Through this Information Notice on the processing of personal data, we inform you of how your personal data are processed when you visit and/or use the website www.ghita.app and use the Ghiță App (hereinafter the “App”), available on iOS (Apple App Store) and Android (Google Play Store). Both the website and the App are owned by GHITAPP S.R.L.
GHITAPP S.R.L. is a company organised and operating under the laws of Romania, with its registered office in Gornești, Mureș County, Romania, registered with the Trade Register (Registrul Comerțului) under no. J2024050232004, EUID ROONRC.J2024050232004, unique tax registration code (CUI) 51056200, date of registration: 19 December 2024. Official website: https://ghita.app.
Data protection contact: ghita@ghita.app
When you visit or use our Website and use the Ghiță App, we process certain personal data about you, as described below. For the purposes of data protection law, GHITAPP S.R.L. is the controller of personal data, and you are the data subject. Please read this Information Notice carefully to understand how we process your personal data.
This Policy has been drawn up in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”);
- the applicable national legislation of Romania on the protection of personal data;
- the Apple App Store requirements (App Store Review Guidelines, section 5.1 – Data Collection and Storage);
- the Google Play Store requirements (Developer Program Policy – User Data, Data Safety Section).
The processing of personal data means any set of operations that we may perform on the data, such as collecting, storing, organising, transferring and erasing your data.
This Policy on the processing of personal data forms an integral part of the Terms and Conditions of use of the Ghiță Website and App.
You can call us, or send us a message using the contact form. The data you enter in this form are processed on the basis of our legitimate interest in responding to your request and in keeping a record of the requests submitted. These data are stored for 3 years from the time we last communicated.
If you choose to post a comment on the blog, we use only the data you submit in order to publish your comment. In this case too, on the basis of our legitimate interest in responding to your comment and moderating our blog, we keep the data you have provided to us for 3 years from the time you published the comment or we last communicated.
Depending on your choices and on the permissions you grant us, the App may collect the following data:
a) Identification data:
- Client Account: name, email address, telephone number, the city and county in which you need Ghiță’s services, profile photo.
- Tradesperson (“Meșter”) Account: name, email address, telephone number, the city and county in which you can provide your services, field of activity, a description of yourself, profile photo, identity document and a photo of yourself holding your identity document.
Purpose: to identify you and to activate your Account. The image of your identity document and the photo of you holding your identity document are deleted by us within 30 days of the date on which your Tradesperson Account is validated.
We also use your email address to send you transactional emails (e.g. to inform you of changes to the Terms applicable to our services).
Legal basis: performance of the contract and our legitimate interest.
b) Authentication through third-party services:
- Google Sign-In: we collect the name and email address associated with your Google account.
- Apple Sign-In: we collect the name and email address associated with your Apple account (or the private relay email address, if you choose the Hide My Email feature).
- Facebook Login: we collect the name and email address associated with your Facebook account.
Purpose: to identify you and to activate your Account. Legal basis: performance of the contract.
c) Your activity in the App: your offers and requests, the ratings you receive or give, your comments, the photos you post. We collect this information in order to measure user satisfaction, to enable users to communicate with one another and to prevent and check inappropriate content in the App.
Your Account with your full details is displayed only once the Client has accepted the Tradesperson’s offer, and only the two of them can see each other’s details.
Legal basis: performance of the contract and our legitimate interest.
d) Invoicing: we process, to a limited extent, the personal data of Users who request chargeable services from us, in order to fulfil our legal obligation to issue an invoice for the services we provide.
Legal basis: compliance with the controller’s legal obligations.
e) Technical device data: device type, operating system and its version, unique device identifiers, IP address, preferred language, time zone. These data are collected automatically when you use the App.
Purpose: ensuring the optimal functioning of the App, troubleshooting, security and aggregated statistical analysis. Legal basis: our legitimate interest.
f) Location data (optional): if you grant us permission, the App may access your approximate location in order to recommend tradespeople in your area. You may revoke this permission at any time from your device settings.
Purpose: personalising the services according to your location. Legal basis: your consent.
g) Push notifications (optional): if you grant us permission, we will send you push notifications about the status of your requests, new offers or important updates. You may disable notifications at any time from your device settings.
Purpose: communicating with you effectively about the services you have requested. Legal basis: your consent.
When you choose to subscribe to our Newsletter, we process your email address for the purpose of sending you information about the App or about the services of our partners.
We send advertising offers and commercial communications (the newsletter) only to recipients who have subscribed to it. Legal basis: your consent, in accordance with Article 6(1)(a) of the GDPR.
You may withdraw your consent at any time by clicking the unsubscribe link at the end of any Newsletter email.
To send transactional emails and the Newsletter we use the services of SparkPost (MessageBird / Bird), with servers located in the European Union. Your personal data (email address) are processed exclusively within the European Economic Area (EEA) and are not transferred outside it.
The personal data obtained in this way are processed for as long as you remain subscribed to the Newsletter.
Our Website automatically collects certain information in our legitimate interest, for the purpose of ensuring the security and optimal functioning of the website.
The information we collect is traffic data sent automatically by your browser, such as the region or location from which you access the internet, the time and place of your visit, and the pages of the Website you visit.
GHITAPP S.R.L. is a joint controller together with the Tradespeople with regard to the personal data you provide when you accept a Tradesperson’s offer (name, telephone number). Tradespeople, acting as professionals, collect the personal data relating to your repair request in order to perform the distance contract concluded between you and them. Legal basis: performance of contractual obligations.
As regards the Ghiță App’s accounts on various social networks (Facebook, Instagram, LinkedIn, YouTube), we collect your data only for the purpose of normal interaction on the network concerned, when you follow our pages, comment on our posts, like or share them, or send us a direct message. The data are collected together with the social networks concerned, with which we are joint controllers. Legal basis: your consent. The data are kept until you withdraw your consent or until you ask us to delete this information.
Our Website uses cookies and similar technologies. Detailed information about them is displayed in the consent banner on your first visit to the Website.
Cookies are small files that a website stores in the user’s browser in order to save data about their visit. Cookie files do not contain software, viruses or spyware and cannot access information on the user’s hard disk.
Categories of cookies used:
- First-party (internal) cookies: set by GHITAPP S.R.L. or on our behalf. These may be session cookies (which expire when the browser is closed) or persistent cookies (stored for a set period).
- Third-party (external) cookies: set by other companies whose functionality is embedded in the Website (for example, Google Analytics cookies).
Managing cookies:
You can access the cookie management interface at any time while browsing the Website. You may change the consent you have given at any time. Refusing cookies is as easy as accepting them – we offer the “Reject all” option with the same visibility and accessibility as the “Accept all” option.
You can also configure cookies from your browser settings:
To block Google Analytics cookies, you can use the tool at https://tools.google.com/dlpage/gaoptout.
The Ghiță App may request the following permissions on your device. Each permission is requested individually, the first time you use the relevant feature, and you may revoke any permission at any time from your device settings:
| Permission | Purpose | Required? |
|---|---|---|
| Camera | Profile photos, photos for service requests, identity verification of tradespeople | Optional |
| Gallery / Files | Uploading existing photos for requests or for your profile | Optional |
| Location | Recommending tradespeople in your area | Optional |
| Push notifications | Alerts about the status of requests, offers, messages | Optional |
| Internet access | General operation of the App | Required |
We do not collect data from your contacts, calendar, SMS messages, call log or other apps on your device.
The App integrates the following third-party services, which may collect or process data in accordance with their own privacy policies:
| Service | Purpose | Data processed |
|---|---|---|
| Google Analytics / Firebase Analytics | Statistical analysis of usage | Anonymised usage data, device identifiers |
| Firebase Cloud Messaging | Push notifications | Device tokens |
| Apple Push Notification Service (APNs) | Push notifications on iOS | Device tokens |
| Google Sign-In | Authentication | Name, email |
| Apple Sign-In | Authentication | Name, email (or private relay) |
| Facebook Login | Authentication | Name, email |
| SparkPost (Bird) | Transactional emails and Newsletter | Email address |
All third-party partners are contractually bound to provide the same level of protection for personal data as that provided for by this Policy and by the GDPR.
We will share some of your personal data only to the extent necessary and only with the following categories of third parties:
a) Processors of GHITAPP S.R.L. that provide us with various services: payment processing; advertising services (e.g. sending email messages); IT support and development services; website hosting services; legal, consultancy and accounting services; traffic analysis services. They are contractually bound to comply with the requirements of the GDPR.
b) Public authorities and institutions, where we are under a legal obligation to disclose the data to them.
c) We may disclose your personal data to third parties:
- if you ask us to do so or give us your consent to do so;
- if the persons concerned can demonstrate that they have the legal authority to act on your behalf;
- where we have a legitimate interest in administering, expanding or developing our business (e.g. in the context of an acquisition or merger);
- in order to respond to any legal claims, or to protect the rights, safety or property of GHITAPP S.R.L., of our users or of the public.
We do not sell or rent your personal data to third parties for direct marketing purposes.
GHITAPP S.R.L. stores your data securely on servers located in the European Union.
All data transmitted between the App/Website and our servers are protected by encryption in transit (TLS/SSL).
We implement appropriate technical and organisational measures to ensure the security, confidentiality, integrity and availability of the data and to protect them against destruction, loss, alteration, unauthorised disclosure or unauthorised access.
The personal data we process are limited to those that are necessary, adequate and relevant for the purposes stated in this Information Notice (the data minimisation principle).
Although we strive to provide the highest possible level of security for your data, please note that the security of transmitted information cannot be 100% guaranteed, given the risks inherent in transmitting data over the internet.
Security recommendations:
- Do not disclose personal data unless you are expressly asked to;
- Choose strong, complex passwords;
- Secure your electronic devices with passwords or other locking methods;
- Do not leave your electronic devices unattended;
- Check the identity of the people you communicate with.
The data collected will be kept only for a set period of time, depending on the needs and purpose of the processing:
| Data category | Retention period |
|---|---|
| Data associated with your App Account | For the duration of the contractual relationship + 3 years from the deletion/closure of the Account |
| Contact form data | 3 years from the last communication |
| Invoicing data and accounting documents | 10 years from the issue of the invoice (or any other applicable tax limitation period) |
| Data processed on the basis of consent | Until consent is withdrawn |
| Identity document images (Tradesperson verification) | 30 days from the validation of the account |
| Audio files (voice feature) | Deleted immediately after processing |
You have the right to delete your account and all associated data at any time. You can do this:
- From the App: go to Settings → My account → Delete account;
- By email: send a request to ghita@ghita.app.
Upon receipt of a deletion request, we will completely remove your account and all associated personal data, except for the data we are required by law to retain (e.g. accounting documents). We will confirm the deletion to you within 30 days.
Deleting your account is permanent and irreversible. All associated data, including your history of requests, ratings and messages, will be permanently removed.
In accordance with the GDPR, you have the following rights:
a) Right of access – you have the right to request information about the personal data we process about you, including the purpose of the processing, whether and with whom the data are shared and how long they will be kept.
b) Right to rectification – if the personal data we process about you are inaccurate, you have the right to have them rectified or completed.
c) Right to erasure (“right to be forgotten”) – you have the right to ask us to erase your data, except where the data are necessary for us to comply with legal obligations, for exercising the right of freedom of expression, or for the establishment, exercise or defence of legal claims.
d) Right to restriction of processing – you may request the restriction of the processing of your data in any of the following cases: you contest the accuracy of the data; the processing is unlawful; we no longer need the data but you require them for the defence of a legal claim; you have objected to the processing, pending verification.
e) Right to data portability – you have the right to receive your personal data from us in a structured, machine-readable format and to ask us to transmit them to another controller.
f) Right to object – you have the right to object at any time to the processing of your data on the basis of our legitimate interests.
g) Right to withdraw your consent – where your data are processed on the basis of consent, you may withdraw that consent at any time, without affecting the lawfulness of the processing carried out before its withdrawal.
h) Right not to be subject to automated decision-making – you will not be subject to a decision based solely on the automated processing of your data which produces legal effects or similarly significantly affects you (see also Section 10).
i) Right to lodge a complaint with the ANSPDCP – you have the right to lodge a complaint with the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, Romania’s National Supervisory Authority for Personal Data Processing). Complaints can be submitted online at https://www.dataprotection.ro/?page=Plangeri_pagina_principala.
As a user of our services, you will not be subject to a decision based solely on automated processing of your data which produces legal effects concerning you or similarly significantly affects you.
As a rule, your personal data are stored and processed within the European Economic Area (EEA).
If, in the future, it becomes necessary to transfer your data outside the EEA to service providers, such transfers will be carried out in accordance with the GDPR, on the basis of one or more of the following safeguards:
- the EU-US Data Privacy Framework (for certified recipients in the US);
- standard contractual clauses (SCCs) approved by the European Commission;
- supplementary protection measures, including data encryption and transfer impact assessments.
The Ghiță App is not intended for persons under the age of 18. We do not knowingly collect personal data from minors. If we learn that we have collected data from a minor, we will delete those data as soon as possible. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at ghita@ghita.app.
For any request relating to your personal data, please email us at ghita@ghita.app.
We will inform you of the action taken within one month of receiving your request. This period may be extended to two months where necessary, taking into account the complexity or the number of requests. If the period is extended, you will be informed within one month of receipt of your request, together with the reasons for the delay.
If we do not grant your request, we will inform you, no later than one month after receiving it, of the reasons for not taking action and of the possibility of lodging a complaint with the ANSPDCP or seeking a judicial remedy before the courts.
In most cases, you are under no obligation to provide us with your personal data. There are, however, situations in which, without the necessary data, we cannot resolve your legitimate request or will not be able to provide our Services to you.
This Information Notice may be amended from time to time. Amendments apply from the moment they are published on the Website and in the App. Whenever your consent is required or requested, we will inform you accordingly.
We recommend that you consult the Policy each time you use our services, so that you are aware of the version in force.
This version of the Policy on the processing of personal data is available at https://ghita.app/privacy (in Romanian, the legally binding version) and, in English, at https://ghita.app/en/privacy.
| Version | Effective date | Main changes |
|---|---|---|
| Version 2 | 27 March 2026 | Controller changed to GHITAPP S.R.L.; new sections on permissions, third-party SDKs, account deletion, protection of minors and international transfers; compliance with Apple App Store and Google Play Store requirements |
| Version 1 | 3 June 2022 | Initial version (controller: SC Oltspera SRL) |