roles, invitations, the activity log, the menu history, tables, QR codes and the scan statistics shown to the Venue, the POS connection data and, when available, Orders and the team's actions in administering the Loyalty Programme. The Venue is the controller of this data; the terms are in section 17. For questions about it, contact the Venue; we will help you get in touch with it.

2.4. Others are independent controllers

Some organisations receive data from us or directly from you and decide for themselves what they do with it: Venues, for further use in their own systems; Stripe, for fraud prevention, identity verification and combating money laundering, when payments become available; Google and Apple, for sign-in and the app stores, and Apple also for notifications in the iOS app; Microsoft, for Clarity, if we use it; OpenFreeMap and the OpenStreetMap Foundation, for the requests they receive; Freya, for the Venue's POS account. Details in section 6.4.

3. What data we process

We receive most data directly from you. Other data comes from your device (technical data), from Google or Apple (if you sign in with them), from other users (for example, when someone invites you to a Venue Team or you appear in a photo), from Venues, from OpenStreetMap and other public sources about venues and, when payments become available, from Stripe (the payment status). We take them in turn.

3.1. When you visit the website or use the Apps

• Technical data and logs. Our servers receive and record in technical logs the IP address, the date and time, the full address of the page or resource requested (which may contain the search text and, if you chose nearby venues, your approximate position — section 3.3), the page you came from, the response code and the browser identifier. We also record events such as Account creation, sign-in or a password change (with the Account identifier), the recipient and subject of each e-mail sent, and errors. To limit abuse, we count the requests coming from the same IP address in memory only, over short intervals.
• Cloudflare. The cecomand.ro website runs through the Cloudflare network, which protects and delivers it, so Cloudflare sees the requests to the website, including the IP address; your browser may also send it reports about network errors.
• Photos and maps. Your browser loads photos from our storage at Hetzner (Germany), and maps directly from OpenFreeMap, which receives your IP address, information about your browser and the map area displayed. In horeca.cecomand.ro, your browser loads the map in the Venue's profile directly from the servers of the OpenStreetMap Foundation (United Kingdom), which receive the same data. Your browser loads your Google account photo, if you use it, from Google.
• Browser storage, strictly necessary: on cecomand.ro, cecomand.session (the session and basic Account data, until you sign out or delete your Account; we delete an expired session on your next visit), cecomand.consent (your choice regarding analytics cookies) and cecomand.near-asked (the fact that we asked you for your location in that tab, until you close it); on horeca.cecomand.ro, cecomand.business.session (the session in the dashboard, deleted in the same way) and cecomand.business.lastVenue (the last Venue opened in the dashboard, until you clear the site data). On a device that others also use, sign out when you have finished.
• Traffic analytics. We do not currently use any analytics tool. If we use Google Analytics 4 or Microsoft Clarity, we will load them only after you accept, and your position will not reach them.

We do not keep a history of your searches in your Account.

3.2. Your Account

• Account data: your e-mail address (unique on the Platform), your first name and surname (the registration form on the website asks for them; when you sign in with Google or Apple they may be missing, and you can change them in „Profil și setări”), your phone number (optional; we ask for it when you register to manage a Venue), your password (stored only as a salted hash), the date of creation, of the last change and of the last sign-in, the Account status and whether the e-mail address has been confirmed.
• Display name. If you do not fill in your first name and surname, in a few places we use your e-mail address instead: in the e-mail by which a Venue receives the claim code you requested (section 3.6), in the list of a Venue Team, in the Venue's activity log and in the menu history, for your actions as a member of the Team, and in the invitations you send. Fill in your name to avoid this.
• Sessions: an access token valid for 60 minutes and a refresh token valid for 30 days from its last use, stored only as a hash, together with the sign-in method (password, Google or Apple). We do not record device identifiers.
• Signing in with Google, if you choose it: Google sends us the identifier of your Google account, your e-mail address and whether it is confirmed, your name and the address of your profile photo. We keep the identifier, the e-mail address, the confirmation, the photo address (updated at each sign-in) and the date of linking; we use the name only to complete the Account when it is created. We do not receive the password and we have no access to other data in your Google account.
• Signing in with Apple, if you choose it: Apple sends us a unique identifier, your e-mail address — possibly a relay address ending in @privaterelay.appleid.com, if you hide your address — and, only at the first sign-in, your name, if you choose to share it. So that we can revoke access when the Account is deleted, we may keep the refresh token issued by Apple. We do not receive the password of your Apple account.
• Automatic linking. If Google or Apple confirms to us an e-mail address that already belongs to an Account, we link that sign-in method to that Account.
• Profile photo, if you upload one: we convert it into two small sizes, remove its metadata and store it at a public address that is hard to guess; we show it only to you, not to other users.

3.3. Location

We use your location only if you allow us to through the browser's or the phone's permission; without it, you can choose the city or neighbourhood or search by name.

• Search, „Lângă mine” ("Near me") and „Cele mai apropiate” ("Nearest"). The browser or the App asks for your permission. On cecomand.ro, the first time you open search in a tab, we automatically request your position: if you have not decided yet, the browser asks you; if you have already given it permission, we receive the position without a new prompt. When we receive it, we round the position to approximately 100 m (three decimal places), put it in the page address (the langa parameter) and send it to our servers, to show you the venues located no more than approximately 5 km away. Because it is in the page address, the rounded position stays in the browser history and anyone who receives the link can see it.
• „Aproape de mine” ("Close to me"), in community review: if you are a Trusted Contributor and choose to see nearby proposals first, we send your position with a precision of approximately 1 m, only to sort the list.
• What we do not do: we do not save your position in your Account, we do not keep a location history and we do not use location to verify Contributions. Your position may, however, appear as part of the request address in the technical logs, which are kept for up to 12 months.
• The pin in „Adaugă un local” ("Add a venue") is not your location but the venue's: you place it, and our server finds the address through the OpenStreetMap Foundation's Nominatim service.

The legal basis is your consent, given through the browser's or the phone's permission. You can withdraw it at any time in their settings, by removing the location permission for cecomand.ro or for the App; after that we no longer receive your position. If you press „Lângă mine” again, you stop sharing your position only for the search that is open: as long as the permission remains active, we receive it again the first time you open search in a new tab.

3.4. Contributions

• The menu photos and PDF files you upload, with the original file name, the date, the Venue and the reading status. We convert photos and remove their metadata (EXIF, GPS); we keep PDF files as you send them, with their metadata (for example, the author), which becomes public if the file is published as the "Original Menu"; if the metadata contains your name, delete it before uploading.
• What the artificial intelligence service reads: the categories, dishes, descriptions, prices, portion weights, the confidence level of the reading of each line and the warnings (section 5).
• The corrections you propose (price, name, description, unavailability, removal), with your free-text note, the date and the Venue; votes, if you are a Trusted Contributor (the decision, the reason, the note); decisions on your Contributions (the status, the reason for a rejection, who decided).
• Contributor record: accepted and rejected Contributions (including as spam), votes that did or did not match the final decision, the trust score and level, any level set by our team, points, rank, badges, the venues you have contributed to and your streak of weeks with Contributions.
• Fiscal receipts, only when the feature becomes available: the photo and what we read from it (the date, the total, the products, quantities and prices). We do not currently accept receipts.

To send menu files, corrections or votes you need an Account; you can propose a new venue without an Account too (section 3.5). You can send up to 30 corrections in 24 hours, and uploads and submissions are also limited by IP address.

3.5. Proposing a venue („Adaugă un local”)

We process the details of the proposed venue (name, type, street, city, neighbourhood, phone, website, pin), your name and e-mail address (mandatory even when you are signed in), the „Reprezint acest local” ("I represent this venue") tick box and the Google Maps link, if you add it. If you are signed in, we link the proposal to your Account; you can also propose a venue without an Account. Only our team sees your name and e-mail address, and we use them to contact you about the proposal; those who check the proposal see only a short name, the alias (section 6.1).

Our server opens a short Google Maps link at Google, only to find out the full address of the link. For the pin, our server sends the text of the address or the coordinates of the pin to the OpenStreetMap Foundation's Nominatim service. In both cases we do not send any data about you.

3.6. Claiming a venue

When you claim a Venue, we process:

• the Venue and the declared role: „Proprietar sau administrator” ("Owner or administrator") or „Manager al localului” ("Venue manager");
• your phone number, which is mandatory and used only for questions related to verification;
• the company name and tax identification number (CUI), if you declare them to us (the CUI of a sole trader (PFA) or of an individual enterprise (II) can identify a person), and the brand chosen;
• the documents uploaded (registration certificate, contract, letter of authorisation: PDF, JPEG or PNG, up to 5, of up to 10 MB each), with their name, type and size. We keep them exactly as you send them, including their metadata (for example, the date or place where the photo was taken, if present);
• the verification code record: the code (only as a hash), when it was issued, its validity, each time it was sent, the attempts to enter it and the Venue's e-mail address to which it was sent;
• the decision, its date, who decided and the reason for a rejection.

The e-mail sent to the Venue names you. For verification by code, we send a 6-digit code to the Venue's e-mail address registered with us, and the message says who asked to manage the page: your name or, if you have not filled it in, your e-mail address. That way, whoever reads the Venue's inbox can refuse to give the code to someone they do not recognise. If needed, our team may also call the Venue's public phone number to read out a code.

Do not upload identity documents: the company's documents are sufficient. Redact the CNP, the series of an identity document and other people's data that is not needed. If a document nevertheless contains an unredacted CNP or identity document series and number, we ask you for a version in which they are redacted and immediately delete the original document; after the decision we do not keep documents containing such data.

3.7. The „Pentru restaurante” form

If you leave your details in the contact form on the „Pentru restaurante” page, we process your first name and surname, the Venue, your e-mail address and, if you fill them in, your phone number and message, to contact you about using Cecomand for your Venue.

3.8. A Venue Team (horeca.cecomand.ro)

If you are a member of a Venue Team, in addition to your Account data we process:

• your membership of each Venue and brand, your role (Proprietar (Owner), Manager, Personal (Staff), Contabil (Accountant) or a role defined by the Venue), since when you have held it and who added you;
• invitations: the e-mail address and name of the person invited, the roles, who invited them, the status and the dates; we keep the link, valid for 7 days, only as a hash;
• your last activity (the time of your last sign-in);
• your actions in the activity log and in the menu history, with your name (or your e-mail address, if you have not filled in your name) — for example, who changed the menu, who published a menu file, who decided on a suggestion;
• if you connect the POS system: the user name of the POS account (in plain text), the password and the access key (encrypted), who connected it and when.

Owners and Managers see, for each member, the name, e-mail address, phone number, roles and last activity.

3.9. QR codes on tables

When you scan the QR code of a Venue or of a table, we record the code, the Venue, the table, the time and the device type (phone, tablet or computer), inferred from the browser identifier, and then send you to the Venue Page, with the table in the page address. We do not save the IP address or the Account in the scan record. To count repeated scans only once, we keep for 30 minutes an irreversible fingerprint (hash) of the code, the IP address and the browser identifier. We do not count scans made by automated programs. You do not need an Account to scan.

3.10. Loyalty, prepaid balances, payments and orders (when available)

These features are not yet available. When a Venue activates them, we will process, as applicable: enrolment in its Loyalty Programme, recorded visits and purchases, points or stamps, rewards, the Prepaid Balance and its movements, Top-ups (the amount, date, status, payment identifier), Orders (the products, the table or collection time, the price, the status) and requests for withdrawal or refund. You enter your card details directly with Stripe and they do not reach us; we receive only the payment status and its identifiers. We will show you what data is processed before you enrol or pay, and we will update this policy before launch, if needed.

3.11. Communications with us

• Your messages: what you write to us or tell us on the phone (questions, data requests, complaints, notices of illegal content, appeals), your contact details and our replies.
• Our e-mails, all related to the service: password reset; setting a password for Accounts created by our team; invitations to a Venue Team and Owner invitations; the claim code sent to the Venue; the outcome of the claim (approved or rejected, with the reason); the reason for rejecting a venue you proposed and the statement of reasons for other moderation measures that do not appear in your Account (article 13.4 of the Terms). The record of sending (the recipient, the subject, the time) remains in the technical logs.

3.12. The mobile Apps

When they become available, the Apps will also process: the type and version of the operating system and of the App, the notification token (only if you turn on notifications) and the photos or files you choose to upload (we access the camera and photos only when you add a photo). We do not use the device's advertising identifier. Details in section 14.

3.13. Data about other people

• People in photos and documents. A photo may capture people, and a receipt or a document may contain names or card digits. Photograph only the menu and redact other people's data. If you appear in a photo published on Cecomand, write to us and we will remove it.
• Venue data. The Venue Page shows the address, the pin, the phone number, the website, the booking link, the Instagram account, the opening hours and the photos. We obtain them from OpenStreetMap, from the community or from the Venue, or our team adds them from the venue's public sources. The Venue's e-mail address (used for the claim code) and its Facebook or TikTok accounts are not public. For a sole trader or an individual enterprise, some data (for example, a mobile phone number) may identify a person (section 4.3, point B).
• Invited people. When you invite someone to a Venue Team, you give us their e-mail address and name; invite only people who expect it.

3.14. What we do not ask for

• We do not ask for, and we do not build, a profile of your health or religious beliefs. The labels „vegetarian”, „vegan”, „de post” ("Lenten"), „fără gluten” ("gluten-free"), „fără lactoză” ("lactose-free"), „picant” ("spicy") or „halal” describe dishes, not people, and we do not save the filters you choose in your Account.
• We do not ask for identity documents; for a claim, use the company's documents.
• We do not ask for your CNP and we do not extract it from files. If a receipt or a document contains it, redact it before uploading.
• We do not ask for your date of birth: when you create your Account you confirm that you are at least 18 years old (section 12).

4. Purposes and legal bases

4.1. Why we process data and on what legal basis

The letters in the "Legal basis" column refer to article 6(1) GDPR: a) consent; b) a contract or steps taken at your request before entering into it; c) a legal obligation; f) legitimate interest — the interest is shown in the table and, for the main processing operations, explained in section 4.3.

We do not use data for other purposes. If we want to use it for a new purpose (for example, to train artificial intelligence models or for statistics offered to Venues), we will inform you beforehand and, where the law requires it, ask for your consent.

4.2. What happens if you do not give us data

In general, you have no legal obligation to give us data; the exception is the billing data for the Pro Plan, when you sign up for it, which the law requires us to put on the invoice, and without which we cannot conclude the contract. Some data is, however, necessary for the feature you request: without an e-mail address and password (or Google or Apple) we cannot create the Account; without a name and e-mail address we cannot receive a venue proposal; without a phone number and without a code or documents we cannot verify a claim. We ask for your name when you register on the website, and for your phone number when you register to manage a Venue; otherwise, the name and phone number in your Account, location, the profile photo and consent to traffic analytics are optional; without a name you appear as „Un contributor” ("A contributor"), and in a few places we use your e-mail address (section 3.2). You can also use the public pages without an Account.

4.3. Legitimate interest assessment

For each processing operation based on legitimate interest we have carried out the balancing test required by article 6(1)(f) GDPR. Below are the conclusions for the main processing operations; for the others, the interest is the one shown in the table in 4.1, and we will send you the assessment on request.

4.4. Your right to object

5. Automated processing and artificial intelligence

5.1. Automatic reading of menus

We immediately send the menu photos and PDF files uploaded by contributors or by a Venue Team to the Google Gemini API, provided by Google Cloud EMEA Limited (Ireland) as our processor, to extract the categories, dishes, descriptions, prices and portion weights. We send only the file and the reading instructions, without your name, e-mail address or other Account data; any people or data captured in the file do, however, reach Google along with it.

The file reaches us and Google as soon as you select it, even if you do not then submit the Contribution, and we keep it like any unpublished file (section 8). It is seen by our team, by the Venue Team of a Claimed Venue (without your name) and by the Trusted Contributors who check the proposal; it becomes public only if it is published as the "Original Menu" (section 6.1).

• we use the paid services of the Gemini API: Google does not use the files and responses to improve its products;
• Google keeps them for up to 55 days, only to prevent abuse, and may process them temporarily outside the European Economic Area (EEA; section 7);
• the result is a proposal: lines read with a low confidence level are highlighted, and you check and correct everything before you submit the Contribution, which then goes through the review described in article 6.4 of the Terms;
• if the reading fails, we retry it automatically; after no more than 5 attempts in total, the file waits for a person from our team or from the Venue Team, who can send it for reading again;
• in the Apps we ask for your explicit permission before a photo is first sent to this service; if you refuse or withdraw it, you can still send written corrections.

We do not use your files to train artificial intelligence models, and what the service reads does not reach the menu without confirmation by a person: you, the community, the Venue or our team.

5.2. Contributors' trust level

After each event, we automatically calculate an internal trust score from: the age of the Account (up to 10 months); accepted Contributions, which increase the score, and rejected ones, which decrease it, more so for spam (some reasons, such as a venue that already existed or outdated information, do not penalise you); votes that did or did not match the final decision. The score determines the level: Nou (New), Contributor, De încredere (Trusted) or Expert.

From the „De încredere” level upwards, your changes to unclaimed venues apply immediately (except those that exceed the safety thresholds: a price change of more than 30%, a removal or more than 20 changes at once), the venues you propose appear on the map immediately and you can vote on other people's proposals. A proposal is decided by two concurring votes of Trusted Contributors or by the vote of an Expert or of our team. Our team may also set a level manually, up or down.

We use the score only for Contributions on Cecomand. We do not show it to you as a number, but the Trusted Contributors who check your menu proposals receive it, and the Venue Team of the venue to which you propose changes sees it (section 6.1). You see your points, your rank (Nou, Contributor, Cunoscător (Connoisseur), Expert) and your badges, which have no monetary value. On request, we tell you your score and explain how it is calculated, and a person from our team reassesses your level.

5.3. Other automated decisions

• Claiming by code. When you enter the correct code received by the Venue, the request is approved automatically and you become the Owner of the Venue Page, and the other open requests for the same Venue are rejected; the approval is necessary for the relationship you request (article 22(2)(a) GDPR). You can challenge a request rejected in this way, and a person decides on the basis of documents. Claims by documents are decided by people from our team.
• Automatic limits (corrections per day, limits per IP address, safety thresholds) stop certain actions or send them for review, without evaluating you as a person.
• The order of results does not depend on a profile of you: venues currently appear in alphabetical order; sorting by distance (only if you give us your location) or by date added will apply only when it becomes available (article 5.6 of the Terms).

Apart from approval by code, we do not make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you. For any automated decision concerning you, you can request human intervention, express your point of view and contest the decision, by writing to us.

6. Who has access to data and to whom we disclose it

6.1. Other users and the public

• The public sees Venue Pages without the identity of contributors: a community change appears only as „Actualizat de comunitate” ("Updated by the community"), with the date. We have no public contributor profiles or leaderboards. Uploaded menu files remain private until our team or the Venue Team publishes them on the Venue Page as the "Original Menu".
• Trusted Contributors receive, for the proposals they check: the author's alias, that is, a short name (the first name and the initial of the surname, for example "Andrei P."; „Un contributor” if there is no first name; for a venue proposed without an Account, the first word of the contact name or „Anonim” ("Anonymous")), the author's trust level and score, the number of accepted and rejected Contributions, the notes, the Google Maps link of the proposed venue and the evidence, through links valid for 5 minutes. The Terms require them to use this data only for the review (article 6.10).
• The Venue Team of a Claimed Venue sees, for the proposals concerning its Venue, the alias, the trust level and score, the number of accepted and rejected Contributions, the notes and the evidence; it sees all menu files uploaded for the Venue, without the name of the person who uploaded them, as well as the menu history and the activity log, where contributors appear only under their alias.
• The Venue you claim learns your name or e-mail address from the e-mail with the code (section 3.6).
• Colleagues in a Venue Team: those who manage the team (by default, Owners and Managers) see each member's name, e-mail address, phone number, roles and last activity; those with access to the activity log see the members' actions, with their names; the person invited sees your name in the invitation.
• Anyone who has the link to an invitation sees the brand, the Venues, the roles, the name of the person who sent the invitation, the invited address partly hidden (for example, a***@gmail.com) and whether an Account with that address already exists; do not give the link to anyone else.
• Our team sees the full identity, the Contributions, the score and the claim documents, each administrator only within the limits of the permissions granted to them.

6.2. Venues

In addition to what section 6.1 describes, when Loyalty Programmes, Prepaid Balances and Orders become available, the Venue whose programme you take part in or from which you order will receive the necessary data: your name, enrolment, points, rewards, the balance and their history, or the Order data, respectively. For the Programme and the balance we are joint controllers with the Venue (section 2.2); we process the Order data on behalf of the Venue, which is the seller.

6.3. Our providers

We use providers that process data on our behalf (processors), under contracts that comply with article 28 GDPR:

DPF means the adequacy decision on the EU-US Data Privacy Framework, and SCC means the European Commission's standard contractual clauses (section 7).

6.4. Independent controllers

• Google Ireland Limited, for signing in with Google, if you choose it. Once we activate this method, the Google script will load only after you press „Continuă cu Google” ("Continue with Google"); it is only then that Google receives your IP address and can read its cookies (Cookie Policy, section 4 (in Romanian)).
• Apple Distribution International Ltd, for Sign in with Apple, if you choose it; the Apple script loads only when you press the button.
• Apple and Google, as app stores (App Store, Google Play).
• Apple Inc., for the Apple Push Notification service, if you turn on notifications in the iOS app.
• Microsoft Ireland Operations Limited, for Microsoft Clarity, only if we use it and only with your consent; Microsoft declares itself the controller of this data.
• Stripe (Stripe Payments Europe, Limited and, for regulated payment services, Stripe Technology Europe, Limited), when payments become available, for fraud prevention, identity verification and combating money laundering, in accordance with Stripe's policy.
• Hyperknot Software Kft. (OpenFreeMap, Hungary): your browser loads the maps from its servers, through the Cloudflare network, which receive the IP address, information about the browser and the area displayed; it states that it does not use cookies and that it does not normally log IP addresses.
• OpenStreetMap Foundation (United Kingdom): our server sends it, through the Nominatim service, only the text of an address or the coordinates of a venue's pin; in horeca.cecomand.ro, your browser downloads the map in the Venue's profile from its servers, which receive the IP address, information about the browser and the area displayed; if you open a link to openstreetmap.org, your browser connects directly to its servers.
• Google, for Google Maps: „Vezi în Google Maps” ("View in Google Maps") links open at Google; if you paste a short link, our server opens it at Google only to find out its full address.
• FREYAPOS S.R.L., the provider of the Freya POS system, for Venues that connect it with their access credentials.
• Venues, for the further use of data in their own systems.

6.5. Authorities and other recipients

We may disclose data to authorities where the law requires or permits us to: the National Agency for Fiscal Administration (ANAF), including for reporting sellers on platforms, if this becomes applicable; the National Authority for Consumer Protection (ANPC); the National Authority for Management and Regulation in Communications (ANCOM); the National Supervisory Authority for Personal Data Processing (ANSPDCP); courts, prosecution bodies and the police, on the basis of a lawful request. We may disclose data, under a duty of confidentiality, to our lawyers, accountants and auditors, and to a potential successor in the course of a reorganisation, merger or sale of assets, with notice to you.

6.6. No selling, no advertising, no tracking

We do not sell personal data, we do not display advertising, we do not use your data for personalised advertising and we do not track you in other companies' apps or on their websites. If we use Microsoft Clarity and you accept, however, Microsoft sets cookies on its own domains which can recognise your browser on other websites too and which it also uses for its own purposes, including advertising (Cookie Policy, section 3.2 (in Romanian)). Any third party with which we share data — hosting and network, e-mail, artificial intelligence, authentication, payment and, if we use them, analytics providers — as well as any affiliated entity that might have access to it, is bound, by contract or by its public commitments, to give it protection equal or equivalent to that described in this policy.

7. Transfers outside the EEA

The servers and storage we use are at Hetzner, in Germany. Not all data stays in the European Economic Area (EEA), however: some providers and independent controllers may process data in the USA, in the United Kingdom or in other countries — mainly Cloudflare, Google (the Gemini API, sign-in, notifications and, if we use it, Google Analytics 4), Plus Five Five, Inc. (Resend), Stripe and Apple, when we use their services, Microsoft (if we use Clarity) and the OpenStreetMap Foundation. In these cases, the transfer is based on:

• the European Commission's adequacy decision on the EU-US Data Privacy Framework (Decision (EU) 2023/1795), for certified recipients, for as long as the decision remains in force;
• and/or the European Commission's standard contractual clauses (Decision (EU) 2021/914), supplemented, where necessary, by additional measures; we also rely on them if the decision on the EU-US Data Privacy Framework is invalidated or suspended;
• the adequacy decision for the United Kingdom, valid until 27 December 2031, for the OpenStreetMap Foundation.

You can request a copy of the applicable safeguards at [email protected]. To the artificial intelligence service we transmit only the uploaded menu files and the reading instructions, without Account data.

8. How long we keep data

We keep data for as long as it is necessary for the purpose for which we collected it, and then delete or anonymise it, so that it can no longer be linked to you:

• The Account (profile, sign-in methods, photo): for as long as it exists; copies of the photo may remain for a while in the cache of the browsers that displayed it. We may close an Account with no sign-in for 36 months, after notifying you by e-mail at least 30 days in advance (article 4.5 of the Terms).
• Sessions: 30 days from their last use; they also end when you sign out, when the Account is deleted and, on the other devices, when you reset your password through the link received by e-mail (within one hour at most). Password reset links: 1 hour; links for setting the password of Accounts created by our team: 7 days.
• Technical logs (of our servers and of Cloudflare), with the IP address, the browser, the addresses requested and the position contained in them: up to 12 months, except for those needed to investigate an incident, which are kept until it is closed. We do not keep your position anywhere else.
• Unpublished menu files: up to 24 months from upload, so that we can re-read and check the menu. Files published as the "Original Menu": for as long as they are published, at the latest until the Venue Page is deleted. We delete a file you sent as a Contribution, whether published or not, within 30 days at most of your request or of the deletion of your Account (we first withdraw a published file from the Venue Page); the dishes and prices already read from it remain in the menu, without your name.
• Proposals, votes, notes and their statuses: for as long as the Venue Page exists, as a history of moderation; after the Account is deleted, without your name, linked only to an internal identifier that can no longer be associated with you.
• Contributor record (points, badges, score, level): for as long as the Account exists. Menu history: the last 100 versions of each Venue's menu, with contributors shown only under their alias.
• A Venue's activity log: 12 months. Invitations: the link, 7 days; the record, 12 months after acceptance, expiry or revocation.
• Contact details in a venue proposal: 12 months after the venue is published or rejected.
• Claims (the request, the decision, the reason): 3 years from the decision, as evidence. Claim documents: 12 months from the decision; a document you remove before the decision is deleted immediately.
• The „Pentru restaurante” form: 24 months from our last contact with you.
• QR scans: approximately 13 months (400 days); the fingerprint for repeated scans, 30 minutes. The temporary cache of address and pin look-ups, not linked to you: 30 days.
• Messages with us, complaints, notices of illegal content and our decisions: 3 years from the closure of the case.
• Our invoices and accounting records (the Pro Plan): for as long as Accounting Law no. 82/1991 and the Tax Code require (currently, as a rule, 5 years from the end of the financial year, or longer where the law requires it).
• Loyalty Programmes (when active): for as long as you take part, then for as long as the Venue's legal obligations require. Top-ups and payments: for the duration of the relationship, plus the general limitation period of 3 years and the periods set by tax law; Stripe keeps its own records.
• Traffic analytics (if we use it, with your consent): Google Analytics 4 — up to 14 months; Microsoft Clarity — recordings 30 days (those marked as favourites and a sample chosen by Microsoft, up to 9 months), heatmaps and click data 9 months.
• Backups (if we have them): they are overwritten cyclically; deleted data may persist in them for up to 90 days and we do not use them to restore data deleted at your request.
• Data needed to defend a legal claim: until the dispute is finally resolved or the limitation period expires.

9. Account deletion

You can delete your Account at any time, free of charge, without telling us why. The Account is the same on cecomand.ro, in horeca.cecomand.ro and in the Apps, so you delete it only once:

• On the web: Contul meu → Profil și setări → Ștergerea contului (My account → Profile and settings → Account deletion; cecomand.ro/cont/setari): press „Șterge contul” ("Delete account"), then „Da, șterge definitiv” ("Yes, delete permanently").
• In the Apps: Cont → Setări → Șterge contul (Account → Settings → Delete account).
• Without installing or opening the App: write to us from your Account's e-mail address at [email protected] or call us on +40 746 666 068. If you write from another address or call, we may ask you for information to verify that the Account is yours. We delete the Account within 30 days at most and confirm this to you by e-mail.

Before you delete. If you are the only Owner of a Venue, first add another Owner or ask us to close the Venue Page (article 4.4 of the Terms); until then, deletion is not possible. If you have Cecomand administrator rights, we must revoke them first. When Prepaid Balances exist, use up your balance or ask for it to be refunded. Deletion is permanent.

What we delete immediately: the Account (e-mail address, name, phone number, password, sign-in methods), the profile photo, sessions, membership of Venue Teams and reset links; sessions on other devices end within one hour at most. If you signed in with Apple, we revoke the "Sign in with Apple" authorisation (you can also check this in your Apple account settings). For Google we do not keep tokens, so there is nothing to revoke; you can remove Cecomand from your Google account settings.

What we delete within 30 days at most: all menu files you sent as Contributions, whether unpublished or published as the "Original Menu" (we withdraw the latter from the Venue Page), your contributor record and the documents of any claims that are still open, which are then closed; in the menu histories we replace your name with a generic label. Files uploaded on behalf of a Venue, from horeca.cecomand.ro, remain the Venue's. Before your Account is deleted or within the 30 days after, you can ask us, free of charge, for a copy of your files (article 6.7 of the Terms).

What we keep, for the periods in section 8: the menu information taken from your Contributions (for example, dishes and prices) and the moderation history (proposals, votes, notes), without your name; decided claims (3 years) and their documents (12 months from the decision); contact details in venue proposals and invitations (12 months); the activity log of the Venues where you worked, until the 12 months have elapsed; messages with us (3 years), invoices (for as long as the law requires), technical logs (up to 12 months) and the data needed to defend a legal claim.

While you have an Account, you can also ask us at any time to delete only some data, for example a menu file you sent, whether published or not; we do so within 30 days at most. You can remove your profile photo yourself, in „Profil și setări”.

10. Data security

We apply technical and organisational measures appropriate to the risk (article 32 GDPR), including:

• all connections between your device and the Platform are encrypted (HTTPS/TLS);
• we store passwords only as salted hashes; our session tokens, reset and invitation links and claim codes, only as hashes;
• passwords and access keys for the Venues' POS systems are encrypted (AES-256-GCM);
• we check access rights on every request, and each Venue's data is isolated from that of the others;
• private files (claim documents, unpublished menu files, evidence) open only through temporary links, valid for between 5 and 60 minutes;
• we convert photos (profile, venue, dish and menu photos) and remove their EXIF and GPS metadata; we keep PDF files and claim documents as they were sent;
• we limit the number of requests, attempts and submissions, to prevent abuse;
• our team's permissions in the administration panel are granted separately, by category of data;
• the servers and storage are hosted at Hetzner, in Germany.

No measure is infallible. If a personal data breach may result in a risk to your rights, we notify ANSPDCP within 72 hours at most, where the law requires it, and if the risk is high, we inform you without undue delay. When we act as a Venue's processor, we notify the Venue without undue delay. You can help too: use a unique password, do not give anyone the links you receive by e-mail and sign out on devices that others also use.

11. Your rights

Under the conditions of articles 15–22 GDPR, you have the right:

• of access — to find out whether we process data about you and to receive a copy;
• to rectification — you change your name, phone number and photo in „Profil și setări”, and we change your e-mail address on request;
• to erasure — except for data that the law requires or allows us to keep; you can delete your Account yourself (section 9);
• to restriction, in the situations set out in article 18 GDPR (for example, while we check whether the data is accurate);
• to portability — to receive the data you provided in a structured, commonly used and machine-readable format, or to have us transmit it to another controller, where technically feasible; we do not yet have an export feature, so we send it to you on request;
• to object — to processing based on legitimate interest and, at any time, to direct marketing (section 4.4);
• to withdraw your consent at any time, without affecting prior processing: for location, in the browser or phone settings; for traffic analytics, in „Setări cookie-uri” ("Cookie settings"), in the website footer, when we use such tools; for notifications, in the phone or App settings; for sending photos to the artificial intelligence service, in the App settings; for marketing, through the unsubscribe link, if we send such messages;
• regarding automated decisions — to request human intervention, to express your point of view and to contest the decision (section 5).

How to exercise your rights. Write to us at [email protected] from your Account's e-mail address, call us on +40 746 666 068 or write to us by post at our registered office. We reply without undue delay, within one month at most of receiving the request; in complex cases or when we receive many requests, this period may be extended by a further two months, in which case we tell you within the first month and explain why. We may ask for additional information to verify your identity. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

For the data of a Venue's Loyalty Programme you can contact us or the Venue (section 2.2). For data we process on behalf of a Venue, contact the Venue; if you write to us, we pass your request on to it and help it reply to you.

Complaint. If you consider that your rights have been infringed, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, postcode 010336, Bucharest; telephone +40.318.059.211 or +40.318.059.212; e-mail [email protected]; website www.dataprotection.ro. You can also go to the competent courts. We encourage you to write to us first, so that we can resolve the issue directly.

12. Minors

The Account — and therefore uploading menus, corrections, votes, claims, Loyalty Programmes and payments — is reserved for persons aged at least 18 with full legal capacity (article 2.2 of the Terms). The reasons: the Platform uses a third party's artificial intelligence service whose terms exclude services likely to be used by minors, menus include alcoholic drinks, and the paid features require full legal capacity. Anyone can view the public pages, without an Account. We do not knowingly collect data about minors; if we learn that an Account belongs to a person under 18, we close it and delete the data, except for data the law requires us to keep. If you are a parent or guardian and believe that a minor has created an Account, write to us.

13. Cookies and similar technologies

The cecomand.ro and horeca.cecomand.ro websites use only the strictly necessary storage described in section 3.1, for which your consent is not required (article 4(6) of Law no. 506/2004); Cloudflare may set strictly necessary security cookies on cecomand.ro when bot protection is active. We could use analytics tools (Google Analytics 4, Microsoft Clarity) only with your consent; we do not currently use any, and we do not display the cookie banner. We do not use advertising cookies; if we use Clarity and you accept, however, Microsoft sets cookies on its own domains which it also uses for its own purposes, including advertising. The Apps do not use cookies of their own. The full list, the durations and how you manage your choice are in the Cookie Policy (in Romanian).

14. The Cecomand mobile Apps (iOS and Android)

The Apps use the same Account and the same rules as the website. In addition:

• Camera and photos: only when you choose to add a photo and, where possible, through the system photo picker, which gives us access only to the photos you select.
• Artificial intelligence: before a photo is first sent to the Google Gemini API, we explain what happens to it and ask for your explicit permission (section 5.1). You can withdraw the permission at any time in the App settings; after that we no longer send your photos to this service, but you can still send written corrections.
• Location: optional, requested only when a feature needs it, while you are using the App; without it, you choose the city or search by name.
• Notifications: optional; if you turn them on, we store the device token needed to send them through Firebase Cloud Messaging or the Apple Push Notification service. They do not contain sensitive data. We send you marketing notifications only if you have explicitly opted in to them, and you can turn them off at any time in the App.
• No conditions: we do not require you to turn on notifications or location in order to use a feature or to receive a reward.
• Signing in with Apple or Google: we receive only the data in section 3.2, for sign-in and the Account; we do not receive the password.
• The session is kept in the device's secure storage and is deleted when you sign out.
• No advertising and no tracking: the Apps contain no advertising tools, do not use the device's advertising identifier and do not track you in other companies' apps or on their websites, so they do not ask for your permission to track (App Tracking Transparency). They currently contain no analytics or error-reporting tools either; if we add one, we will first update this policy.
• App stores: Apple and Google process your App Store and Google Play account data as independent controllers.
• Account deletion: from the App (Cont → Setări → Șterge contul), on the web or by e-mail or phone, without reinstalling the App (section 9).

15. Communications

We send you service-related messages (section 3.11) and mandatory notices: changes to the documents, moderation decisions and the reasons for them, replies to your requests. They are not marketing and you receive them for as long as you have an Account. We do not currently send marketing messages. If we start, we will ask for your consent separately, through an unticked box, every message will have an unsubscribe link, and we will send marketing push notifications only if you have explicitly opted in to them. Venues do not receive your data from us for marketing without your consent. Our e-mails are sent from [email protected]; to reply to us, write to us at [email protected].

16. Information for venues and their teams

• Business contact details of representatives and team members (name, e-mail, phone, role): we use them to manage the relationship with the Venue (section 4.3, point F).
• Team data in horeca.cecomand.ro: we process it on behalf of the Venue (section 17); the Owner is responsible for who has access and for the roles assigned.
• Data about contributors that you see (alias, level, score, statistics, notes, files): use it only to decide on suggestions and to publish the menu; do not try to identify contributors.
• The Pro Plan (contracted through our sales team; online billing is not yet available): when you sign up for it, we process the billing data (the company, CUI, address, contact person), invoices and payments, kept for as long as the law requires.
• Payments through Stripe (when available): the company and representative data needed for identity verification is collected directly by Stripe, as an independent controller; Stripe may send us data about the Venue's account and about transactions.
• Tax reporting of sellers through platforms (Directive (EU) 2021/514, "DAC7"): if payments for Venues go through the Platform, we may be required to report data about sellers to ANAF, including personal data of sole traders and individual enterprises; we will inform you beforehand.
• The POS system: when you connect Freya, we use your access credentials to read only the catalogue (categories, products, prices, availability), not orders, customers, receipts or staff data.

17. Data processing agreement for venues (article 28 GDPR)

This section is the data processing agreement between the legal person or Professional that operates a Venue in horeca.cecomand.ro (the "Venue", as controller) and MRD TECH HOLDINGS S.R.L. ("we", as processor), for the data we process on behalf of the Venue (section 2.3). The agreement forms part of our contract with the Venue, concluded in accordance with the Terms, and applies from the moment the Venue is given access to horeca.cecomand.ro. The Venue may request a signed version at [email protected].

17.1. Subject matter, nature, purpose and duration of the processing

The storage, organisation, display, modification, synchronisation with the POS system, transmission to team members according to the roles set by the Venue, and deletion of data, as well as, when available, the management of Orders and the recording of the team's actions in administering the Loyalty Programme, on behalf of the Venue, in order to provide the horeca.cecomand.ro features described in the Terms, for the term of the contract and the deletion period in 17.4.

17.2. Categories of data subjects and of data

The members of the Venue's team and invited persons; contributors, to the extent that they appear, under their alias, in the menu history and in the activity log; persons who scan the QR codes (without identification data); when available, customers who order. The data: name, e-mail, phone, roles, invitations, last activity, actions in the activity log and in the menu history, POS access data, scan statistics and, where applicable, Order data and the team's actions in administering the Loyalty Programme. The data of members of Loyalty Programmes and of Prepaid Balances is not covered by this agreement: for that data we are joint controllers with the Venue (section 2.2).

17.3. The Venue's obligations

The Venue warrants that it has a legal basis for processing the data entered in horeca.cecomand.ro and for transmitting it to us, that it has informed the data subjects in accordance with articles 13–14 GDPR (including the team members it invites), that its instructions are lawful and that it is responsible for the accuracy of the data, for the roles and access of team members and for the exercise of data subjects' rights. The Venue must not use the activity log or members' last activity to monitor its employees outside the conditions set by law (including those of article 5 of Law no. 190/2018).

17.4. Our obligations

• we process the data only on the Venue's documented instructions (the Terms, the settings and actions in horeca.cecomand.ro, written requests), including with regard to international transfers, unless Union or Romanian law requires us to carry out processing; in that case we inform the Venue beforehand, unless the law prohibits this on important grounds of public interest; we also inform the Venue if an instruction appears to us to be unlawful;
• we ensure that the persons authorised to process the data have committed themselves to confidentiality, and we apply the security measures in section 10;
• we assist the Venue, through the horeca.cecomand.ro features and, where necessary, through additional reasonable measures, in responding to data subjects' requests and in complying with its obligations under articles 32–36 GDPR (security, breach notification, impact assessments, prior consultation);
• we notify the Venue without undue delay after becoming aware of a personal data breach affecting its data;
• on termination of the services, after the Venue has been able to request an export of the data (article 10.12 of the Terms), we delete the data or return it to the Venue, at its choice, within 90 days at most, except for data the law requires us to keep;
• we make available to the Venue the information necessary to demonstrate compliance with article 28 GDPR and allow for audits, including inspections, conducted by the Venue or by an auditor mandated by it, with at least 30 days' notice, at most once a year (or after an incident), during working hours, without affecting the security of other Venues, at the Venue's expense; available independent reports and certifications are sufficient to the extent that they cover the subject of the audit.

17.5. Sub-processors

The Venue gives general authorisation for the use of the providers in section 6.3 as sub-processors. We inform the Venue by e-mail or in horeca.cecomand.ro at least 15 days before adding or replacing a sub-processor. The Venue may object within that period, on reasonable grounds relating to data protection, and if we cannot find a solution, it may terminate the contract, with a proportionate refund of the amounts paid in advance for the Pro Plan. We impose on sub-processors, by contract, the same data protection obligations and we are liable to the Venue for their performance.

17.6. Liability

The parties' liability under this agreement is subject to article 17 of the Terms, to the extent permitted by article 82 GDPR. Each party is responsible for the administrative fines imposed on it for its own infringements.

18. Changes to the policy and language

We may update this policy when the processing operations, the providers, the Platform's features or the law change; the version in force is always at cecomand.ro/politica-de-confidentialitate, with the date of the last update. We notify you of significant changes by e-mail and/or in your Account or in the Apps at least 15 days in advance, and of changes that adversely affect your access to or use of the service, at least 30 days in advance; we notify Venues by e-mail, at least 15 days in advance. Changes required by law or for security reasons may apply immediately, and none applies retroactively. If you do not agree, you can delete your Account at any time, free of charge. You can request previous versions at [email protected].

Language. This policy is drawn up in Romanian. The English version, provided for information purposes, is at cecomand.ro/en/policy. In the event of any inconsistency, the Romanian version prevails.

This version was published and applies from 29 September 2026.