Draft version. A lawyer must review this text before it is used.

Privacy policy

1. Who is responsible for your data

The controller of the data described on this page is Promotion Performance SRL, with its registered office in Târgu Mureș, Romania (“we” or “us”). The office is a registered seat, not an office open to visitors. You can email us at motion@promotioncreative.ro.

This policy is for visitors to our website, for practices with a PediJurnal account, and for their team members.

2. Patient data

This policy does not cover patient data (such as medical history, visit findings, or photos). The controller of that data is the practice that treats the patients. We process it only on the practice’s behalf, under the data processing agreement.

If you are a patient and have a question about your data, please contact your practice. If you write to us, we’ll pass your request on to the practice.

3. What data we process

• Website visitors: the technical data your browser sends automatically when it requests a page, such as your IP address, browser type, the page requested, and the time.
• Accounts: the name, email address, and role of each user in the practice, sign-in data, and the session cookie (see section 10).
• Practice and billing: the practice’s name, legal name, tax ID, city, address, phone, and email, the subscription plan, payment status, and invoices. Card details go only to Stripe. We don’t see or store them.
• Correspondence: what you write to us by email.

We don’t use advertising or analytics trackers.

4. Why we process data and on what legal basis

• To provide PediJurnal: creating your account, signing in, your subscription, payments, and account messages. Legal basis: performance of a contract (GDPR Article 6(1)(b)).
• To keep accounting and tax records. Legal basis: legal obligation (GDPR Article 6(1)(c)).
• To protect the website and accounts from abuse and attacks. Legal basis: our legitimate interest in keeping the service secure (GDPR Article 6(1)(f)).
• To answer your messages. Legal basis: steps you ask for before a contract, or the contract itself, as the case may be, and our legitimate interest in replying.
• To defend our rights in a dispute. Legal basis: legitimate interest.

5. How long we keep data

• Account data: as long as the account exists. When you delete the account, the data is erased at once. Backups, if any, are overwritten within 30 days at most.
• Invoices and payment records: as long as Romanian accounting and tax law requires, even after the account is deleted.
• Technical data from visits: only as long as needed for security.
• Correspondence: as long as needed to handle your request and any follow-up.

6. Who receives data

We don’t sell data. We share it only with the providers that help us run the service (processors), and only as much as they need:

• Stripe: payments and subscriptions;
• hosting provider: Namecheap, Inc. (USA);
• email sending service: Namecheap, Inc. (USA).

We share data with authorities only when the law requires us to.

7. Transfers outside the EEA

Stripe may process data outside the European Economic Area. In that case, the transfer is based on the standard contractual clauses approved by the European Commission. If we choose a hosting or email provider that processes data outside the EEA, we’ll update this page and use one of the safeguards the GDPR provides.

8. Your rights

You have the right to:

• find out what data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data erased;
• have processing restricted;
• receive your data in a format another program can read (portability);
• object to processing based on our legitimate interest.

Email us at motion@promotioncreative.ro. We reply free of charge within one month at most. We may ask for information to confirm that the request comes from you.

9. Complaints to the authority

If you believe we process your data unlawfully, you can file a complaint with the Romanian data protection authority (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), www.dataprotection.ro. Please write to us first; we may be able to fix the problem faster.

10. Cookies

We use the session cookie, which is strictly necessary for the website to work and for signing in. If you tick “Trust this device for 30 days” at two-step sign-in, a second strictly necessary cookie remembers for 30 days that this device has already passed the second step; it holds only a signed number for your login. We don’t use either for advertising or statistics. The law does not require consent for strictly necessary cookies, which is why you don’t see a cookie banner.

11. Changes

If we change this policy, we’ll publish the new version on this page. We’ll tell account holders about important changes by email.

12. Contact

For any question about your data: motion@promotioncreative.ro.

Last updated: 2026-10-29