Full details on how we use your data: what we process, who we share it with and what automated decisions we make.
Updated: 12 October 2026
This English version is a translation provided for convenience only; in the event of any discrepancy, the Romanian version prevails.
| Category | Data collected | Legal basis | Retention |
|---|---|---|---|
| User account | Name, email, password (one-way bcrypt hash only), phone*, company*, tax ID (CUI)*, address* | Contract (6(1)(b)) | Account lifetime + 3 years |
| IMEI/serial checks (with an account) | IMEI/serial, result, date/time, account ID | Contract (6(1)(b)) | 2 years |
| Checks (without an account) | IMEI/serial, result, delivery email* | Contract (6(1)(b)) | 30 days of report access |
| Model identification | IMEI/serial, brand and model (not linked to an account) | Legitimate interest (6(1)(f)) | 90 days from identification |
| Payments | Transaction ID, amount, date (no card data) | Legal obligation (6(1)(c)) + Contract | 10 years (tax) |
| Support / contact | Name, email, message, IP, user agent | Legitimate interest (6(1)(f)) | 3 years |
| Security / logs | IP, security actions | Legitimate interest (6(1)(f)) | 1 year |
| Analytics (with consent) | Anonymised browsing data | Consent (6(1)(a)) | up to 2 years (Google) / 1 year (Clarity) |
| Newsletter (with consent) | Consent (6(1)(a)) | Until unsubscription + 1 year |
* Optional field or specific to the account type
Verification data (IMEI/serial number) is transmitted to our data partners (GSMA, Apple and mobile operator databases) in order to generate the report. The data is used exclusively for the purpose of the requested verification.
We send you transactional emails: order confirmation, report delivery, security notifications (new login, password change). These communications do not require marketing consent and cannot be disabled for as long as you hold an account.
If you have subscribed to the newsletter, we send you news about our services, guides and offers. You can unsubscribe at any time through the link in any email or by writing to us at contact@codat.ro.
Anonymised and aggregated data (without personal identifiers) is used to analyse the performance of the platform, detect errors and develop new features.
We may use data to comply with our legal obligations (requests from authorities, tax obligations) and to prevent fraud, abuse or unauthorised access.
The reports and the AI assistant on Codat.ro use large language models (LLMs) provided by Anthropic, to summarise verification results into readable text and a recommendation score, and by OpenAI, to automatically read the IMEI from photos. When OpenAI does not respond, the image is sent for reading to the Gemini models of Google. The data sent is exclusively technical data about the device (or the image uploaded for IMEI reading), not personally identifying data.
We do not take decisions based solely on automated processing which produce legal effects or similarly significant effects concerning natural persons, within the meaning of Art. 22 GDPR. The reports are information tools, not decisions.
Codat.ro does not use high-risk AI systems within the meaning of Regulation (EU) 2024/1689 (AI Act), Article 6 and Annex III.
We do not carry out profiling within the meaning of Art. 4(4) GDPR for automated marketing purposes or to evaluate personal aspects. Behavioural analysis aimed at improving the service is based exclusively on aggregated and anonymised data.
We do not sell your data. We share data with third parties only where necessary to provide the service:
You have the right of access, rectification, erasure, restriction, portability and objection. To exercise any of these rights: contact@codat.ro. We respond without undue delay and at the latest within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months; in that case, we will inform you of the extension and the reasons for it within the first month.
For the complete deletion of your data, see the dedicated page.
You can lodge a complaint with ANSPDCP: dataprotection.ro
Contact: contact@codat.ro