This policy explains what personal data we collect through the Fonetix platform, why we use it, and your rights. Data controller: FONETIX PLATFORM S.R.L., registered office at sat Florești, str. Tautului nr. 13 F, ap. 2, jud. Cluj, cod poștal 407280, România, registered with the Romanian Trade Register under no. J2026041758009 (EUID ROONRC.J2026041758009), VAT/company ID 55036630.
1. Data we collect
- Account data: first/last name, username, password (hashed), internal e-mail.
- Identity data used for verification: date of birth, sex, national ID (CNP) where required by the employer.
- Activity data: course progress, scores, learning time.
- Technical data: IP address, device type, access logs.
- Biometric data (see the separate "Biometric Data" notice).
2. Why we use it (purposes & legal basis)
- Providing the course and your account — performance of a contract (Art. 6(1)(b) GDPR).
- Identity verification and fraud prevention — employer legitimate interest and explicit consent for biometric data (Art. 9(2)(a)).
- Compliance and reporting to your employer — legitimate interest / legal obligation.
- Platform security — legitimate interest.
3. Who we share with
Your data may be accessed by your employer (for progress and compliance reports) and by our service providers acting as processors: the identity-verification provider (Didit), the face-verification service (Amazon Web Services – Rekognition, EU region), hosting and e-mail. We do not sell your data.
4. How long we keep it
We keep each category of data only as long as the purpose it was collected for requires:
- Account and learning activity — while your account is active, then for 3 years after it closes (the general limitation period for civil claims under Romanian law, art. 2517 Civil Code).
- Identity data including the CNP — while the account exists, then only for as long as the fiscal or certification obligation that required it.
- Biometric data — per the "Biometric Data" notice: liveness captures are deleted automatically after at most 90 days.
- Security and access logs — 12 months.
- Sealed compliance reports issued to your employer — 5 years.
- Invoices — 10 years, as Romanian fiscal law requires.
5. Your rights
You have the rights described on the "GDPR" page (access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to the supervisory authority).
6. Security
We use encryption in transit and at rest, access control and logging. No system is 100% secure, but we apply appropriate technical and organisational measures.
7. Contact
For questions or requests about your personal data, write to contact@fonetix.ro. Data-protection requests are handled at the same address.