Privacy Policy

1. Introduction

MOTY CONSULTANCE S.R.L. (Tax ID (CUI): 38556110, Trade Register No.: J23/5998/2017, registered office: Str. Sofia nr. 6, Oraș Otopeni, Județ Ilfov, 075100, România), the operator of the website www.moty.ro, respects the confidentiality of your personal data and is committed to protecting it in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and applicable national law (Law No. 190/2018).

This policy describes what data we collect, how we use it, who we share it with, and what rights you have as a data subject.

2. Data controller

Controller: MOTY CONSULTANCE S.R.L.

Tax ID (CUI): 38556110 · Trade Register No.: J23/5998/2017

Registered office: Str. Sofia nr. 6, Oraș Otopeni, Județ Ilfov, 075100, România

Website: moty.ro

Contact: contact@moty.ro

3. Data we collect

We collect the following categories of personal data:

• Identification data: first name, last name, email address, phone number — provided when you create an account or fill in forms.
• Account data: the email address and password (encrypted) used to sign in.
• Transaction data: purchase history, payment method (processed by Stripe — we do not store card details), invoices.
• Usage data: course progress, quiz results, certificates issued, content preferences.
• Technical data: IP address, browser type, operating system, pages visited — collected automatically through cookies and similar technologies.
• Communication data: messages sent through the contact form, replies to the newsletter.

4. Purposes and legal basis for processing

5. Data sharing

To provide our services, we use the following providers, which process data on our behalf (processors) or, where applicable, as independent controllers:

• Supabase — cloud infrastructure for the database, authentication, and file storage (account data, purchases, course progress).
• Vercel — website hosting and content delivery (technical data: IP address, access logs).
• Stripe — processing of online payments and memberships (name, email, payment data; card details are processed exclusively by Stripe).
• SmartBill — issuing tax invoices (name, email, billing address, transaction details).
• Resend — sending transactional emails (account confirmation, password reset, order confirmations, tickets, certificates).
• Brevo — managing contact lists and, with your consent, sending the newsletter.
• Google Calendar (Google Ireland Ltd.) and Zoom (Zoom Video Communications, Inc.) — booking and running coaching sessions: the booking is recorded in our Google calendar (name, email, phone if you gave it, date and time), and the session takes place on Zoom.
• Ticket Tailor — selling and managing event tickets (name, email, ticket details).
• Vimeo — hosting and playing the Academy video lessons (technical playback data; the player is loaded with the “do not track” option).
• Meta Platforms Ireland Ltd. — ad measurement through the Meta Pixel and the Conversions API (pages visited, checkout initiation, sign-ups, purchases and their value, IP address, browser, Meta cookie identifiers; email only as a SHA-256 hash). Meta acts as a joint controller for this data.
• Bunny.net (BunnyWay d.o.o., Slovenia) — hosting and playing course and webinar videos (technical playback data: IP address, device and browser type), with servers in the European Union.
• Google Fonts (Google Ireland Ltd.) — delivering some of the fonts used on the website (technical data: IP address, browser type); it does not set cookies.

Data may also be disclosed to public authorities when the law requires us to do so (for example, to tax authorities).

We do not sell, rent, or share your personal data with third parties for marketing purposes without your explicit consent.

6. Data transfers outside the EU/EEA

Some of our providers (for example Stripe, Vercel, Vimeo, Ticket Tailor, Google, Zoom, or Meta) may process data outside the European Union / European Economic Area, including in the US. Such transfers take place only with appropriate safeguards: either to entities certified under the EU-US Data Privacy Framework, based on the European Commission adequacy decision of July 10, 2023 (Art. 45 GDPR), or on the basis of the Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR), supplemented, where appropriate, by additional measures. You can request information about the applicable safeguards by writing to the contact address above.

7. Retention period

• Account data: for as long as the account exists + 30 days after deletion.
• Transaction data: 10 years, as required by Romanian tax law.
• Marketing data (newsletter): until consent is withdrawn.
• Technical data (cookies): for the duration specified in the Cookie Policy.

8. Your rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to request that inaccurate data be corrected.
• Right to erasure (“right to be forgotten”) — to request that your data be deleted, subject to legal obligations.
• Right to restriction of processing — to limit processing under certain conditions.
• Right to data portability — to receive your data in a structured, commonly used format.
• Right to object — to object to processing based on legitimate interest.
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at contact@moty.ro. We will respond without undue delay and within one month of receiving your request at the latest (a period that may be extended by two further months in complex cases, in which case we will inform you).

9. Data security

We implement appropriate technical and organizational measures to protect personal data: SSL/TLS encryption, secure authentication, role-based restricted access (RLS), regular backups, and continuous monitoring.

10. Complaints

If you believe that the processing of your data violates the GDPR, you have the right to file a complaint with:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — the Romanian National Supervisory Authority for Personal Data Processing
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București
www.dataprotection.ro

11. Changes

This policy may be updated periodically. Changes will be published on this page with an updated revision date.