Privacy Policy

Last updated: 2026-04-23

This Privacy Policy explains how Motoc Development S.R.L. ('Groteval', 'we') processes your personal data when you use the Groteval platform. We are the data controller for the processing described below.

Who we are

Groteval is operated by Motoc Development S.R.L., registered in Romania. Contact us at privacy@groteval.com for any data-protection questions.

Data we collect

Account data (email, display name, phone number if provided), billing identity (name and address used on invoices), seller profile data for DAC7 reporting, bid and transaction history, and technical data like IP addresses and browser information in server logs.

Legal basis for processing

Most processing is based on contract performance (Art. 6(1)(b) GDPR) — we cannot run the platform without your account data. Invoicing is based on legal obligation (Art. 6(1)(c)). Anti-fraud and audit logs are based on our legitimate interest (Art. 6(1)(f)). Phone number collection is based on your consent (Art. 6(1)(a)), which you can withdraw at any time.

How long we keep your data

Account data is retained while your account is active and for 30 days after deletion. Invoices and DAC7 seller-profile data are retained for 10 years as required by Romanian fiscal law. Audit logs are retained for the duration required by applicable regulation (GDPR, DSA, Romanian tax code).

Your rights

You have the right to access, rectify, and erase your personal data, to restrict or object to processing, and to data portability. You also have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP, www.dataprotection.ro). Contact privacy@groteval.com to exercise any of these rights.

Who we share data with

We share data with processors who help us run the platform: Google (Firebase authentication), Stripe (payment processing), Amazon Web Services (file storage and email delivery), Vercel (hosting), and ANAF (Romanian tax authority, for DAC7 and e-Factura reporting). Where processors are outside the EU, we rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.