GDPR Rights and Procedures

The GDPR gives you specific rights over the personal data we hold about you. You may request:

• Access — a copy of the personal data we hold about you (Art. 15)
• Rectification — correction of inaccurate or incomplete data (Art. 16)
• Erasure — deletion where the legal conditions are met (Art. 17)
• Restriction — temporary limitation of processing (Art. 18)
• Portability — machine-readable export of data you provided (Art. 20)
• Objection — to processing based on legitimate interests (Art. 21)
• Withdrawal of consent — for any processing that relied on consent (Art. 7(3))
• Complaint — to ANSPDCP or your local supervisory authority (Art. 77)

Send your request to [email protected]. Tell us which right you want to exercise and any details that help us locate the record (account email, subscription ID, approximate dates).

You can update your own profile fields in the workspace. Export and account deletion are handled by our team on request. Write to [email protected] and we will complete both within the period Article 12(3) allows.

To protect your data we verify the requester is the data subject. For active accounts we send a verification email to the address on file. For closed accounts we may ask for additional confirmation (two of: the work email previously used, a recent invoice number, or the identifier of a run on the account). We ask for an identity document only where nothing else can settle it, we accept it with everything except your name and photograph redacted, and we delete it as soon as the request closes. Excess data sent for verification is discarded after the request closes.

We respond within one month of receiving your request, as Article 12(3) GDPR requires, free of charge for normal requests. The month runs from when the request arrives, not from when we finish identifying you. We may extend by a further two months for complex or numerous requests; we will tell you within one month of receiving the request that we are extending, and why. Manifestly unfounded or excessive requests may carry a reasonable fee or be refused, and we will tell you why.

Some data is held under legal obligations and cannot be deleted on request. In particular, invoices, billing records, and VAT data are retained for 5 years, calculated from 1 July of the year following the financial year in which they were drawn up, under Article 25 of Romanian Law 82/1991 as amended by Law 36/2023. Where we cannot fulfil an erasure request we explain why and we erase the rest of your record — account fields, audit logs, report inputs — on request, as Section 6 of the Privacy Policy explains.

We follow Articles 33 and 34 GDPR. If we detect a personal data breach that is likely to result in a risk to your rights and freedoms, we notify ANSPDCP without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to you, we notify you directly without undue delay. Where we act as processor for a business customer, we notify that customer within 24 hours of becoming aware, which is shorter than the law requires of us and is the commitment our customers actually need.

Our current sub-processor list is at noda.energy/legal/subprocessors. We have a signed data processing agreement with each, including Standard Contractual Clauses where personal data flows outside the EEA. To receive our own data processing agreement as customer, write to [email protected] and we will send it and sign it. We give at least 15 days' notice before adding a new sub-processor to the list.

The Romanian Data Protection Authority is:

• Name: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania
• Email: [email protected]
• Phone: +40 318 059 211
• Web: dataprotection.ro