Privacy policy

In short

This summary helps you find your way. It does not replace the policy below, which is the one that applies.

• onegate.ro sells nothing to consumers. You give us personal data when you write to us or use a partner account.
• We store passwords only in irreversibly encrypted form (hashed), never in plain text.
• Each partner account's data is isolated from the other accounts.
• We process our partners' customer data only on the partners' behalf, as a processor.
• Visitor statistics (Google Analytics) and visit recordings (Microsoft Clarity) start only with your consent. We do not use marketing cookies.
• If you bought from beesim.ro or vinietabg.ro, the privacy policy of that website applies.
• You can ask for access to your data, or for it to be corrected or deleted, at any time at contact@onegate.ro.

Who processes your data

1. The data controller is Digital Wap SRL, registered office Str. Alexandru Moga 3A, Sector 3, București, România, tax ID (CUI) RO36145517, Trade Register no. J2016007621403, which operates onegate.ro and the OneGate platform. About the company: digitalwap.ro.
2. For the data of our B2B partners' customers, our role is different: we are a processor and the partner is the controller. The details are below, under "Data about our partners' and brands' customers".
3. For any question about your data, write to us at contact@onegate.ro with the subject "Personal data", or call us at (+40) 746 102 502. We have not appointed a data protection officer, because our activity does not require one; we answer you directly.
4. We process data in line with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 and Romanian Law no. 506/2004 on electronic communications.

What data we process

1. Messages sent to contact@onegate.ro: your name, email address, the content of the message and any other details you choose to include (for example, your phone number or company).
2. Sign-up form data: first name, last name, email address, password, your acceptance of the terms and, if you tick it, your consent to receive news from us.
3. Data of users in partner accounts: name, email address, role in the account and password, which we store only in irreversibly encrypted form (hashed). If you sign in with Google, Google sends us the name and email address of your Google account; we never see your Google password.
4. Technical logs of the API and the account: IP address, browser, the requests made (which resource, with what result), their time and the important actions in the account, such as sign-up, sign-ins and changes.
5. Partner billing data: company name, tax ID, address, contact person and the history of orders, transactions and invoices.
6. Card payment data, where a partner chooses to pay by card (for example, to top up the balance): you enter your card details directly with our payment processor, Stripe, and they never reach us. Stripe sends us only the payment result and the transaction details.
7. Technical data about your visit, only if you accept analytics cookies: pages visited, how you use the pages (scrolling, taps, clicks), browser and device type, the page you came from and the data in cookies, described in the cookie policy.
8. We do not ask for or process sensitive data, personal identification numbers or copies of ID documents; please do not include them in messages. The site is aimed at businesses and we do not knowingly process data about minors.

Why we process it and on what legal basis

For each purpose, you will find below the data used and the legal basis under Article 6(1) GDPR.

• Answering your message and discussions before working together, including the evaluation account created through the sign-up form. Data: the content of your message or form. Legal basis: point (b), steps taken at your request before entering into a contract, or point (f), our legitimate interest in communicating with the company that contacted us.
• Creating and managing the partner account, access to the platform and the API, fulfilling orders. Data: user and account data. Legal basis: point (b), performance of the contract with the partner; for users who are not themselves party to the contract, point (f), our legitimate interest in performing the contract with their company.
• Invoicing, collecting payments and accounting. Data: billing data, transactions and payments. Legal basis: point (b), performance of the contract, and point (c), legal obligation (tax and accounting law).
• Platform security: preventing unauthorised access and abuse, investigating errors and incidents. Data: technical logs. Legal basis: point (f), our legitimate interest in protecting our systems and partners' accounts.
• Visitor statistics (Google Analytics). Data: technical data about your visit. Legal basis: point (a), your consent, given in the cookie banner.
• Visit recordings and tap maps (Microsoft Clarity): where visitors get stuck on the pages. Data: technical data about your visit and how you use the pages. Legal basis: point (a), your consent, given in the cookie banner.
• News about OneGate, only if you ticked the box for it. Data: name and email address. Legal basis: point (a), your consent, which you can withdraw at any time.
• Defending our rights in a complaint or dispute. Data: what the case requires. Legal basis: point (f), legitimate interest.

1. Without the user's name, email and password we cannot create an account. Without billing data we cannot issue invoices.
2. We write to partners about their account, orders, invoices and platform changes. We send other messages about OneGate only if you agreed to receive them.
3. We do not make decisions based solely on automated processing that have legal effects on you.

Data about our partners' and brands' customers

1. beeSIM and vinietabg.ro customers. If you bought from beesim.ro or vinietabg.ro, your order is processed through OneGate. Some pages you open from these brands' emails (for example, the eSIM installation page or the unsubscribe link) are served from onegate.ro. Your data is covered by the privacy policy of the website you bought from.
2. Customers of B2B partners. When a partner sends us its customers' data through the API to fulfil an order, the partner is the controller of that data and we process it as a processor within the meaning of Article 28 GDPR: only on the partner's behalf, on its instructions and under the data processing agreement included in the partnership contract.
3. If you are a partner's customer and have questions about your data or want to exercise your rights, please contact the partner you bought from. If you write to us instead, we pass your request on and help the partner answer it.

Who else receives the data

1. Google:
   • hosts our email through Google Workspace, including messages sent to contact@onegate.ro and our correspondence with you, as a processor;
   • receives technical data about your visit through Google Analytics and Google Tag Manager, only if you accept analytics cookies;
   • verifies your identity if you choose to sign in with Google; for your Google account, Google is an independent controller.
   Google's policy: policies.google.com/privacy.
2. Microsoft (Microsoft Ireland Operations Limited) receives, through Microsoft Clarity, technical data about your visit and how you use the public pages, only if you accept analytics cookies. For this data, Microsoft is a controller and also processes it under its own policy: privacy.microsoft.com/privacystatement.
3. Stripe, our payment processor, receives the payment data, only where a partner chooses to pay by card. Stripe's policy: stripe.com/privacy.
4. Our hosting provider, which works for us as a processor, under contract and only on our instructions. The site, the platform and the database run on servers in Romania.
5. We issue invoices through ProBill, our own invoicing platform, so billing data does not go to an outside provider for this. As the law requires, invoices are submitted to ANAF's RO e-Factura system.
6. Our accountants and auditors, and the tax authorities, to the extent the law requires.
7. Public authorities and courts, only if the law or a lawful request requires it.
8. We do not sell or rent your data to anyone.

Transfers outside the European Economic Area

1. The site, the platform and the database run on servers in Romania. Google, Microsoft and Stripe may transfer some data to the United States.
2. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the Commission.

How long we keep it

1. Messages and correspondence that do not lead to working together: 24 months from our last interaction with you, after which we delete them.
2. Partner account and user data, including order history: for the term of the contract, then for 3 years after it ends, the general limitation period under Romanian law, so that we can defend our rights. A user removed from an account can no longer sign in.
3. Invoices and accounting records: 10 years, as accounting law requires.
4. Technical logs of the API, the account and the server: up to 90 days, except those linked to a security incident, which we keep for as long as the investigation lasts.
5. Analytics data (Google Analytics): up to 14 months.
6. Visit recordings (Microsoft Clarity): 30 days; a sample chosen by Microsoft and the recordings we flag, up to 9 months. Tap maps, aggregated: up to 9 months.
7. How long each cookie lasts is listed in the cookie policy.

Your rights

1. You have the right to:
   • find out what data we process about you and get a copy (right of access);
   • have inaccurate data corrected;
   • have your data deleted, except for data the law requires us to keep, such as invoices;
   • restrict processing;
   • receive the data you gave us in a structured, commonly used format (right to data portability);
   • object to processing based on our legitimate interest;
   • withdraw your consent at any time, without affecting processing done before: for analytics cookies, from the "Manage cookie preferences" link at the bottom of the public pages; for news, from your account settings or by emailing us.
2. Write to us at contact@onegate.ro with the subject "Personal data". If we cannot verify who you are, we may ask you for additional information.
3. We reply free of charge within one month. For complex or numerous requests, this may be extended by two more months; we will tell you within the first month.

Complaints to the supervisory authority

1. If you believe we process your data unlawfully, you can complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro, or to the authority in the EU country where you live.
2. It would help if you wrote to us first so we can fix the problem, but you do not have to.

How we protect it

1. The site and the API use encrypted connections (HTTPS) only.
2. We store passwords only in hashed form. Forms in the account area are protected against forged requests (CSRF).
3. Every API request and every back office screen is limited to the data of the account making it. Users added by a partner have the same limits.
4. Only team members who need the data for the platform, invoicing or support can access it.
5. If a data breach occurs that may affect your rights, we notify ANSPDCP and, where the law requires it, we notify you as well. For partners' customer data, we notify the partner, as the controller.

Cookies

1. We use strictly necessary cookies to remember your choice in the cookie banner and, in the account area, for sign-in and security. Analytics cookies start only with your consent. The full list and how to change your choice: cookie policy.

Changes to this policy

1. We may update this policy when the law, our providers or the way we process data change. The new version is published on this page with its update date.
2. If a change significantly affects your rights and you have a partner account, we will also tell you by email.
3. The rules for using the site and the framework for partners: terms and conditions.