Privacy Policy and GDPR Notice

This notice explains what personal data we process through the cata.cataro.ro platform, for what purposes, on what legal basis, how long we keep it and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.

1. Data controller

The controller of your personal data is:

Name: ASOCIAȚIA COMUNITATEA ANTREPRENORILOR TINERI DIN AGRICULTURA
Registered office: Str. Elocinței nr. 8, Sector 1, București, România
Tax identification number (CUI): 54784535
Date of incorporation: 28 May 2026
Phone: +40 740 017 810
Email: contact@cataro.ro
Platform: https://cata.cataro.ro

For any data protection question or to exercise your rights, write to contact@cataro.ro or to the registered office above.

2. What data we process

Depending on how you use the platform, we process:

Conversations with the Agri mascot (optional): the questions you type, the answers, the sources shown and your ratings (👍/👎), with date and language; if you are logged in, the link to your account; a random session identifier kept in your browser.
Monthly Agri mascot usage totals per account: number of questions, tokens and estimated cost; visitors without an account are only counted in a combined total, without identification.
Account data: email address, password (stored only as an argon2 hash, never in clear text), role, account status, email verification date, GDPR consent date.
Profile data: display name, phone number, profile picture, description, county, locality, approximate coordinates for the member map, farm type, farm size (ha), main activities, project stage, skills, interests, availability, public links.
Company/farm data: the tax identification number (CUI) and the official company name retrieved from the Romanian tax authority (ANAF), APIA registration (yes/no).
Membership data: membership status, dues owed and payments recorded.
Platform activity: posts, comments, reactions, knowledge base articles and votes, lesson progress, badges and points, marketplace listings, 1:1 private messages, notifications.
Event participation data: name, email, phone, participation category, registration form answers, badge QR code and check-in time.
Technical data: IP address, request method and path, response code and timestamp of write actions, recorded in an audit log accessible to administrators only.

We do not process special categories of data (health, political or religious beliefs, biometric data) and we never ask you for such information.

3. Where the data comes from

Directly from you: when you create the account, complete your profile, register for events and publish content.
From ANAF: based on the CUI you enter, we query the Romanian tax authority public service to retrieve the official company name, county and locality.
From OpenStreetMap (Nominatim): we turn the locality and county you declare into approximate coordinates, used only for the member map.
From partner organisers of events you attend (for example Romexpo, for Agripreneurs Summit): your name, email, phone, company and job title, locality, your answer to the question about joining the community and the consents you gave when registering. We use them to manage your participation in the event and, if you said yes or that you are still thinking, to send you the invitation to the CATA community; the account becomes active only after you set your password and give your GDPR consent.

4. Purposes and legal bases

Purpose	Data used	Legal basis (art. 6 GDPR)
Automatic answers to questions about CATA and the association through the Agri mascot; improving the content based on unanswered questions	Question and answer text, the random session identifier, the account (if you are logged in), language, ratings	Our legitimate interest in giving members and visitors quick information — Art. 6(1)(f) GDPR; using the mascot is optional
Creating and managing your member account, authentication and account approval	Account data, profile data, company data	Performance of the membership contract — art. 6(1)(b)
Showing your profile in the member directory and on the community map	Display name, county, locality, approximate coordinates, farm type, skills, interests	Your consent — art. 6(1)(a)
Running events: registrations, QR badges, check-in, participant lists	Name, email, phone, category, form answers, attendance	Consent and performance of the membership relationship — art. 6(1)(a) and (b)
Service emails: address verification, password reset, confirmations, activity notifications	Email, display name	Performance of the contract — art. 6(1)(b)
Periodic community updates (digest) and the microlearning bites by email, on the schedule set by the administrators; you can unsubscribe at any time from the link in the email or from your profile	Email, display name, first name, subscription choice	Your consent — art. 6(1)(a)
Recording membership dues and payments	Membership data, amounts, payment details	Legal obligation (accounting and tax) — art. 6(1)(c)
Measuring platform audience and the effectiveness of CATA promotional campaigns (Google Analytics, Google Ads, Meta Pixel)	Cookie identifiers, IP address, pages visited, visit source, browser and device type	Your consent, given in the cookie banner and withdrawable at any time from “Cookie settings” — art. 6(1)(a)
Platform security, abuse and fraud prevention, audit log	IP address, write actions, account email	Our legitimate interest in protecting the platform and its members — art. 6(1)(f)
Responding to authorities and defending legal claims	Data relevant to the request	Legal obligation and legitimate interest — art. 6(1)(c) and (f)

Providing the data marked as mandatory at sign-up (email, password, name, phone, CUI) is necessary to create the account; without it we cannot give you access to the platform.

5. Who has access to your data

Google (Google Cloud, Vertex AI service, in a European Union region) — receives the text of your question and the passages of CATA content used for the answer, only to generate the answer, as a processor.
Platform administrators and moderators can read conversations with the Agri mascot, to improve the answers and the content.
Administrators and moderators see the Agri mascot usage for each account (number of questions, estimated cost), to control costs.
Approved community members: they see your profile in the member directory and on the map, as well as the content you publish (posts, comments, listings).
Platform administrators and moderators: they access account data and the audit log strictly to administer the community.
Our hosting provider, within the European Union, under a data processing agreement.
The email (SMTP) service provider, to deliver transactional messages.
ANAF — receives only the CUI, to validate the company.
OpenStreetMap Foundation (Nominatim, maps) and Google (Google Fonts) — receive your browser's IP address and the minimum technical data needed to display the map and the fonts.
Google Ireland Limited (Google Analytics, Google Ads) and Meta Platforms Ireland Limited (Meta Pixel) — only if you accept analytics and marketing cookies: they receive cookie identifiers, your browser's IP address and the pages visited.
Public authorities, where the law requires it.

We do not sell your data. Google Analytics, Google Ads and Meta Pixel run only with your consent, to measure audience and CATA promotional campaigns. Your data is not used for personalised advertising (remarketing).

6. Transfers outside the European Economic Area

The Agri mascot uses Google's Vertex AI service in a European Union region, so questions sent to the mascot are processed in the EU.

Platform data is hosted in the European Union. Two features rendered in your browser involve services outside the EEA: maps and geocoding (OpenStreetMap Foundation, United Kingdom) and page fonts (Google). They receive your browser's IP address and the technical request, not your account data. These transfers rely on the safeguards set out in Chapter V of the GDPR. If you accept analytics and marketing cookies, Google and Meta may transfer the collected data to the United States under the EU-US Data Privacy Framework.

7. How long we keep the data

Conversations with the Agri mascot: 30 days from the last message, then deleted automatically; only daily totals (number of questions, cost) remain, without text. Google may keep the questions for up to 30 days, solely to detect abuse.
Monthly Agri mascot usage totals per account: 12 months, then deleted automatically; after the account is deleted they remain only as a "deleted account", without any link to you.
Account and profile data: for as long as your account exists. After the account is deleted, the associated data is erased or anonymised.
Event registrations and attendance: for the duration of the event and afterwards for the community's internal records, for as long as you are a member.
Financial records (dues, payments): 10 years, as required by Romanian accounting and tax law.
Audit log (IP address, write actions): for as long as necessary to investigate security incidents.
Data processed on the basis of consent: until you withdraw your consent.

8. Your rights

Under the GDPR you have the following rights:

Right of access: to know what data we hold about you and receive a copy.
Right to rectification: to correct inaccurate or incomplete data (most of it can be edited directly in your profile).
Right to erasure (“right to be forgotten”): to request deletion of your data, under art. 17 GDPR.
Right to restriction of processing, in the cases set out in art. 18 GDPR.
Right to data portability: to receive the data you provided in a structured, commonly used, machine-readable format.
Right to object to processing based on our legitimate interest.
Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Right not to be subject to a decision based solely on automated processing.
Right to lodge a complaint with the supervisory authority and to seek a judicial remedy.

9. How to exercise your rights

Send your request to contact@cataro.ro, from the email address linked to your account. We reply free of charge within one month of receiving the request; the deadline may be extended by two further months for complex requests, in which case we will inform you. We may ask for additional information if we have reasonable doubts about the identity of the person making the request.

You can delete your account at any time by writing to the same address; deleting the account leads to the erasure or anonymisation of the associated data, except for data we are legally required to keep.

10. Automated decisions and profiling

We do not take decisions producing legal or similarly significant effects based solely on automated processing. Community points and the leaderboard are computed automatically from your activity, but they produce no legal effects for you.

11. Minors

The platform is intended for adults (18 years and over). We do not knowingly collect children's data. If you learn that a minor has provided us with data, contact us and we will delete it.

12. Data security

Passwords are stored exclusively as argon2 hashes.
Traffic is encrypted with HTTPS/TLS.
Sessions use short-lived tokens with rotation and revocation.
Access to administrative features is restricted by role, and write actions are recorded in the audit log.
We apply rate limiting against abuse and take regular system backups.

13. Cookies and local storage

Details about cookies and the data kept in your browser are set out in the Cookie Policy.

14. Complaints

If you believe we are infringing your rights, please contact us first. You always have the right to lodge a complaint with the supervisory authority:

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Address: B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, România
Phone: +40 318 059 211
Email: anspdcp@dataprotection.ro
Web: www.dataprotection.ro

15. Changes to this notice

We may update this notice when platform features or legal obligations change. The version in force is the one published on this page, with the last update date shown at the top. We will announce significant changes by email or through a notice in the platform.