Privacy policy

1. Who we are

Romania Business Labs SRL, fiscal code (CUI) 29617927, trade register number J40/997/2012, registered office at Bulevardul Nicolae Bălcescu 25, Bucharest, Romania, 010045. For any question about personal data, write to us at contact@onesta.app.

2. Controller or processor

• For the firm's account data — names, email addresses and phone numbers of team members, the firm's name and CUI, billing details — and for the data of website visitors, Onesta is the controller.
• For the clients' data the firm uploads or connects — invoices, SPV / e-Factura documents, bank statements, payroll including employees' CNP — and for the accounts of the clients the firm invites, the firm is the controller and Onesta is the processor (art. 28 GDPR). We process this data only on the firm's instructions, under the data processing agreement in the Terms and conditions.

If you are a client of a firm, or an employee of a client, and want to exercise your rights over this data, contact the firm. If you write to us, we pass your request on to the firm.

3. The firm's account data

• What: name, email, phone and role in the firm; the firm's name, CUI and address; billing details and payment history; technical access logs (IP address, date, action). Card details are processed directly by the payment processor; we never see them in full.
• Why and on what basis: to provide the service and manage the account, including messages about the account such as the end of the trial (performance of the contract, art. 6(1)(b) GDPR); for invoicing and our own accounting records (legal obligation, (c)); for security, abuse prevention and improving the service (legitimate interest, (f)).
• How long: for the life of the account. After it is closed we delete the data within 30 days, except invoicing records, which we keep as long as accounting law requires, and security logs, which we keep for at most 12 months.

4. Website visitors, cookies and analytics

• The contact form: your name, email, phone, firm and role; the AI team trial booking: your email and number of clients (sent at the first step), then your name, phone (optional), firm, accounting software, the AI colleagues you are interested in and what you write about your month; with both forms, the page you write from, the referring address and the campaign parameters of the link (utm), without cookies — so that we can answer you (steps at your request before a contract, and legitimate interest). We keep this data for at most 24 months after the last contact unless you become a customer.
• Cookies and analytics: the website and the app use strictly necessary cookies (sign-in and your choice in the banner). Only if you accept in the banner do we also use product analytics — PostHog, on its EU cloud (servers in Frankfurt, Germany) — and, on the website, Google Analytics, to count visits and which pages and steps are used (consent, art. 6(1)(a) GDPR and art. 4(5) of Romanian Law 506/2004). Nothing of this loads before you agree.
• What analytics records: a random identifier, the pages visited (without query parameters or identifiers in the address), the browser and device type and the approximate country (derived from the IP address, which is not kept); in the app also the internal identifier of the user and of the firm. It records no names, email addresses, screen content or your clients' data, and makes no session recordings. We keep this data for at most 24 months.
• Your choice is kept for 6 months in the onesta_consent cookie (on onesta.app and app.onesta.app); PostHog's cookie (ph_…) lasts at most 12 months. You can change or withdraw consent at any time from "Cookie settings" at the bottom of the website or "Analytics preferences" in the app.

App analytics on our servers: when an action completes on Onesta's servers — a firm created, a client added, an SPV or one-conta.ro connection made, a return generated or recorded, a payroll closed, a client invited — we send PostHog (EU) an event with the internal identifiers of the user and the firm and the kind of action (for example the return's code), never names, CUI, amounts or documents, to understand how the service is used and improve it (legitimate interest, art. 6(1)(f) GDPR). You can object at any time at contact@onesta.app.

Otherwise the app uses the cookies and local storage needed for sign-in and for it to work.

5. The firm's clients' data

We process the data the firm uploads or connects only to display, organise and process it in the firm's account, as the firm asks. We do not use it for our own purposes, we do not sell it and we do not use it for advertising. Our team accesses it only when needed for support or to fix a problem at the firm's request, or for the security of the service.

Payroll data and the CNP (personal numeric code, a national identification number within art. 87 GDPR and Romanian Law 190/2018) are handled with restricted access and the same security measures as the rest of the account data.

6. Access to ANAF / SPV

Onesta connects to SPV / e-Factura only with the access token the firm (or its client) obtains from ANAF with its own digital certificate. We store the token encrypted and use it to download the documents the firm asks for and to send an e-Factura to SPV only when a person at the firm sends it by their own action. We have no access to the digital certificate, we send nothing on our own initiative and we file no returns with ANAF.

7. Who receives the data

• Cloud hosting, in the European Union: Onesta's servers and database.
• Transactional email: invitations, notifications and messages about the account.
• Payment processor: collecting the subscription.
• AI model providers, only if you use the AI team: the content from which the assistants prepare their proposals.
• Product analytics: PostHog Inc., its EU cloud (data stored in Germany) — on the website and in the app only with your consent; the events from our servers described in section 4, with internal identifiers.
• Authorities: only when the law requires it.

We do not sell personal data. The current list of sub-processors, with their names, is published on this site's "Sub-processors" page. If a provider processes data outside the European Economic Area, it does so only with appropriate safeguards (an adequacy decision or the standard contractual clauses approved by the European Commission).

8. Security

We use encrypted connections (HTTPS), separate data between firms, control access by role, make backups and keep access logs. If a personal data breach occurs, we notify the authority and the people affected when the law requires it; for clients' data, we notify the firm without undue delay.

9. Your rights

For the data Onesta controls, you have the right:

• to know what data we hold about you and get a copy (access);
• to have wrong data corrected (rectification);
• to have the data erased or its processing restricted;
• to receive the data in a structured format and pass it to someone else (portability);
• to object to processing based on legitimate interest, including marketing messages;
• to withdraw consent, without affecting processing carried out before.

We take no decisions with legal effects on you based solely on automated processing. Write to us at contact@onesta.app; we answer within one month (extendable by two months in the cases the GDPR allows). You can lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro).

10. Changes

We publish any new version on this page with its date and identifier. For important changes we tell firms by email or in the app.

11. Contact

contact@onesta.app · Romania Business Labs SRL, Bulevardul Nicolae Bălcescu 25, Bucharest, Romania, 010045.