1. Information Collected

We collect the following personal data through the website:

• First and last name
• Personal Identification Number (CNP)
• Postal address
• Email address
• Phone number
• Signature drawn inside the Form 230 flow
• The generated and signed Form 230 PDF, together with the ANAF template version used
• Fiscal year, two-year redirection choice and confirmations submitted with the form
• Administrative notes strictly related to Form 230 processing, B230 export status and administrative operation history
• Technical metadata required for security and audit, such as cryptographically derived identifiers for IP and browser data

PDF preview inside the Form 230 page is generated so the user can verify the document before submission and does not create a database record. After submission, the signed PDF is generated on the server and stored encrypted as supporting documentation for the request.

2. Purpose of Data Processing

The collected data is used for:

• Completing Form 230, generating the signed PDF and preparing centralized B230 documents for ANAF
• Communicating with donors
• Complying with legal and tax obligations
• Preventing duplicate submissions and investigating requests or security incidents
• Handling requests for access, export, rectification, restriction or deletion of data

3. Legal Basis for Processing

Data processing is based on:

• Explicit user consent for completing and signing Form 230 on the website
• Legal obligations of the association related to tax documents and their archiving
• The association's legitimate interest in security, audit, duplicate prevention and defence of its rights

4. Data Storage Duration

Personal data related to Form 230, the signature and the signed PDF are kept for the period needed to prepare, submit and archive tax documents, according to applicable legal obligations and the internal retention policy. In the technical implementation, completed records and audit events are configured for retention of up to 10 years, while invalid or deleted records are kept for shorter periods only for traceability and abuse prevention.

If a Form 230 has already been included in a B230 export or submitted to ANAF, full erasure may be limited by legal obligations to retain tax documents. In these cases we may restrict processing or keep only the data needed for compliance and audit.

5. User Rights

According to GDPR, you have the following rights:

• Right of access to personal data
• Right to rectify data
• Right to erasure of data ("right to be forgotten")
• Right to restriction of processing
• Right to object to processing
• Right to data portability

To exercise these rights, you can contact us at contact@inimispeciale.ro or inimispeciale@gmail.com.

6. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss or destruction. Sensitive Form 230 data and generated PDFs are encrypted before storage, and the CNP is used for duplicate detection through a cryptographic identifier instead of displaying the full value in the administration lists. Access to the administration area is restricted to authorized people, and relevant actions are recorded in the audit log.

7. Data Disclosure to Third Parties

We do not sell your personal data. Data may be disclosed to ANAF for tax document submission, to authorized people supporting the association's accounting or tax processing, to technical providers that host or secure the application and database, or where we are legally obliged to do so.

8. Changes to Privacy Policy

We reserve the right to update this privacy policy. Any changes will be published on this page.