Privacy Policy

This Privacy Policy explains what personal data we process when you use Joaca Bine, why we process it and what rights you have over it.

We process only the data needed for the platform to work, and we protect it in line with the applicable legislation.

Who is the data controller

Joaca Bine is operated, on a non-commercial basis, by Rosu Mircea Ionut, Eugen Nicolae Nistoroiu and Mares Marinica, as joint controllers of personal data.

For any question about the processing of your data, or to exercise your rights, you can contact us at joacabine.ro@outlook.com or through the Support section in the app.

What data we process

Depending on how you use the platform, we may process the following categories of data:

• account data, such as your email address, username and password, stored in a secure form;
• your activity on the platform, including the events you create, the ones you join, invitations, requests, teams and your friend list;
• the messages you send in the chats available in the app;
• technical data needed for the platform to work, such as authentication tokens and, if you choose to enable push notifications, your device identifier;
• the record of your acceptance of the Terms and Conditions, of this policy and of the minimum age confirmation given when you created your account;
• if you choose to sign in with your Google or Apple account, we receive from that provider an identifier of your account with them, your email address and the confirmation that the address is verified. We do not receive your password and we do not request access to any other data in your account. Your username on the platform remains the one you chose;
• aggregated statistics about the use of the platform.

If you choose to grant access to your location, it is used to show events near you. Your location is not stored on our servers, except where you explicitly choose to send it.

Why we process the data

We process your data only where there is a legal basis for it, in accordance with the GDPR:

• Performance of a contract - to create and manage your account, to organise events, to take part in them and to send the emails needed for the service to work. This also covers signing in with a Google or Apple account when you choose that method: the exchange of data with the provider happens at your request, so that we can create your session.
• Consent - for optional features, such as push notifications or access to your location. You can withdraw your consent at any time.
• Legitimate interest - for the security of the platform, the prevention of abuse, content moderation and aggregated statistics about the use of the service.
• Legal obligation - where the law requires us to keep certain information, such as the record of your acceptance of the legal documents.

Usage statistics

We collect aggregated statistics in order to understand how the platform is used and how effective our promotion campaigns are.

We do not use this information to profile users, for personalised advertising or to track your activity on other websites. We do not sell personal data and we do not take automated decisions that produce legal effects on users.

How long we keep data

We keep data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires us to.

Messages and content

• Event chat messages, including attached images, are kept for 24 hours after the event ends.
• Messages in city and team chats are kept for 7 days.
• Images attached to resolved support tickets are kept for 7 days after the ticket is resolved.
• Resolved support tickets are kept for 12 months.

Technical data

• We keep the most recent 50 notifications for each user. Older ones are deleted automatically.
• The history of push announcements sent by administrators is kept for 12 months.
• Visits coming from campaigns are kept for 12 months.
• The technical record of account deletions is kept for 24 months.
• The security log (sign-ins, administrator actions and rejected access attempts) is kept for 12 months.
• Password reset and email confirmation links are removed 7 days after they expire.
• Temporary data used while signing in with a Google or Apple account is deleted 1 day after it expires.
• Unused push notification tokens are kept for 90 days.

Accounts

• Accounts with an unconfirmed email address are deleted after 48 hours.
• Account data is kept for as long as the account is active.
• If an account stays inactive for 24 months, we send a notice by email. If the user does not come back within the next 30 days, the account and its data are deleted.

Service providers

To run the platform we work with providers that supply hosting, email delivery, image storage, push notifications, protection against automated access and map display.

Some of these providers may process data outside the European Union. In those situations, transfers are carried out using the safeguards provided by the GDPR, including the Standard Contractual Clauses approved by the European Commission or, where available, the EU-US Data Privacy Framework.

Signing in with a Google or Apple account is a different situation: that provider does not process the data on our behalf, but in its own name, as an independent controller. It learns that you signed in to Joaca Bine and applies its own privacy policy to that processing. From them we receive only the information listed above. You can withdraw access at any time from the settings of your Google or Apple account, and you can disconnect the linked account from the Profile page.

Your rights

Under the GDPR, you have the right:

• to find out what data we process about you;
• to ask for inaccurate data to be corrected;
• to ask for your data to be deleted, where the law allows it;
• to ask for the processing to be restricted;
• to object to processing based on legitimate interest;
• to download your data in a structured format;
• to withdraw your consent for the processing that is based on it;
• to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

Most of these actions can be carried out directly from the Profile page. For any other request you can contact us using the contact details above.

Exporting your data

From the Profile page, in the Your data section, you can download the data associated with your account at any time.

The export is available in an easy-to-read format and in a structured format (JSON) intended for data portability. It contains only the data associated with your account. Information about other users is limited to what is strictly necessary, and their email addresses are not included.

Deleting your account

You can delete your account at any time from the Profile page. We will ask for your password to confirm.

If you created your account exclusively with Google or Apple and do not have a password, you will first set one through a link we send you by email. After that you can delete your account in the same way.

Deletion is permanent and cannot be undone.

When an account is deleted we remove the data associated with it, including the events you created, your participations, messages, requests, invitations, friend list, support tickets and saved preferences.

We may keep only the data we are legally obliged to retain, or a minimal technical record needed for the security of the platform.

Contact

For any question about the processing of personal data, you can contact us at joacabine.ro@outlook.com or through the Support section in the app.