Privacy Policy — App

MMV Application Privacy Policy

Last updated: 22.09.2026

1. Data controller

MMV Smart Consulting SRL (the "Controller"), established in Romania, processes personal data collected through the MMV application (the "App") — available as a web application and as a mobile application for iOS and Android — in accordance with Regulation (EU) 2016/679 (GDPR).

2. Data we collect

• Account data: first and last name, email address, phone number, role within the App, the company or companies you have access to.
• Company data: name, tax ID (CUI), registration number, address, contact and billing details.
• Uploaded documents and content: invoices, bank statements, contracts, HR documents, photos of documents taken with the device camera, and messages from the chat module.
• Operational data: trip sheets, vehicles, drivers, issued documents (invoices, receipts), generated reports.
• Technical data: IP address, device type and operating system, app version, access and error logs, last sign-in date.
• Push notification token: a device identifier issued by Firebase Cloud Messaging / APNs, used solely to deliver notifications.

The App does not collect GPS location data and does not store payment card details; online payments are handled by specialised providers.

3. Device permissions

• Camera / Photos: only to photograph or select documents you wish to upload. Permission is requested when the feature is used and may be declined.
• Notifications: for alerts about documents, messages and expiry dates. They can be disabled at any time from the operating system settings.
• Storage / Files: to save downloaded documents and reports on the device.

4. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): providing accounting services and App features, authentication, support.
• Legal obligation (Art. 6(1)(c) GDPR): retention of accounting and tax documents, reporting to authorities.
• Legitimate interest (Art. 6(1)(f) GDPR): application security, abuse prevention, service improvement.
• Consent (Art. 6(1)(a) GDPR): push notifications and optional communications.

5. Who we share data with

Strictly for the purposes above, data may be shared with: public authorities (ANAF — SPV, e-Invoicing, e-Transport), our server hosting provider, the push notification provider (Google Firebase / Apple APNs), payment processors and email service providers. We do not sell or rent personal data.

6. Transfers outside the EU

The App's servers are hosted in the European Union. Where certain service providers (for example, push notifications) involve transfers outside the EU, these are based on the standard contractual clauses approved by the European Commission.

7. Retention periods

• Account data: for the duration of the contractual relationship and 3 years thereafter.
• Accounting and tax documents: for the period required by Romanian law (generally 5 or 10 years).
• Technical logs: usually up to 12 months.
• Notification tokens: until the App is uninstalled or the permission is revoked.

8. Security

The App communicates with our servers exclusively over encrypted connections (HTTPS/TLS). Passwords are stored as hashes. Data access is segmented by company and by role, and access events are recorded in the activity log.

9. Your rights

You have the right of access, rectification, erasure ("right to be forgotten"), restriction, portability, objection, and the right to withdraw consent. These rights can be exercised by email, at the contact address published on our website.

You also have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP), www.dataprotection.ro.

10. Account and data deletion

You may request deletion of your account directly from the App or by sending a request by email. Once the request is validated, account data is deleted, except for documents subject to a statutory archiving obligation.

11. Children

The App is intended exclusively for persons aged 18 or over, in a professional context. We do not knowingly collect data from minors.

12. Changes to this policy

This policy may be updated. The version in force is the one published in the App and on the website, with the last update date shown at the top.

13. Contact

For any data protection request, you can contact us using the details published on the MMV Smart Consulting website.