Privacy policy
Last updated: August 10, 2026
This policy explains what personal data we collect through the Notaro.ro platform, for what purpose, who we disclose it to, how long we keep it and what rights you have over it. It explicitly covers the processing of identity-document data (including the CNP national ID number) through the identity vault and the documents generated for notary offices.
The data controller and the designated contact
The controller of your personal data is Notaro - cyber app, registered at Bucuresti - Adresa notaro, fiscal code 123456. For any request concerning your personal data, or to exercise your rights under the GDPR, write to gdpr@notaro.ro. This is the single address designated for such requests. Our Data Protection Officer can be contacted at: Dorin Borcan.
What data we collect
We collect the data you give us directly (name, email, phone) when you create an account and when you book, plus technical data (IP address, device type) generated automatically as you use the platform. Separately, and only if you choose to, you may store your identity-document data — see “The identity vault”.
How we use the data
We use the data to create your account, process your bookings with notary offices, send you confirmations and reminders, pre-fill the documents for an appointment when you consent to it, and improve the platform.
Legal basis for processing
We process data on the basis of performing our contract with you (your bookings), your consent (pre-filling documents from the identity vault, marketing communications) and the legal obligations that apply to notarial activity, including the notary's duty to verify your identity.
The identity vault
You may choose to store your identity-document data on the platform: first name, last name, CNP (national ID number), document series and number, address, issuer, issue date and expiry date. This data is encrypted at rest with a key the database does not hold — a database breach alone cannot read it. It is used solely to pre-fill the documents for an appointment you have explicitly consented to. You can delete it at any time from “My account”.
The CNP (national identification number)
We process the national identification number because the notary has a statutory duty to verify your identity (Art. 6(1)(c) GDPR), and sharing the CNP with the notary office through the identity vault is done on the basis of your explicit consent (Art. 6(1)(a) GDPR, read with Art. 87 on national identification numbers). The CNP is never shown in plaintext to platform support staff or administrators.
Document generation and the office's receipt of the file
When you consent to pre-filling for an appointment, the platform decrypts your identity data on the server, through a secured and audited function, and generates a Word document (.docx) that contains your CNP in plaintext. That document can be downloaded by the staff of the notary office you chose. The generated document is kept only briefly, for the period stated under “Data retention”, after which it is deleted automatically. If you withdraw your consent, the office's access stops immediately and documents already generated are deleted.
Who we disclose data to
We disclose the data strictly necessary to the notary office you choose for your appointment. We also use the following categories of provider that process data on our behalf: database and file hosting (Supabase, with data stored in the European Union), the transactional email provider for confirmations and notifications, and the map and geocoding providers used to display office locations. We do not sell your data and we do not pass it to third parties for marketing.
Data retention
We keep your data for as long as your account is active, and afterwards only for the period required by our legal obligations. Retention periods are set separately for each category of data — the audit log, appointments, notifications, messages and attachments, export and erasure requests, diaspora cases and generated documents — and are applied automatically by the platform. Generated documents containing a CNP are kept for the shortest period of all. Data attached to legally binding notarial acts is kept as notarial law requires.
Security
We apply technical and organisational measures to protect your data, including encrypting identity data with a key the database does not hold, role-based access control, tenant isolation between offices, and an audit log of privileged access.
Data sent through the contact form
When you write to us through the contact form we process your name, email address and, optionally, your phone number and subject, together with the content of your message, in order to answer you. The legal basis is our legitimate interest in answering the questions you put to us, and pre-contractual steps taken at your request. We collect only the data needed for that purpose; please do not include sensitive data such as a CNP, identity-document series and number, or health information. We keep these messages for at most 24 months after resolution, after which they are deleted or anonymised.
Your rights
You have the right of access, rectification, erasure, restriction of processing, portability and objection. You can download a copy of your data and request deletion of your account directly from “My account”. Each right is explained in detail on the “Data protection (GDPR)” page. For any request, write to gdpr@notaro.ro.
Supervisory authority
If you are unhappy with how we process your data, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. General Gheorghe Magheru 28-30, Bucharest.