1. Data Controller
BunaMia ("we", "us", "our") is the online platform described in these documents. It is operated by Oleksandr Dziuba, a natural person domiciled in Bratislava, Slovakia, who is the data controller responsible for your personal data.
Contact: info@bunamia.ro
2. Data We Collect
Data you give us:
- Full name
- Email address
- Phone number
- Organisation name (optional)
- Profile photo, cover photo, and short bio (optional)
- Social media handles and website (Instagram, Facebook, WhatsApp) (optional)
- Portfolio photos of your work (optional)
- Content of listings you publish
- Content of private messages and any images you send through the messaging feature
- Favorites and likes (listings, specialists, and portfolio items you save)
- The content of any report you submit
Data we record automatically:
- Technical data: IP address at registration and at your most recent visit, browser, device
- The IP address and browser recorded at the moment you accept our Terms and Privacy Policy, together with the version you accepted and the language you read it in, kept as proof of acceptance
- The IP address recorded with a report you submit, and IP addresses we block for abuse or security reasons
- A log of the transactional emails we send (recipient, type of email, subject, delivery status, date)
- Usage data: pages viewed, the site that referred you, your approximate country, and key actions such as publishing a listing or running a search (see clause 9)
We also receive data about you from other users (for example when someone submits a report about one of your listings or messages) and from Google, if you choose to sign in with it.
3. Purposes and Legal Basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Publishing listings and delivering messages between users | Performance of a contract (Art. 6(1)(b)) |
| Favorites, likes, and service notifications | Legitimate interest (Art. 6(1)(f)) |
| Moderation, handling reports, preventing fraud and abuse | Legitimate interest (Art. 6(1)(f)); legal obligation under the DSA (Art. 6(1)(c)) |
| Keeping proof that you accepted our Terms and Privacy Policy | Legal obligation (Art. 6(1)(c), read with Art. 7(1)) |
| Establishing, exercising, or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
| Improving platform security and performance | Legitimate interest (Art. 6(1)(f)) |
| Understanding how the platform is used, in aggregate | Legitimate interest (Art. 6(1)(f)) |
| Compliance with other legal obligations | Legal obligation (Art. 6(1)(c)) |
You may object at any time to processing based on legitimate interest; see clause 7.
4. How Long We Keep Data
We keep your account data for as long as your account is active. If you delete your account, your profile data, listings, portfolio, uploaded images, and favorites are permanently erased within 30 days.
Records relating to moderation, reports, abuse, acceptance of the legal documents, and emails sent are kept for as long as they remain necessary for the purpose they were created for: for as long as we may still be called on to account for our actions or to defend a legal claim. They are then deleted. Data we are required by law to retain is kept for the period the law prescribes.
5. What Happens When You Delete Your Account
Your account is deactivated immediately: your listings, profile, and portfolio stop being visible. Within 30 days we permanently erase the data listed above.
Some limited records are not erased at that point, and we want to be explicit about them:
- Private messages you sent to other users remain in the recipient's conversation history, shown under a neutral placeholder name rather than yours. A conversation is the recipient's record too, and removing one side of it would destroy their account of what was said. They are deleted when the recipient deletes them or deletes their own account.
- Reports you submitted or that concerned you, records of moderation actions, proof that you accepted the legal documents, and the log of emails sent are kept as described in clause 4, so that we can handle repeat abuse, answer authorities, and show that we met our obligations.
- Database backups, which we make so that the platform can be restored after a failure, may still contain already-deleted data for a period. These copies are not used in day-to-day operation and are replaced as newer ones are made.
These records rest on our legitimate interest and on our legal obligations. You can object to them, and we will assess your objection individually.
6. Data Sharing
We do not sell your personal data. We share it only with service providers who process it on our instructions under a data processing agreement: our server hosting provider (European Union), Resend, Inc. for delivering transactional emails (United States, with the transfer covered by the European Commission's Standard Contractual Clauses), and Umami Software, Inc. for analytics (see clause 9). If you sign in with Google, we receive your name and email address from Google Ireland Ltd. to create or access your account; Google processes that data under its own privacy policy.
We may disclose data to public authorities where we are legally required to do so, and to our legal advisers where necessary to defend a legal claim.
The Platform is currently operated by a natural person. If the business is transferred to a legal entity we establish to continue it, or to an acquirer, your data may be transferred to that entity, which will process it for the same purposes and under the same safeguards described here. We will tell you in advance by a notice on the platform or by email, and if you do not want your data transferred you can delete your account before the transfer takes place.
Please note: the information you publish in a listing or on your specialist page (including your name, photo, organisation, and, once a visitor clicks to reveal them, your phone number and WhatsApp) is publicly visible on the internet and may be indexed by search engines. Do not publish anything there that you do not want to be public. Likewise, when you contact a specialist, that specialist receives your personal data and becomes an independent data controller for it; we are not responsible for how they subsequently use it.
7. Your Rights
Under the GDPR you have the following rights:
- Right of access: Request a copy of your personal data.
- Right to rectification: Correct inaccurate or incomplete data.
- Right to erasure: Request deletion of your data ("right to be forgotten"), subject to the records described in clause 5.
- Right to restriction: Request that we limit how we process your data.
- Right to data portability: Receive your data in a structured, machine-readable format.
- Right to object: Object to processing based on legitimate interest, on grounds relating to your particular situation.
- Right to withdraw consent: Where processing rests on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at info@bunamia.ro. We will respond within one month; where a request is complex we may extend that period by up to two further months and will tell you within the first month. We may ask you for information needed to confirm your identity, so that we do not disclose your data to someone else.
8. Right to Lodge a Complaint
If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with a competent supervisory authority: that of the country where you habitually reside, where you work, or where the alleged infringement took place. Because the operator is established in Slovakia, our lead supervisory authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), dataprotection.gov.sk. Users in Romania may equally complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro, which will coordinate with the lead authority. A list of all EU data protection authorities is available at edpb.europa.eu.
9. Analytics
We use Umami, a privacy-focused analytics service, to understand how the platform is used in aggregate: which pages are visited, how visitors arrive, and how often key actions such as publishing a listing or running a search take place.
Umami sets no cookies and does not track you across other websites. What we see is aggregated statistics (page addresses, referring site, browser, operating system, device type, and country), never an identified person.
The service is provided by Umami Software, Inc. (United States), acting as our processor under a data processing agreement. Analytics data is stored on servers within the European Union; where the provider accesses it from outside the EEA, the transfer is covered by the Standard Contractual Clauses in that agreement.
This analytics does involve personal data: at the moment of your visit your IP address is processed and a daily, non-reversible pseudonymous identifier is derived from it; the address itself exists only in memory and is then discarded. Because nothing is stored on your device in the process, we do not ask for your consent, and the basis is our legitimate interest. That is where your right to object comes from; see clause 7. Because the stored statistics cannot be traced back to you, the most effective way to stop this processing is to block the analytics script in your browser, which has no effect on your use of the platform. We will also consider an objection sent to us by email and act on it as far as we technically can.
10. Cookies
We use only technically necessary cookies: those required for authentication and session management, for signing in with Google, and for remembering your chosen language. We do not use tracking or advertising cookies, and our analytics uses no cookies at all, which is why you are not asked to accept any.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a notice on the platform, and where a change materially affects how we use your data we will ask you to accept the updated policy. The date of the latest revision is shown at the top of this page.