How we collect, use and protect your personal data, in accordance with the GDPR and Romanian law.
Updated: 26 October 2026
This English version is a translation provided for convenience only; in the event of any discrepancy, the Romanian version prevails.
Personal data is processed in accordance with:
What: First name, last name, email address, password (stored only as a one-way cryptographic hash, bcrypt with salt; never stored in plain text or in a form that can be decrypted), and optionally: phone number, company details (name, tax ID (CUI), billing address), county, locality.
Purpose: Authentication, account management, issuing tax documents.
Legal basis: Art. 6(1)(b) GDPR, performance of the contract.
Retention: For as long as the account exists + 3 years from its deletion (legal obligations), or 3 years from the last login (inactive accounts).
What: The IMEI or serial number entered, the verification result, date/time, account ID (if any).
Purpose: Providing the service, verification history, technical support.
Legal basis: Art. 6(1)(b) GDPR.
Retention: 2 years (registered account) / 30 days of access to the report (without an account).
What: When you enter an IMEI or serial number, we keep the code together with the identified brand and model. The record is not linked to the account, email or IP address of whoever entered the code.
Purpose: Showing the model automatically when the same code is entered again, without querying the data providers a second time.
Legal basis: Art. 6(1)(f) GDPR: legitimate interest (faster responses and fewer queries sent to third parties).
Retention: 90 days from identification, then automatic deletion.
What: We do not store card data. Viva.com (Viva Payments S.A.) processes the payments. We keep: transaction ID, amount, currency, date, status.
Purpose: Payment confirmation, invoicing, refunds.
Legal basis: Art. 6(1)(b) and Art. 6(1)(c) GDPR (tax obligations).
Retention: 10 years (in accordance with the Romanian Fiscal Code).
What: Name, email, subject, message content, IP address and user agent at the time of sending.
Legal basis: Art. 6(1)(f) GDPR, legitimate interest (managing customer relationships).
Retention: 3 years.
What: IP address, browser, operating system, security-relevant actions (logins, errors).
Purpose: Fraud prevention, platform security, error diagnostics.
Legal basis: Art. 6(1)(f) GDPR, legitimate interest.
Retention: 1 year.
If you accept statistics cookies, we collect anonymised data about the use of the platform through Google Analytics 4. Details in the Cookie Policy.
Legal basis: Art. 6(1)(a) GDPR, consent.
The reports and the AI assistant on Codat.ro use models provided by Anthropic (Anthropic PBC, USA) to generate summaries and the assistant's answers, and by OpenAI (OpenAI, L.L.C., USA) to automatically read the IMEI from photos. When OpenAI does not respond, the image is read using the Gemini models of Google (Google LLC, USA). Requests are routed through the Vercel AI Gateway infrastructure. The data transmitted consists exclusively of technical information about the device (the verification results or, as the case may be, the image uploaded for IMEI reading), without any personally identifying data. The transfer takes place on the basis of the Standard Contractual Clauses (SCCs) approved by the European Commission.
We do not use AI systems classified as high-risk under Regulation (EU) 2024/1689 (AI Act) to make decisions affecting the fundamental rights of users.
Your data may be accessed by:
We do not sell or transfer your data to third parties for marketing purposes.
Under the GDPR, as a data subject you have the following rights:
To exercise your rights: contact@codat.ro. We respond without undue delay and at the latest within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months; in that case, we will inform you of the extension and the reasons for it within the first month.
We implement appropriate technical and organisational measures: TLS encryption in transit, passwords stored only as a one-way cryptographic hash (bcrypt, with salt), never in plain text or in a form that can be decrypted, restricted access based on the need-to-know principle, audit logs, regular backups, anomaly monitoring. We update our security measures periodically.
In the event of a personal data breach, we notify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of it (Art. 33 GDPR). If the breach is likely to result in a high risk to your rights and freedoms, we also inform you without undue delay (Art. 34 GDPR).
We use cookies for the operation of the platform and, with your consent, for analytics and marketing. Full details in the Cookie Policy.
FIXLY TECHNOLOGY SRL
Calea Națională 37A, Botoșani, Botoșani County, Romania
Email: contact@codat.ro
We are not legally required to appoint a DPO (Data Protection Officer), but you may send any question regarding personal data to the email address above.
Contact: contact@codat.ro