Privacy Policy

EU START S.R.L. – Privacy Policy

Pan-European B2B Platform for Business Contact Sharing

1.  DATA CONTROLLER INFORMATION

Company Name: EU START S.R.L. Registration Number: J12/2541/2025 Unique Registration Code: 51949256 Registration Date: 12.06.2025

EUID: ROONRC.J2025041291000

Registered Office: Cluj County, Cluj-Napoca Municipality, EUGEN IONESCO Street, No. 46, Apt. 1, Romania

Main Activity: 7311 – Advertising agency activities

Commercial Register Office: Cluj Tribunal

Email: office@ go-ro.eu

Website: https://go-ro.eu and all associated domains

Lead Supervisory Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

2.  SCOPE AND TERRITORIAL APPLICATION

This Privacy Policy applies to the processing of personal data in connection with our pan-European B2B platform that facilitates business connections between Small and Medium Enterprises (SMEs) across all 27 European Union member states.

Territorial Scope (Article 3 GDPR):

  Data subjects located in the European Union

  Also applies to EU citizens temporarily outside the EU

  Processing activities related to offering services to data subjects in the EU

  Cross-border processing across EU member states through country-specific domains

3.  PERSONAL DATA WE PROCESS

3.1  Business Contact Information

Categories of Personal Data (Article 4(1) GDPR):

 

 Business names and professional titles  Professional email addresses

 Business telephone numbers  Company addresses

 Professional LinkedIn profiles

 Business-related communication preferences

3.2  Platform Usage Data

 Account registration information  Platform interaction logs

 Communication facilitation records  Business matching preferences

3.3  Social Media Marketing Data (Separate Consent)

  Business contact information for social media marketing

  Only with explicit consent through separate email from platform usage

3.4  Technical Data

 IP addresses (for security and EU jurisdiction verification)  Browser information

  Device identifiers (for platform functionality)

4.  LAWFUL BASIS FOR PROCESSING (Article 6 GDPR)

4.1  Primary Lawful Bases

Legitimate Interests (Article 6(1)(f)):

 Facilitating B2B connections between European SMEs  Platform security and fraud prevention

  Business analytics for service improvement

Legitimate Interest Assessment:

  Purpose: Enable efficient B2B networking across EU markets

  Necessity: Contact sharing essential for business facilitation

 Balancing Test: Business contacts have lower privacy expectations; significant economic benefits for EU SME sector

Contract Performance (Article 6(1)(b)):

  Account creation and platform access

  Delivering requested B2B matching services

  Processing business inquiries and communications

Consent (Article 6(1)(a)):

 Social media marketing (through separate email consent)  Optional advanced features

  Data sharing beyond core platform functionality

5.  PURPOSES OF PROCESSING

5.1  Core Platform Services

 B2B Contact Facilitation: Connecting European SMEs for business opportunities  Cross-Border Trade Support: Enabling Romanian market entry for EU businesses  Market Intelligence: Providing industry insights and business matching

5.2  Platform Operations

  Account Management: User registration, authentication, profile management

  Communication Facilitation: Enabling secure business communications

  Service Improvement: Analytics for platform enhancement

5.3  Social Media Marketing (Separate Consent)

  B2B Service Promotion: Targeted marketing on LinkedIn, Facebook, Instagram, TikTok

  Visibility Enhancement: Promoting partner companies on social platforms

  Community Development: Building pan-European business networks

5.4  Legal and Security Aspects

  Compliance: Meeting EU regulatory requirements

  Security: Fraud prevention and platform integrity

  Legal Obligations: Responding to lawful requests from authorities

6.  DATA SHARING AND RECIPIENTS

6.1  Business Contact Sharing (Core Functionality)

Recipients: Other verified business users on the platform Legal Basis: Legitimate interests + User consent for specific sharing Safeguards:

 Business verification requirements

 User control over sharing preferences  Audit trails for all sharing activities

6.2  Service Providers (Article 28 GDPR)

Categories of Processors:

 Cloud hosting providers (EU-based)  Email communication services

 Analytics and monitoring tools  Payment processing services

Processor Agreements: All processors bound by Data Processing Agreements (DPAs) ensuring GDPR compliance. Complete DPA list maintained and available for inspection.

6.3  Social Media Platforms (Separate Consent)

Recipients: LinkedIn, Facebook, Instagram, TikTok Legal Basis: Explicit consent obtained through separate email Consent Process:

  Email request after platform registration

 Clear explanation of use on each social platform

 Option to refuse without affecting platform access  Consent withdrawal anytime via email

6.4  Legal Disclosures

 EU supervisory authorities (when legally required)  Law enforcement (under lawful requests)

  Professional advisors (under confidentiality obligations)

7.  INTERNATIONAL TRANSFERS (Chapter V GDPR)

 

7.1  EU/EEA Transfers

Primary data processing occurs within the European Economic Area ensuring adequate protection.

7.2  Transfers to Third Countries

Social Media Platforms (with separate consent):

  LinkedIn, Facebook, Instagram, TikTok (headquartered in USA)

 Safeguards: Standard Contractual Clauses + Additional security measures  Transfer Impact Assessments conducted for each platform

Other Third Country Transfers: When transfers to third countries occur:

  Standard Contractual Clauses (SCCs): EU Commission approved clauses

  Adequacy Decisions: Only to countries with EU adequacy decisions

  Transfer Impact Assessments: Conducted for all third country transfers

Specific Safeguards:

 Encryption in transit and at rest

 Access controls and audit logging  Regular compliance monitoring

8.  DATA RETENTION (Article 5(1)(e) GDPR)

8.1  Retention Periods

Active Business Contacts: Retained while platform account remains active Inactive Accounts: Deleted after 36 months of inactivity Communication Records: Retained for 24 months for dispute resolution Social Marketing Data: Retained only while consent is active, deleted immediately upon withdrawal Legal Compliance Data: Retained as required by applicable EU laws

8.2  Automated Deletion

  Systematic review every 12 months

 Automated deletion workflows for expired data  User notification before account deletion

9.  DATA SUBJECT RIGHTS (Articles 15-22 GDPR)

 

9.1  Right of Access (Article 15)

Request copies of your personal data and information about processing activities. Response Time:

Within 1 month Method: Online portal or email request

9.2  Right to Rectification (Article 16)

Correct inaccurate or incomplete personal data. Self-Service: Available through user account settings

Response Time: Immediate for user-controlled data, 1 month for other requests

9.3  Right to Erasure (Article 17)

Request deletion of personal data under specific circumstances. Considerations: Balanced against legitimate interests and legal obligations Process: Identity verification and lawful basis for deletion

9.4  Right to Restrict Processing (Article 18)

Limit processing of personal data under specific circumstances. Implementation: Technical restriction measures in place

9.5  Right to Data Portability (Article 20)

Receive personal data in structured, machine-readable format. Format: JSON/CSV export functionality

Scope: Data provided by user or generated through platform use

9.6  Right to Object (Article 21)

Object to processing based on legitimate interests. Process: Balancing test conducted; processing stopped unless compelling legitimate grounds exist

9.7  Social Media Marketing Consent Withdrawal

Specific Process: For withdrawing consent regarding social media marketing Email: social-consent@go- ro.eu Effect: Immediate cessation of data use on social platforms, without affecting GO-RO access

9.8  Exercising Rights

Contact: office@ go-ro.eu Online Portal: Available through user account Identity Verification: Required for all rights requests

10.  DATA PROTECTION BY DESIGN (Article 25 GDPR)

10.1  Technical Measures

 Encryption: AES-256 encryption for data at rest and in transit

  Access Controls: Role-based access with multi-factor authentication

  Pseudonymization: Where feasible for analytics and reporting

  Audit Logging: Comprehensive logging of all data access

10.2  Organizational Measures

 Privacy Impact Assessments: Conducted annually for high-risk processing in accordance with Article 35 GDPR

  Staff Training: Regular GDPR compliance training for all personnel

  Data Protection Officer: Available for privacy-related inquiries

  Incident Response Procedures: 24/7 monitoring and breach response procedures

11.  DATA BREACH PROCEDURES (Articles 33-34 GDPR)

11.1  Breach Detection

 Automated monitoring systems

 Staff training for breach identification  Third-party security assessments

11.2  Notification Procedures

Supervisory Authority: Within 72 hours of becoming aware (Article 33) Data Subjects: Without undue delay if high risk to rights and freedoms (Article 34)

11.3  Breach Response

 Immediate containment measures

 Investigation and impact assessment

 Remediation and prevention measures

12.  COOKIES AND EPRIVACY COMPLIANCE

12.1  What are Cookies

Cookies are small text files that websites place on your device while browsing. They are processed and stored by your web browser and serve crucial functions for website operation.

12.2  Cookie Categories Used

Strictly Necessary Cookies:

 

  Purpose: Essential for website navigation and feature usage

  Examples: User authentication, session security, platform functionality

  Legal Basis: Legitimate interests (Article 6(1)(f) GDPR)

  Consent: Not required, but usage transparently explained

Preference Cookies (Functionality):

  Purpose: Remember choices made for personalized experience

  Examples: Language preferences, display settings, login data

 Duration: Up to 12 months or until manual deletion

  Legal Basis: Consent (Article 6(1)(a) GDPR)

Statistics Cookies (Performance):

  Purpose: Collect information about website usage for improvements

  Provider: Google Analytics (anonymized)

  Data Collected: Pages visited, time spent, traffic source (anonymized)

 Duration: 24 months

  Legal Basis: Consent (Article 6(1)(a) GDPR)

Marketing Cookies:

  Purpose: Track online activity for targeted advertising

  Providers: LinkedIn, Facebook, Google Ads

  Usage: Only with explicit separate consent for social media marketing

 Duration: Up to 24 months or consent withdrawal

  Legal Basis: Explicit consent (Article 6(1)(a) GDPR)

12.3  Cookie Consent (ePrivacy Directive)

Consent Requirements:

  Consent required before using any cookies except strictly necessary ones

 Precise and specific information about data tracked by each cookie and its purpose  Documentation and storage of consent received from users

 Service access allowed even if user refuses certain cookies  Consent withdrawal as easy as giving consent

Consent Implementation:

 Cookie Banner: Displayed on first visit with granular options  Preference Center: Permanent access to cookie management  Specific Options: Enable/disable for each cookie category

  Documentation: Automatic preference recording with timestamps

12.4  Cookie Management

User Control:

  Platform Settings: Preference management through user account

  Browser Controls: Instructions for browser settings

  Cookie Deletion: Step-by-step guide for removing existing cookies

Consent Withdrawal:

  Permanent Access: Footer link for “Manage Cookies”

  Easy Modification: Change preferences anytime

  Immediate Effect: Real-time application of changes

12.5  Third-Party Cookies

Google Analytics:

  Purpose: Website traffic analysis (anonymized IP)

 Retention: 24 months

 User Control: Opt-out available

  Data Transfer: USA with additional safeguards

Social Media Platforms (with separate consent):  LinkedIn Insight Tag: For B2B remarketing

 Facebook Pixel: For targeted advertising

  User Control: Disable through cookie settings

13.  CHILDREN’S DATA

This platform is designed exclusively for business users. We do not knowingly collect personal data from individuals under 16 years of age. If we become aware of such collection, the data will be deleted

immediately.

14.  AUTOMATED DECISION-MAKING (Article 22 GDPR)

14.1  Business Matching Algorithm

  Purpose: Suggest relevant business connections based on industry, location, and business needs

  Logic: Machine learning algorithms analyzing business profiles and preferences

  User Rights: Right to human intervention, explanation, and challenge of decisions

14.2  Safeguards

 Regular algorithm auditing

 User control over matching preferences  Manual override capabilities

15.  UPDATES TO THIS POLICY

15.1  Policy Changes

 Users notified of material changes via email and platform notifications  Continued use constitutes acceptance of updated terms

  Previous versions archived and available upon request

15.2  Review Schedule

This policy is reviewed annually and updated as necessary to reflect:

 Changes in processing activities  Updates to applicable laws

 Guidance from supervisory authorities

Language Accessibility: This policy is also available in Romanian. Upon request, we can provide it in other official EU languages.

16.  CONTACT INFORMATION

16.1  General Privacy Inquiries

Email: office@ go-ro.eu

Address: Cluj County, Cluj-Napoca Municipality, EUGEN IONESCO Street, No. 46, Apt. 1, Romania

16.2  Data Protection Officer

Email: dpo@go-ro.eu

Responsibilities: Privacy compliance oversight, data subject rights handling, supervisory authority liaison

16.3  Supervisory Authority

Romanian ANSPDCP:

Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania Email: anspdcp@ dataprotection.ro

Website: www.dataprotection.ro

17.  CROSS-BORDER COMPLAINTS

Data subjects may also lodge complaints with the supervisory authority in their EU member state if they believe our processing violates GDPR, even though our lead authority is the Romanian ANSPDCP.

18.  SOCIAL MEDIA CONSENT PROCESS

18.1  Separate Consent Request

After registering on the GO-RO platform, companies will receive a separate email requesting consent for using their contact information for social media marketing purposes.

18.2  Information Provided in Request

The consent email will include:

 Complete list of platforms: LinkedIn, Facebook, Instagram, TikTok  Specific types of planned marketing activities

 Estimated frequency of use

 Right to refuse without consequences for platform access  Consent withdrawal procedure

18.3  Consent Management

  Recording: All consent responses documented with timestamps

  Withdrawal: Available anytime via email to social-consent@go-ro.eu

  Monitoring: Annual consent status review with reconfirmation option

18.4  Service Independence

 

Refusing or withdrawing consent for social media marketing does not affect:

 Access to GO-RO platform  B2B connection services

 Other platform functionalities

19.  EFFECTIVE DATE

This Privacy Policy is effective from June 12, 2025, and applies to all personal data processing activities of EU START S.R.L. across all EU member state operations.

Last Updated: June 12, 2025

Version: 1.0

Next Review: June 12, 2026

GDPR COMPLIANCE AGREEMENT

By using the GO-RO platform and related services, you confirm that you have read, understood, and agreed to this Privacy Policy and consent to the processing of your personal data in accordance with the terms described herein and the General Data Protection Regulation (EU) 2016/679.