Privacy notice for people who appear in our Romanian company-status and public-procurement data

Version 0.3, 7 October 2026.

This notice explains how PPFTEC S.R.L. handles personal data in:

• two data tools (“actors”) offered on the Apify platform: Romania company status (ANAF) (ro-company-status) and Romania direct purchases & contracts (ro-procurement-monitor); and
• the procurement data copy that we prepare from public data and that only the procurement actor can read.

It is written mainly for people who run a business as a natural person in Romania (PFA, II, IF or a liberal profession), and for people whose name appears in Romanian public-procurement data.

1. Who we are

PPFTEC S.R.L., Str. Patriarh Iustinian Marina nr. 17-19B, bl. DC12, mansardă, ap. 25, Râmnicu Vâlcea, jud. Vâlcea, 240469, Romania. CUI 55537142, trade register no. J2026052999008. Website: https://ppftec.com. E-mail: support@ppftec.com.

We have not appointed a data protection officer. Write to support@ppftec.com for anything in this notice.

Who is responsible for what

• We are the controller for the procurement data copy that we prepare and supply to our actor, for the list of people who have objected (suppression list), and for the logs of our rate-limit service. We alone decide about these.
• Our customers are the controllers of their own runs. A business that runs one of our actors decides whose data is checked or searched, when and why, and is responsible for the results it keeps.
• We act for a customer (as its processor) only if we handle the data of a run on the customer's behalf, for example when the customer shares a run with us for support.
• We wrote the actors and decide which data they fetch, output and drop. We are responsible for this notice and for handling objections.

2. Whose data this is about

Data about companies, public bodies and other legal persons is not personal data. This notice concerns:

• natural-person businesses: authorised natural persons (PFA), individual enterprises (II), family enterprises (IF) and liberal professions registered with ANAF. Their tax code (CUI) and business name identify a person, so they are personal data;
• people named in procurement data: a person's name can be part of a company's name (for example a company named after its founder), or can be written in the free-text description of a purchase or contract.

3. Where the data comes from

Company status. The company-status actor reads the public web service of the National Agency for Fiscal Administration (ANAF) for checking taxpayers, PlatitorTvaRest version 9 (https://webservicesp.anaf.ro/api/PlatitorTvaRest/v9/tva). This is a publicly accessible source. The registers behind it are public by law and are shown on the ANAF website: the VAT register (Fiscal Code, art. 316(15)), the VAT-on-collection register (Fiscal Code, art. 324(16)) and the register of inactive and reactivated taxpayers (Fiscal Procedure Code, art. 92(11)).

The actor only checks tax codes that a customer types in or uploads. It does not list or copy the register, and all users together send at most one request per second to ANAF.

Procurement data. The procurement actor and our copy use the quarterly datasets “Achizițiile publice” (exports from the electronic public procurement system SEAP), published by the Authority for the Digitalisation of Romania (ADR) on data.gov.ro, for example https://data.gov.ro/dataset/achizitii-publice-2026, under the Creative Commons Attribution 4.0 licence (CC BY 4.0). This is a publicly accessible source. Every record in our copy keeps the address of the original file and the time we downloaded it.

4. What data is processed

4.1 Company status (ro-company-status)

Returned to the customer for a natural-person business:

• tax code (CUI) and business name (which usually contains the person's name);
• county and locality of the registered office and of the fiscal domicile;
• trade register number, CAEN activity code, legal and organisation form, competent tax office;
• registration status and date; VAT registration and periods; VAT on collection; inactive, reactivated and struck-off dates; split VAT; registration in the RO e-Factura register.

Received from ANAF and deleted at once, never returned: telephone, fax, IBAN, street, street number, address details and postal code.

Never processed: the personal numeric code (CNP). Inputs of 13 digits are refused before any request to ANAF. If any value that looks like a CNP appears in an ANAF answer, it is removed.

4.2 Procurement data (ro-procurement-monitor and our copy)

Kept in our copy and returned by the procurement actor, for each purchase, notice or contract: the contracting authority's name and tax code; the title or description, CPV code and label, contract type, value, currency and dates; the other columns of the export (for example whether EU funds are used); and the winning supplier's name and tax code only when the name carries a clear legal-entity form (for example SRL, SA, a public body or a foreign company form).

Removed before the data enters our copy:

• the name and tax code of every supplier that is not clearly a legal entity: PFA, II, IF, liberal professions (for example individual medical or law practices, bailiffs, notaries) and any name without a legal form. The rule removes too much rather than too little;
• supplier identifiers of 13 or more digits, which may be personal numeric codes;
• e-mail addresses, Romanian phone numbers and personal numeric codes (CNP) in free text, which are replaced with “[redacted]”.

Not removed automatically: a person's name that is part of a company name (for example a single-member company named after its owner), and names of people written inside free-text descriptions. If this concerns you, tell us and we remove it, without asking you for proof (section 9).

5. Why, and on what legal basis

Legal basis for all processing in this notice: legitimate interests, Article 6(1)(f) GDPR.

5.1 Company status

• Our customers' interest: to check a supplier or customer before invoicing, paying or onboarding it. Under the Fiscal Code (art. 11(7) and art. 316(9)), a buyer can lose the right to deduct expenses and VAT when the supplier is inactive or its VAT registration was cancelled. Under the Fiscal Procedure Code (art. 92(13)), inactivity has effect towards third parties from the day after it is entered in the register. The RO e-Factura status tells a customer how to send e-invoices.
• Our interest: to offer a reliable tool for these checks, with the source and retrieval time on every result.
• Balance: the data is published by law so that third parties can rely on it. We return only status data plus name and locality, which are needed to confirm the right business. We drop contact details, bank details and street address. We keep no copy. You can object at any time (section 9).

5.2 Procurement data

• Interests: public-procurement data is published so that anyone can see how public money is spent. Our customers (bid teams, consultants, journalists, researchers) use it to size markets, prepare bids and study public spending. Our interest is to offer this data in a clean, structured form. data.gov.ro does not accept connections from the platform on which our actor runs. We therefore download the files on our own computer in Romania, minimise them and keep the minimised copy on servers in the European Union, where only our actor can read it.
• Permission to reuse: ADR publishes the files under CC BY 4.0, and Law no. 179/2022 on open data and the reuse of public-sector information allows their reuse. Neither replaces data protection law. That is why we remove natural-person suppliers and contact details before anything enters our copy.
• Balance: our copy contains less than the source: no natural-person suppliers and no contact details. It is not public: only our actor can read it, each customer receives only the records that match its search, and nobody can look up a person's name in it on the internet. We keep a record no longer than data.gov.ro shows it, and at most the 8 most recent quarters. You can object at any time, and we remove your data within 24 hours (section 9).

6. What we do not do

• We do not build a database or archive about natural persons. Our procurement copy is a private copy of public contract data, from which natural-person suppliers are removed, and it is used only to supply our actor.
• We do not combine this data with other sources, and we do not profile, score or rank people. Nobody can search our data by a person's name.
• We do not use the data, and we forbid customers to use it, for marketing or to build contact lists.
• In watch mode (repeated checks of a customer's list), natural-person businesses are not watched: nothing about them is stored and no status alert is sent about them.

7. Who receives the data

• The customer who ran an actor. Each run takes place in the customer's own Apify account, and the results stay there. For procurement data the customer receives only the records that match its search, not our whole copy. The customer decides how long to keep the results and whom to share them with. A customer who keeps results is responsible for them under the GDPR, including its own duty to inform you.
• Our service providers. Apify (Apify Technologies s.r.o., Czech Republic) runs the actors: a customer's run under the customer's contract with Apify, and the building and hosting of our actors (including the suppression list) under our contract with Apify. Cloudflare stores our procurement copy in the European Union, delivers it to our actor and serves this website, acting for us.
• Nobody else. Since 7 October 2026 our procurement copy can be read only by our procurement actor, with a secret key. It is not published. From 5 to 7 October 2026 the files could be downloaded by anyone; we cannot recall copies made in that period.
• PPFTEC sees a run's data only if the customer chooses to share that run with us for support. We use it only to solve the support request and do not copy it.
• Our rate-limit service (hosted by Cloudflare in the EU) receives no data about you.

Outside the European Economic Area (EEA)

• Company status: we send no data outside the EEA. A customer outside the EEA obtains the data directly from ANAF's public service through its own run. Each run is limited to the tax codes the customer supplies, and the actor never hands over the register as a whole.
• Procurement data: when our actor delivers records from our copy to a customer established in a country for which the European Commission has not adopted an adequacy decision, we use the EU Standard Contractual Clauses for transfers between controllers (Module One), adopted by Commission Implementing Decision (EU) 2021/914 (official text). They are part of our terms of use. You can ask us for a copy at support@ppftec.com.
• Apify's own transfers to its service providers are covered by Apify's data processing terms.

8. How long the data is kept

9. Your rights and how to object

You have the right to object to this processing (Article 21 GDPR), and the rights of access, rectification, erasure and restriction (Articles 15–18).

To object, write to support@ppftec.com with the subject “Objection” and the tax code (CUI) of your business. If your name appears in a company name or in a description in the procurement data, give that company's tax code or the record (its number or a link). You do not need to give reasons, and we do not ask you for proof, either that you are the person named or that you own the company. Within 24 hours of receiving your message:

• for a natural-person business, we block that tax code: from then on, the actors do not query or return it in any mode;
• for a company whose name contains your name (for example a single-member SRL named after you), we block that company's tax code in the same way and remove its name and tax code from our procurement copy;
• in our procurement copy, we remove the supplier name and tax code concerned, or take the affected file offline until it has been rebuilt without your data;
• for a name in a description, we take the affected file offline and add it again only without that text.

We will then confirm in writing, with a link to this notice.

If your request concerns a company whose name does not identify a person, data protection rights do not apply. Write to us anyway; we answer within one month.

Please note:

• We cannot recall results that customers obtained before the block, or copies of the files that others downloaded while they were openly accessible (5 to 7 October 2026). Customers are responsible for their results; we can tell you how to contact them where we know who they are, which is usually not the case.
• The company-status data is published by ANAF. If it is wrong, ask ANAF (your competent tax office) to correct it. The procurement data is published by ADR from SEAP; if it is wrong, ask the contracting authority or ADR. Our actors and our copy show the corrected data from the next check or rebuild.
• For other requests (access, erasure, restriction), write to the same address. We answer without undue delay and within one month at the latest (Article 12(3) GDPR).

10. Complaints

You can complain to the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, e-mail anspdcp@dataprotection.ro, https://www.dataprotection.ro. You can also complain in the EU country where you live or work.

11. Automated decisions

The actors take no decisions about you. They return the status published by ANAF or the procurement data published by ADR. Any decision is the customer's. The rule that decides whether a supplier name is kept is automatic, but it has no legal or similar effect on you; if it kept your name, you can object (section 9).

12. Why you did not receive this notice personally

We do not collect your data from you, and we hold no contact details for you. To write to every person whose tax code a customer checks, or whose name appears in about 1.7 million procurement records per half-year, we would first have to find out who these people are and how to reach them. That would mean collecting more data about you than we process now. We weighed that effort against the low impact of our processing on you: we keep no company-status results, our procurement copy is private to our actor and holds names only, without contact details, and you can object at any time. Under Article 14(5)(b) GDPR we therefore publish this notice instead. Search engines may index this page so that you can find it. We also link it from every company-status result, from the actor descriptions and from our website. If you write to us, we send you this information directly in our reply.

13. Romania direct purchases & contracts and our procurement data copy

• What the copy is: a quarterly, minimised copy of the data.gov.ro SEAP exports, as one compressed file per quarter and record type, with an index file. Cloudflare stores it in the EU. Since 7 October 2026 only our procurement actor can read it, with a secret key; it is not available to the public. The index lists, for each file, the original data.gov.ro address, the download time, the licence and what we changed.
• Who builds it: PPFTEC, with the same code as the actor, on our own computer in Romania, when ADR publishes a new quarter (usually a few weeks after the quarter ends).
• What the procurement actor does: it reads our copy (or, outside the Apify platform, the original files), applies the customer's filters, the result limit and the current suppression list, and returns the matching records to the customer. It keeps nothing after the run.
• Data, purpose, legal basis, recipients, retention, rights and complaints: sections 4.2, 5.2, 7, 8, 9 and 10.
• The data is provided as published by ADR, under CC BY 4.0. PPFTEC is not affiliated with, or endorsed by, ADR or data.gov.ro.

14. Data about our customers (rate-limit service)

So that all users together stay within ANAF's published limit, each run asks our rate-limit service for a time slot. The request contains a one-way hash of the Apify run ID and the actor version, and nothing else. The service logs the hash, its decision and the time, for abuse control (Article 6(1)(f) GDPR), and deletes the logs after 30 days. It is hosted by Cloudflare in the EU, acting for us.

15. Changes

We will update this notice when the actors, our copy or the law change, and show the date at the top.

• Version 0.3 (7 October 2026): our procurement copy is no longer public and can be read only by our actor; who is responsible for what (section 1); transfers outside the EEA (section 7); retention linked to the source (section 8); removal of company names that contain a person's name on request without proof (section 9).
• Version 0.2 (5 October 2026): first version in force.
• Version 0.1 (4 October 2026) was a draft and was never in force.

Previous versions are available on request.