Service provider
- Legal name
- FARAJ IT SRL
- Tax identifier
- 32687701
- Trade register
- J12/161/2014
- Registered office
- Aleea Padin nr. 32, bl. B2, ap. 43, jud. Cluj, 400557, Cluj-Napoca, RO
- contact@myfactura.ro
- Phone
- +40748547796
Company identity source: ONRC · 2026-10-19. ANAF check: 2026-11-05.
1. Who is responsible for data
The entity identified in the legal information on this page is the controller for data used to administer accounts, the commercial relationship, its own legal obligations, support and service security. Contact details for data protection requests are displayed with the controller's identity.
For personal data in invoices, customer records and other documents provided by an organisation, that organisation generally determines the purpose of processing and the MyFactura Provider acts as a processor. The processing agreement describes that relationship. Controller or processor status depends on the actual activity, not solely on a document's title.
2. Data processed
Data varies with the functions used. Avoid including unnecessary information, particularly sensitive data or personal identifiers in free-text fields.
- Account and organisation: name, email, phone, protected authentication information, roles, company or sole trader identification and contact details, uploaded profile images or logos.
- Documents and activity: partners' contact and identification details, document lines, amounts, taxes, bank accounts, payments received and information you choose to enter or import.
- Enquiries: name, email, phone, subject, message, company and other information provided through contact or investment-interest forms, together with related replies.
- Operation and security: session, access and operation information, technical identifiers, IP address and request information to the extent needed to operate and protect the service.
- Available integrations and payments: ANAF connection authorisations and identifiers, submission messages and results, and payment provider customer, subscription or transaction identifiers when the function is enabled.
3. Sources of data
We receive data from you, the organisation and users creating or administering your access, partners whose information is uploaded in documents and, for functions used, tax sources or authorised external services. Some technical information is generated through use of the application.
If your data appears in a MyFactura client's document, the organisation creating that document can explain the purpose and legal basis for its use. The Provider assists that organisation with requests and does not determine the lawfulness of the document on its behalf.
4. Purposes and legal bases
We use necessary data to provide the account and requested functions, answer enquiries and administer the Client relationship. Performance of a contract or requested pre-contractual steps may be the basis where the data subject is personally a party to that contract. For an organisation's representatives, professional communication and relationship administration may rely on a legitimate interest in conducting that relationship.
Meeting tax and other legal requirements relies on the applicable legal obligation. Preventing abuse, protecting accounts and defending rights may rely on legitimate interests after assessing necessity and the impact on individuals. Where processing requires consent, it is requested separately and can be withdrawn.
Accepting terms or reading this policy is not general consent to marketing or optional tracking. For data processed on the Client's behalf, the Client determines the legal basis and the Provider follows its lawful instructions.
5. Who may receive data
Data may be accessed by the organisation's authorised users and persons authorised to provide operation or support. It is disclosed to necessary providers only for services used, and to authorities where there is a legal basis.
The application, database and application storage run on a Hostinger VPS in Frankfurt, Germany. An automatic application email provider is not configured; Resend is a planned integration that is not yet active. The contact@myfactura.ro mailbox works separately from automatic application email delivery. Stripe is configured for payments and subscriptions, but online payment is not yet active; it may act as a controller for some purposes and as a processor for others. ANAF is an authority receiving data in authorised tax workflows, not a commercial MyFactura subprocessor.
Documents sent at the Client's request reach the selected recipients. A document shared by link may be accessed by people possessing that link. The provider list separately describes purposes, roles and information still to be confirmed before production use.
6. Locations and international transfers
The application, database and application storage are hosted on a Hostinger VPS in Frankfurt, Germany. This confirmed location concerns the VPS; it does not, by itself, establish the location of backups, support access or processing by other providers. We do not claim that all data resides exclusively in the European Union.
Before a transfer outside the European Economic Area, the countries, recipients and applicable legal mechanism must be identified: for example, an adequacy decision or standard contractual clauses, together with the necessary assessment and supplementary measures. Information on applicable safeguards and how to obtain a copy may be requested from the controller.
7. How long data is kept
Retention depends on purpose, relationship duration, legal obligations and the justified need to handle complaints or defend rights. This policy does not establish a single retention period for accounts, messages, documents, logs and backups.
The Provider's own documents subject to tax obligations are treated separately from documents processed for the Client. The Client's obligation to retain accounting documents does not, by itself, require the Provider to retain all account data. On termination of processing for the Client, the processing agreement's return or deletion instructions and legal exceptions apply.
Specific retention categories and periods, including backup removal cycles, must be confirmed for the production service. Account closure does not mean immediate deletion of data subject to legal retention, nor a promise of unlimited archiving.
8. Your rights and response times
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction and, where applicable, portability and objection. You may withdraw consent at any time without affecting the lawfulness of earlier processing. You may object to direct marketing at any time.
Send requests to contact@myfactura.ro. We may request only the additional information necessary to verify identity and locate the data concerned. A response is provided without undue delay and normally within one month of receipt. Where the law permits an extension of up to two further months, we inform you within the first month and explain the reason.
Your profile lets you record a request, follow its status and read the reply available in your account. Erasure and closure requests are assessed separately from the subscription and legally retained records; the form does not erase data automatically. Use the contact form for requests without an account.
Your profile also provides a JSON export of your own account data after you confirm your current password. The file includes the categories explained in it, such as your profile, your access rights, billing data and contractual evidence. Company archives and other people's data have separate processes and checks; the automated export does not limit your right to request other relevant personal data.
Describe your request and your relationship with the service. For your security, do not include passwords, authentication codes or copies of identity documents in your first message.
Rights are not absolute: for example, erasure may be limited by a legal retention obligation. Where we process data on an organisation's behalf, we forward the request to the relevant controller and assist it. You may complain to Romania's ANSPDCP through www.dataprotection.ro, or to the competent supervisory authority, and seek a judicial remedy.
9. Required data and automated decisions
Required fields support account creation, organisation identification, security or the requested function. Without them, we may be unable to provide that function. Additional fields should be completed only where relevant to your enquiry or document.
Current functions are not presented as making solely automated decisions with legal or similarly significant effects on individuals. Tax validations, calculations and access controls do not replace the Client's decisions about its activities.
10. Security and updates
Data protection requires technical and organisational measures appropriate to risk, access limited to authorised persons and incident handling. No online service can promise to eliminate every risk. Specific measures and obligations for Client data are established in the processing agreement and its annexes.
This policy is updated when processing or applicable requirements change. Relevant changes are accompanied by appropriate information; a new purpose requiring a different legal basis is not authorised merely by changing this policy's text.
Send a request
You can submit an account-related request from your profile and follow the reply in the application. For requests without an account, use the contact form.