Privacy Notice

Who is responsible for your data

Spaitz is the data controller for the account, workspace, marketplace, and billing data described here. For data that a business workspace (a farm or HoReCa buyer) manages about its own members and customers, that workspace is a controller in its own right and Spaitz acts as its processor under a data processing agreement. You can reach us at privacy@spaitz.com.

What data we collect

• Identity and contact data — your name, email address, and the account identifier issued by Microsoft Entra External ID when you sign in.
• Workspace and membership data — the workspaces you own or belong to, your role, and invitations sent to your email.
• Address, location, and fulfilment data — the pickup and delivery addresses you add to a workspace, which we convert into map coordinates (geocoding) so we can match, map, and plan routes; and, when a farmer chooses to verify stock on-site, the precise location captured from their device to confirm it matches the farm.
• Order and list data — the shopping lists, procurement plans, and orders you create, and the supplier confirmations that result.
• Billing data — for platform subscriptions, a Stripe customer reference and payment-lifecycle records. Card details are handled by Stripe and are not stored by Spaitz.
• Notification and contact-channel data — the notifications addressed to you and your channel preferences across in-app, email, mobile push, and SMS; a mobile phone number if you verify one for SMS; and the push tokens of the devices where you turn on push notifications.
• Ratings and reviews — the ratings and reviews you leave about suppliers, and any replies suppliers post.
• Device and usage data — when you use our website or mobile app, technical data such as your IP address, device and app version, and the diagnostic and security logs we need to run the platform reliably.
• Cookie data — strictly necessary session and language cookies and, only with your consent, any non-essential cookies described in our Cookie Notice.

Why we process your data and our legal basis

We rely on the following legal bases under Article 6 GDPR:

• Providing your account and workspaces and operating the marketplace, orders, and transactional notifications — performance of a contract (Art. 6(1)(b)).
• Keeping billing and tax records for platform subscriptions — compliance with a legal obligation (Art. 6(1)(c)).
• Keeping the platform secure and reliable, preventing fraud and abuse, confirming that on-site listings are genuine, showing supplier ratings, and improving our service — our legitimate interests (Art. 6(1)(f)), which we balance against your rights and which you can object to at any time.
• Sending SMS or push notifications to a phone or device you register, setting non-essential cookies, and sending any optional communications — your consent (Art. 6(1)(a)), which you can withdraw at any time.

Who we share data with

We do not sell your personal data. We share it only with service providers who act on our instructions:

• Microsoft — Microsoft Entra External ID for sign-in and identity, and Microsoft Azure for hosting and storage.
• Stripe — payment processing for platform subscriptions.
• Azure Communication Services (Microsoft) — sending notification emails and SMS messages on our behalf.
• Expo — delivering push notifications to your mobile devices.
• Mapping providers — Geoapify and LocationIQ turn the addresses you enter into map coordinates, and map imagery is loaded from a mapping provider (OpenFreeMap or MapTiler) that receives your IP address to serve the map.
• Other workspace members — people in a workspace you join can see your display name and role within that workspace.

International transfers

We host personal data in the European Union. Some providers — including Microsoft, Stripe, and Expo — may process data outside the EU; where they do, the transfer is protected by an adequacy decision or by the European Commission's Standard Contractual Clauses. Details are listed in our sub-processor register.

How long we keep your data

We keep personal data only as long as needed for the purpose for which it was collected. Expired or declined invitations, deactivated workspaces, and archived addresses are purged or anonymised on a defined schedule; billing records are retained for the period required by Romanian accounting and tax law. Verified phone numbers and device push tokens are kept only while the SMS or push channel stays enabled and are deleted when you turn it off or remove the device. When you delete your account, your personal data is anonymised in the systems you interact with immediately — reviews you left are anonymised while the numeric rating is retained so a supplier's average stays accurate — and any residual copies in our internal processing records are removed within 30 days. Our full retention schedule is available on request.

Your rights

Under the GDPR you have the right to:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data where it is no longer needed.
• Restriction — ask us to limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on our legitimate interest.
• Withdraw consent — at any time, where we rely on consent.

To exercise any of these rights, email privacy@spaitz.com. We respond within one month. You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), at www.dataprotection.ro.

Cookies

We use strictly necessary cookies to keep you signed in and to remember your language. Non-essential cookies are set only with your consent. See our Cookie Notice for details and to change your choices.

Children

Spaitz is not directed at children. In Romania the digital age of consent is 16; we do not knowingly create accounts for, or allow workspace membership by, anyone under 16.

Changes and contact

We will update this notice as the platform evolves and will revise the date above when we do. If you have any questions, email privacy@spaitz.com.