Privacy policy

Data controller

Topocom SRL, CUI (tax identification number) RO2242027, J1992000324093, registered office at Str. Radu S. Campiniu nr. 1, 810003 Brăila, jud. Brăila. Data protection officer (DPO) contact: dpo@xcf.ro.

Data collected

• First and last name — for drawing up the request to ANCPI and issuing the tax document.
• E-mail — for delivering the document and the status notifications.
• Telephone — for contacting you if there are problems with the request.
• Billing data (address, town, county; for companies: name, CUI, Trade Register number) — for issuing the invoice.
• Property data (land register number, county, town, optional address) — for obtaining the excerpt.
• Technical data (IP, user-agent, technical cookies) — for security and fraud prevention.
• Payment data — processed exclusively by Stripe, not stored by us.
• "My orders" account (optional) — the e-mail address confirmed through a link, the date of creation and of the last sign-in. We do not use passwords.

Purposes of processing and legal basis

• Performance of the contract (Art. 6(1)(b) GDPR): processing the request and delivering the document.
• Legal obligation (Art. 6(1)(c)): issuing tax documents, RO e-Factura reporting, keeping accounting records.
• Legitimate interest (Art. 6(1)(f)): fraud prevention (Cloudflare Turnstile, rate limiting).

Recipients

Data is sent only to: ANCPI (for issuing the excerpt), Stripe (for processing the payment), SmartBill (the invoicing software) and ANAF (the National Agency for Fiscal Administration, through the RO e-Factura system, for the invoice), Cloudflare (anti-bot and DDoS protection), the e-mail provider (delivery). We do not sell or share data for marketing.

Transfers outside the European Economic Area

Some providers process our data in the United States: Cloudflare, Inc. (website security and delivery, anti-bot check) and Resend (sending e-mails, including the excerpt). These transfers rely on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which both providers are certified, and additionally on the standard contractual clauses approved by the European Commission, included in the data processing agreements. You can ask for a copy of these safeguards at dpo@xcf.ro.

Payments are processed by Stripe Payments Europe, Limited (Ireland), an electronic money institution authorised by the Central Bank of Ireland. To process the payment and prevent fraud, Stripe may transfer data to Stripe, Inc. (USA), which is certified under the Data Privacy Framework, and it processes some data as an independent controller, under the Stripe privacy policy.

Third-party data in the excerpt

The land register excerpt (extras de carte funciară) is a public document issued by ANCPI to any applicant (Law no. 7/1996) and contains data of the owners and of other holders of rights (names, sometimes the CNP — personal numeric code). The Provider obtains and transmits this data only in performing the Client's order (Art. 6(1)(b) and (f) GDPR), does not process it for other purposes and keeps the PDF file on the server for only 30 days from delivery, so that it can be re-sent on request; after this period the file is deleted automatically. The Client becomes an independent controller of the data in the excerpt received and is responsible for its lawful use.

Storage period

Invoices are issued and archived in the SmartBill invoicing software, for the period required by accounting and tax law, under SmartBill's policy. We keep the order and payment data for the same legal period. The PDF excerpt (containing third-party data) for 30 days from delivery. Technical data (logs) for 12 months. The "My orders" account is deleted automatically after 24 months without any sign-in (we notify you by e-mail 30 days beforehand) or at any time, by you, from the account page; orders and invoices remain kept for as long as the law requires, without being linked to an account. On request, we delete any data that the law does not require us to keep.

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, portability and objection. You can contact dpo@xcf.ro or, if you are dissatisfied, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — the Romanian data protection authority) at dataprotection.ro.

Security

All communications with the website are encrypted (TLS). The database cannot be reached from the internet, and internal access is limited to the people who need it. Signing in to the account is done only through single-use links sent by e-mail, and the session expires after 7 days; we do not keep passwords, and links and sessions are stored only as a cryptographic fingerprint. Backups are encrypted (AES-256). Excerpts cannot be downloaded from the account; they are only re-sent to the order's e-mail address. The website is protected by Cloudflare against automated attacks.