Legal

Privacy Policy

Last updated: May 2026

1. Data Controller

Connecting ("we", "our", "us") is the data controller responsible for your personal data. We are a business facilitation service registered and operating in Bucharest, Romania, connecting international businesses with Romanian legal, financial, and strategic professionals.

Website: partnerup.ro
Address: Bucharest, Romania
Contact: contact form or privacy@partnerup.ro

2. What Data We Collect

2A — Public Website Enquiry Form

When you submit our enquiry form, we collect the following personal data:

Company name and email address (required)
Phone number (optional)
Country of registration (required)
Contact name (optional)
Industry sector and service interest (required)
Investment scale (optional)
Your message and stated business goals (required)

We do not collect payment information. We do not use tracking cookies, advertising pixels, or third-party analytics scripts on this website without your consent.

2B — Partner Portal (Authorised Users Only)

The Partner Portal is a private, invitation-only tool for authorised business partners. If you use the Portal, the following data is stored and processed:

Browser localStorage (on your device): Commission reports, invoice records, portal settings (commission rates, company details, IBAN), activity logs, upload column profiles, and your portal access password. This data is stored locally on your own device.
Cloud storage (Netlify Blobs): If cloud sync is enabled, commission reports are synchronised to encrypted cloud storage operated by Netlify Inc. This enables shared access across authorised devices. See Section 6 for details.
Uploaded Excel files: Files you upload for calculation are parsed client-side in your browser. Raw file data is not transmitted to or stored on any server — only the calculated results are retained.
Financial data within reports: Includes calculated turnover (EUR/RON), commission amounts, client names extracted from your uploaded file, exchange rates, and period information.
Invoice data: Invoices generated within the Portal are stored in your browser's localStorage. They include your company details, client name, amounts, and issue/due dates. Invoices are not transmitted to any external server unless cloud sync is enabled.
Activity logs: The Portal maintains a local activity log of user actions (uploads, saves, deletions, settings changes) limited to the last 50 entries. This log is stored only in your browser's localStorage.

The Partner Portal does not collect or transmit any data beyond what is described above. No analytics, advertising, or behavioural tracking applies within the Portal.

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data solely on the basis of your freely given, specific, informed, and unambiguous consent (Art. 6(1)(a) GDPR), which you provide by ticking the consent checkbox before submitting the form. You may withdraw your consent at any time by contacting us — withdrawal does not affect the lawfulness of processing prior to withdrawal.

4. Purpose of Processing

Your data is collected and used exclusively to:

Respond to your business enquiry within 24 business hours
Match you with the most appropriate professionals from our vetted network
Facilitate introductions between you and those professionals

We will not use your data for marketing, profiling, or automated decision-making.

5. Data Retention

We retain enquiry data for a maximum of 24 months from the date of submission. After this period, all personal data is securely and permanently deleted, unless an active ongoing business relationship with you requires longer retention under a separate agreement.

6. Data Sharing and Third-Party Processors

Your data is shared only as follows:

Public Website Enquiry Data

Romanian professionals in our network — only the specific professional(s) relevant to your enquiry, and only with your knowledge
Resend Inc. — our email delivery provider (resend.com), used solely to transmit enquiry notifications and your confirmation email. Resend acts as a data processor under a Data Processing Agreement (DPA) compliant with GDPR. Data is processed in accordance with Resend's privacy policy and EU Standard Contractual Clauses (SCCs) where applicable
HubSpot Inc. — our customer relationship management (CRM) platform (hubspot.com), used to record and manage business enquiries received via the contact form. HubSpot processes your company name, email, phone number, country, industry, and services of interest. HubSpot acts as a data processor under a Data Processing Agreement (DPA) compliant with GDPR. Data may be stored on HubSpot's servers in the United States under EU Standard Contractual Clauses (SCCs). You may request deletion of your CRM record at any time by contacting privacy@partnerup.ro.

Partner Portal Data

Netlify Inc. — cloud storage infrastructure provider (netlify.com). If cloud sync is enabled in the Portal, commission reports are stored in Netlify Blobs, a key-value storage service. Netlify processes this data as a data processor. Data is stored in Netlify's infrastructure and protected by Netlify's security measures and privacy policy. Netlify Inc. is a US company; data transfers are governed by appropriate safeguards under GDPR Art. 46.

We do not sell, rent, or share your data with any third-party marketers, data brokers, or advertisers.

7. International Data Transfers

The following processors are incorporated in the United States. Where personal data is transferred outside the European Economic Area (EEA), such transfers are carried out under the European Commission's Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR, ensuring an equivalent level of data protection:

Resend Inc. — email delivery (enquiry form)
HubSpot Inc. — CRM (enquiry form data)
Netlify Inc. — cloud infrastructure (Partner Portal reports, if sync enabled)

No other international transfers of your personal data take place.

8. Your Rights Under GDPR

Under the General Data Protection Regulation (EU) 2016/679 and Romanian Law no. 190/2018, you have the following rights:

Right of access — obtain a copy of the personal data we hold about you (Art. 15)
Right to rectification — request correction of inaccurate or incomplete data (Art. 16)
Right to erasure — request deletion of your data ("right to be forgotten") (Art. 17)
Right to restriction — request that we limit processing of your data (Art. 18)
Right to data portability — receive your data in a structured, machine-readable format (Art. 20)
Right to object — object to processing at any time (Art. 21)
Right to withdraw consent — withdraw your consent at any time without affecting prior lawful processing
Right to lodge a complaint — with the competent supervisory authority (see below)

To exercise any of these rights, contact us at privacy@partnerup.ro. We will respond within 30 days as required by GDPR Art. 12.

9. Right to Lodge a Complaint

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the competent supervisory authority:

Romania (lead authority): Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — www.dataprotection.ro
Alternatively, you may contact the data protection authority in your country of residence or place of work

10. Security

All data submitted via our enquiry form is transmitted over HTTPS with TLS encryption. Our servers enforce HTTP Strict Transport Security (HSTS). We implement appropriate technical and organisational measures — including access controls, input validation, and rate limiting — to protect your personal data against unauthorised access, accidental loss, or destruction, in accordance with Art. 32 GDPR.

11. Cookies and Analytics

This website uses Google Analytics 4 (provided by Google LLC) to collect anonymous statistics about how visitors use our site — such as pages visited, time on site, and general geographic region. This helps us improve the website.

Google Analytics only activates after you give your explicit consent via the cookie banner. If you decline, no analytics data is collected or sent to Google. We implement Google Consent Mode v2, which ensures GA4 defaults to fully denied until your consent is recorded.

Analytics data collected via Google Analytics is processed by Google LLC under Google's privacy policy and our Data Processing Agreement with Google. Data may be processed in the United States under Standard Contractual Clauses.

You may withdraw or change your cookie consent at any time by clicking Manage Cookies in the footer, or by clearing your browser's local storage. We do not use any other cookies or tracking technologies on this website.

12. Partner Portal — Local Storage and Data Retention

The Partner Portal uses your browser's localStorage to store operational data on your device. This data is not accessible to us or any third party unless cloud sync is enabled. The following data is stored:

pl_settings — Commission rates, company profile, sub-contractor list, display currency
pl_history — Commission reports (turnover, commission, invoice data, client names, exchange rates)
pl_invoices — Generated invoices (up to 500 records)
pl_activity — Portal activity log (last 50 entries)
pl_api_key — API authentication key for cloud sync
pl_password — Portal access password (stored in plain text; device security is your responsibility)
pl_deleted_ids — IDs of deleted reports (prevents re-upload after deletion)
pl_consent — Record of your consent acceptance with timestamp and version

You may clear all Portal data at any time by using the "Delete All Data" function in Portal Settings → Backup, or by clearing localStorage for this site in your browser settings.

Retention: Portal data stored in your browser is retained until you explicitly delete it. Cloud-synced reports (in Netlify Blobs) are retained until you delete individual reports or use the full cloud erasure function in the Portal. There is no automatic server-side deletion schedule at this time.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in law or our practices. The "Last updated" date at the top of this page will always reflect the most recent version. We encourage you to review this page periodically. Continued use of the site following any update constitutes acceptance of the revised policy.

15. Contact

For any privacy-related enquiries or to exercise your rights, contact us at privacy@partnerup.ro or via our contact form. We will respond within 30 calendar days.

Important Notice Connecting is a facilitation service. We do not provide legal, financial, accounting, or investment advice. All services are delivered by our network of licensed Romanian practitioners in full compliance with EU regulations.