This notice is addressed to individuals ("the Taxpayer") who complete Formular 230 through the Quorify 230 service. It explains who processes your data, what we collect, why, how long we keep it, and your rights. It is provided at the point of collection, in accordance with Art. 13 GDPR.
1. Who processes your data
1.1. The data controller is the organization you choose as the redirection beneficiary (its name and fiscal identification code are shown on the completion page). It determines the purpose and means of processing and is responsible to you for the data collected.
1.2. Quorify [LEGAL ENTITY] acts solely as a processor, providing the technical tool that generates and stores Formular 230. Quorify processes the data only on the organization's instructions and under this notice.
1.3. Data protection contact at the processor: Patriciu Roșată, contact@usequorify.com.
2. What we collect
2.1. We collect only the data needed to complete Formular 230:
- Mandatory: last name, first name, national ID number (CNP), address (street, locality, county/sector) and signature.
- Optional: father's initial, number, building, staircase, floor, apartment, postal code, phone and email address.
- Your redirection options: the percentage (up to 3.5% of income tax) and, if you choose, the two-year distribution.
2.2. For security and anti-fraud purposes we retain a cryptographic hash (SHA-256) of the IP address and browser agent at submission time, plus the consent date and time. We never store the IP address in clear text.
3. Purpose
3.1. The data is used solely to generate Formular 230 and make it available to the chosen organization for filing with ANAF. We do not use it for marketing, do not sell it, and do not combine it with other organizations' data.
4. Legal basis
4.1. Processing is based on your explicit consent (Art. 6(1)(a) GDPR), given by ticking the consent box before submission.
4.2. CNP is a special-regime category of data. It is processed on the basis of explicit consent (Art. 9(2)(a) GDPR) and in compliance with Art. 4 of Law 190/2018, benefiting from the enhanced security measures in section 6.
5. Who we disclose data to
- The beneficiary organization, which downloads the collected forms and files them with ANAF on your behalf.
- Quorify's sub-processors strictly necessary to run the service: Supabase (encrypted data storage, in the European Union) and Vercel (compute at form-generation time). The full, current list is at /legal/subprocessors.
5.1. Formular 230 PDF documents are never sent to the Microsoft Office preview service and do not leave the service's encrypted infrastructure.
6. How we protect your data
- Field-level encryption: your CNP and all personal data are encrypted with AES-256-GCM before storage and are never kept in clear text.
- Restricted access: only organization administrators with the specific Formular 230 management permission can access the collected data.
- Secure documents: the generated PDF is stored in a private space and is accessible only via temporarily signed links.
- Traceability: access and exports are logged.
7. How long we keep your data
7.1. Formular 230 data is kept for the collection campaign and the legal archiving period of 5 fiscal years + 1 year (aligned with the 5-year fiscal limitation term under the Fiscal Procedure Code), after which it is automatically deleted. You can request earlier deletion under section 8.
8. Your rights
8.1. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
8.2. You can exercise your rights by contacting the beneficiary organization (the controller) or writing to contact@usequorify.com. We respond within 30 days.
8.3. You have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP): B-dul G-ral Gheorghe Magheru 28-30, Bucharest; +40 318 059 211; anspdcp.ro.
9. Important - the role of Quorify and ANAF
9.1. Quorify does not file the form with ANAF, does not handle money, and does not guarantee that ANAF will accept the form. Filing with ANAF is done by the beneficiary organization, on your behalf, based on the signed form.
9.2. The redirection is a percentage of income tax you already owe the state; it costs you nothing extra. The percentage actually redirected depends on your tax situation and may be less than 3.5%. You are responsible for the accuracy of the data you enter.
9.3. The service is intended solely for adults (18 or older).