Terms and conditions

1. Who operates Onesta

Onesta is operated by Romania Business Labs SRL, fiscal code (CUI) 29617927, trade register number J40/997/2012, registered office at Bulevardul Nicolae Bălcescu 25, Bucharest, Romania, 010045 ("Onesta", "we"). You can write to us at contact@onesta.app.

2. What Onesta is

Onesta is software provided online (SaaS) for accounting firms. The firm uses it to organise its work for clients: the client portfolio, supplier documents received through e-Factura (SPV), booking them, the calendar of returns and the cabinet the firm invites its clients into.

Onesta is not an accounting firm and does not provide accounting, statutory accounting expertise or tax advisory services. We keep no one's books and we neither sign nor file returns or other documents on behalf of the firm or its clients.

The calculations, deadlines and suggestions in Onesta are a working aid and do not replace the firm's professional judgement.

The AI team is an optional part of Onesta: software assistants (Mara, Radu, Dana) that read the firm's data and prepare proposals — checks in SPV, document requests to clients, drafts of returns. They do not file returns, sign, send anything to SPV, make payments or change access rights; a proposal is applied only after a person at the firm confirms it. The firm can switch an assistant off at any time, for one client or for the whole firm.

3. The firm's responsibility

The firm remains solely responsible, towards its clients and the authorities, for the books, for the returns and documents it prepares, signs or files, and for complying with the professional rules that apply to it. You check what the software prepares before you use it.

The firm makes sure it has a basis to upload or connect its clients' data in Onesta (for example the contract with the client and the necessary authorisations) and that the data is correct.

4. The account and its users

The account belongs to the firm. The person who creates it confirms they are entitled to accept these terms on behalf of the firm.

• The firm may invite members of its team; they work in the firm's account, under the firm's responsibility.
• The firm may invite its clients into the client cabinet, where they see their own company's data and send documents. An invited client does not see other clients' data.
• The firm may withdraw the access of a team member or a client at any time.
• Every user keeps their sign-in details confidential. If you suspect unauthorised access, tell us at once at contact@onesta.app.

5. Acceptable use

You do not use Onesta for unlawful activities, you do not try to access other firms' data, bypass security measures or overload the service, and you do not upload malicious software. We may suspend access that endangers the service or other people's data; we tell you when we do.

6. Trial, subscription and payment

• A new firm account has a free 14-day trial of the Onesta workspace. The AI team has its own trial month, described below.
• After the trial, use continues on a paid subscription. We publish the price on onesta.app and show it in the app before we ask for any payment.
• We charge nothing automatically without a payment method saved by the firm. If you do not choose a subscription when the trial ends, we may limit access to the account; the data stays the firm's and you can export it.
• We issue an invoice for every payment.
• We may change the price for future periods by telling you by email at least 30 days in advance; if you do not agree, you can close the account before the change.
• The AI team has its own trial month, which is paid: €99 excl. VAT per firm, invoiced when the month starts. We tell you the monthly price that follows before the trial month ends; if the firm does not confirm it, the AI team stops and nothing more is owed. The AI team's price includes the Onesta subscription: the workspace is not paid for separately. With a pilot code received from Onesta, the trial month is free and the AI team's price is reduced by 50 % for 12 months.

7. Your data, export and closing the account

The data the firm enters or connects remains the firm's and its clients'. We use it only to provide the service, as set out in section 8 and in the privacy policy.

You can export the firm's data from the app or on request at contact@onesta.app, and you can close the account at any time. After closing we delete the data within 30 days, except backups, which expire in their normal cycle, and data the law requires us to keep (for example the invoices we issued).

We may close an account for a serious breach of these terms or for non-payment, after telling you by email and giving you time to export the data.

8. Data processing agreement (art. 28 GDPR)

For the personal data the firm uploads or connects in Onesta — for example invoices, SPV / e-Factura documents, payroll including CNP (Romanian personal numeric code) — the firm is the controller and Onesta is the processor. This section is the data processing agreement between the firm and Onesta under art. 28 of Regulation (EU) 2016/679 (GDPR) and is part of these terms.

• Subject and duration: hosting and processing the data needed for Onesta to work, for the life of the account and until deletion as set out in section 7.
• Data subjects: the firm's clients and the people who appear in their documents — directors, employees, contacts at their suppliers and customers — and the users the firm invites.
• Categories of data: identification and contact data, data from invoices and tax documents, payroll data including CNP.
• Instructions: we process the data only on the firm's documented instructions — these terms and the actions the firm takes in the app — unless the law requires otherwise; we then tell you, where the law allows.
• Confidentiality: the people in our team who have access to the data are bound by confidentiality and have access only as far as necessary.
• Security: we apply appropriate technical and organisational measures (art. 32 GDPR), including encrypted connections, access control by account and role, separation of data between firms, and backups.
• Sub-processors: the firm gives us a general authorisation to use sub-processors for cloud hosting, transactional email and payment processing and, if you use the AI team, for running the AI models that prepare the proposals. We bind them by contract to the same data protection obligations. We tell you before adding or replacing a sub-processor and you may object; if we find no solution, you can close the account. We send the current list on request.
• Transfers: the data is hosted in the European Union. Any transfer outside the European Economic Area takes place only with the safeguards of chapter V of the GDPR.
• Assistance: we help you, as far as we can, to answer data subject requests and with impact assessments or consultations with the supervisory authority. Requests we receive directly from data subjects we pass on to you.
• Personal data breaches: we notify you without undue delay after becoming aware of a breach affecting the data in your account, with the information we have, so that you can meet your notification obligations.
• End of processing: when the account is closed, after you have had the opportunity to export the data, we delete it as set out in section 7, unless the law requires us to keep it.
• Audit: we make available the information needed to demonstrate compliance with these obligations and allow reasonable audits, announced in advance, by you or an auditor you mandate, under confidentiality.

9. Access to ANAF / SPV

Onesta accesses SPV / e-Factura only with the access token the firm (or its client) obtains from ANAF with its own digital certificate. We use the token to download the documents the firm asks for and to send an e-Factura to SPV only when a person at the firm sends it by their own action. Onesta sends nothing to ANAF on its own initiative and files no returns. You can disconnect the access at any time.

10. Availability and changes to the service

We do our best to keep Onesta available and working correctly ("best effort"), but we do not guarantee uninterrupted operation and we offer no service level agreement (SLA). Interruptions may occur for maintenance and updates or because of our providers and ANAF systems.

We develop Onesta continuously: we may add, change or withdraw features. If we withdraw an important feature you use, we tell you in advance.

11. Intellectual property

The Onesta software, the brand and the content of the website belong to Romania Business Labs SRL or its licensors. For the life of the account, the firm has a non-exclusive, non-transferable right to use Onesta for its business. The firm's data remains the firm's.

12. Limitation of liability

Onesta is a working tool: we are not liable for the firm's bookings, returns or decisions, nor for penalties arising from them. We are not liable for indirect losses, such as lost profit or lost clients. Our total liability is limited to the amounts the firm paid for Onesta in the previous 12 months. These limits do not apply where the law does not allow liability to be limited, for example for intent or gross negligence.

13. Changes to these terms

We may update these terms. The version in force is published on this page with its date and version identifier. For important changes we tell you by email or in the app at least 30 days in advance; if you do not agree, you can close the account before they take effect.

14. Governing law and disputes

These terms are governed by Romanian law. We first try to settle any disagreement amicably; disputes that remain unresolved are settled by the competent courts of Bucharest.

15. Contact

For any question about these terms: contact@onesta.app · Romania Business Labs SRL, Bulevardul Nicolae Bălcescu 25, Bucharest, Romania, 010045.