Privacy notice: buyers and waitlist
Version: privacy-buyers 2026-10-08
Version privacy-buyers 2026-10-08 · Prepared in line with the GDPR and Romanian law; not reviewed by a lawyer.
This notice explains how PPFTEC S.R.L. handles personal data when you buy a Bandplain licence (Part A) or join the Bandplain waitlist (Part B). It is given under Article 13 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
It does not cover the payroll and pay data you import into the Bandplain app. That data is processed only on your own device; we do not receive, store or have access to it. Your company is the controller of that data. How the app itself handles the little data we do see (delivery logs, support) is described in the app privacy notice.
1. Who is responsible
The controller is PPFTEC S.R.L., Romania · CUI RO55537142 · Trade Register no. J2026052999008 · registered office: see Company details.
Contact for privacy questions and requests: support@ppftec.com. Please write "Privacy" in the subject line.
We have not appointed a data protection officer. We do not carry out large-scale monitoring of people or large-scale processing of special categories of data, which are the cases in which the GDPR requires one (Article 37).
Part A — Buying a licence
2. What data we process
Most of the data in an order is company data. Some of it is personal data, mainly about the person who places the order.
| Category | Examples | Where it comes from |
|---|---|---|
| Order contact | your e-mail address; your name if you enter it, for example as the cardholder name | you, on the Stripe checkout page |
| Company and billing data | the company's legal name, billing address and country | you, on the Stripe checkout page |
| VAT identification number and its check result | the EU VAT number you enter, and the result of its check in the EU VIES system (valid, not valid, or not confirmed) | you; the result comes from the VIES system through Stripe (section 5) |
| Payment data | card type, last four digits, expiry date, payment status, amount and currency | you, entered on Stripe's page. We never see or store your full card number |
| Licence record | licence id, company name, validity date, the version of the terms of sale you accepted, billing country, Stripe reference numbers, the status of the VAT check, and the status of the licence e-mail | created by us when you pay |
| Acceptance record | that you ticked the box accepting the terms of sale, and when | Stripe's checkout records it |
| Invoices and receipts | the invoice with the company and billing data, the VAT number and the amount | created by us through Stripe |
| Messages | e-mails we send you (licence code, renewal reminder, receipts) and any e-mail you send us | us, you |
| Technical data at checkout | IP address and device and browser data, collected by Stripe on its own checkout page for security and fraud prevention | your browser, to Stripe |
Our own licence database holds no e-mail address, no VAT number, no billing address and no card data. It holds the company name, the billing country, the licence data and Stripe reference numbers. The other data stay in your Stripe customer record, which we can see in our Stripe account.
3. Why we use the data, and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Taking your order, issuing and e-mailing your licence code, renewing and cancelling the licence, refunds, and answering your questions about the order | order contact, company and billing data, payment data, licence record, messages | performance of the contract with your company, and steps you ask for before it (Article 6(1)(b) GDPR). Where the data are about you as the company's representative rather than a party to the contract, our legitimate interest in performing the contract with your company (Article 6(1)(f)) |
| Checking that your company can buy from us: an EU business established outside Romania, with a valid VAT number (section 5) | VAT number and its check result, billing country | legal obligation (Article 6(1)(c)): EU VAT rules allow us to treat the buyer as a business, and to apply the reverse charge, only once we have checked its VAT number (Council Implementing Regulation (EU) No 282/2011, Article 18(1)(a)); and the contract (Article 6(1)(b)) |
| Issuing invoices, keeping accounts and filing tax returns, including the EU sales list (form D390) | company and billing data, VAT number, invoices | legal obligation (Article 6(1)(c)): Romanian Fiscal Code Articles 319 and 325; Accounting Law 82/1991 |
| Keeping proof of what was agreed (the version of the terms you accepted and when), and handling disputes, chargebacks and legal claims | acceptance record, licence record, invoices, messages | our legitimate interest in proving the contract and defending legal claims (Article 6(1)(f)) |
| Preventing payment fraud and abuse | payment data, technical data at checkout | our legitimate interest in secure payments (Article 6(1)(f)). Stripe also does this for its own purposes, as a separate controller (section 4) |
Do you have to give the data? Yes, to buy. The e-mail address, company name, billing address, VAT number and payment data are needed to conclude and perform the contract and to issue a valid invoice. Without them, or without a VAT number that the check confirms, we cannot issue a licence.
Our legitimate interests are: performing the contract with your company, proving what was agreed, defending legal claims, and keeping payments secure. You may object to processing based on them (section 9).
We do not use buyer data for marketing. We send you only e-mails about your order, your licence and its renewal.
4. Who receives the data
We use these service providers. Each processes the data only on our instructions under a data processing agreement, unless stated otherwise.
| Recipient | What it does for us | Role | Where |
|---|---|---|---|
| Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, LLC, USA) | checkout page, card payment, VAT number collection and VIES check, invoices and receipts, renewal reminders, customer portal | our processor for our payments and invoices. Stripe is also a separate controller for its own purposes, such as fraud prevention, anti-money-laundering and other legal obligations, under its own privacy policy: https://stripe.com/privacy | EU and USA (section 6) |
| Cloudflare (Cloudflare, Inc. and its group) | hosting of the site and the payment back-end; our licence database (stored in the EU) | processor | licence database in the EU; network traffic may pass through locations outside the EU (section 6) |
| Zoho (ZeptoMail, EU data centre) | sending the licence e-mail and other e-mails about your licence | processor | EU data centre (section 6) |
| Our accountant | bookkeeping and tax returns | our external accounting provider | Romania |
| Romanian tax authority (ANAF) and other public authorities | tax returns, including form D390, which lists the buyer's VAT number and the amount; any other disclosure the law requires | separate controllers | Romania |
| Courts, lawyers, debt or dispute bodies | only if needed to establish or defend a legal claim | separate controllers | EU |
Stripe's cookies. Stripe's checkout and customer portal pages are on Stripe's own domain and may use their own cookies for security and fraud prevention. Stripe is responsible for them; see https://stripe.com/cookie-settings and Stripe's privacy policy. Our own site sets no cookies.
We do not sell personal data, and we do not share it with anyone else for their own marketing.
5. The VAT number check (automated)
When you pay, Stripe sends the VAT number you entered to the European Commission's VIES system ("VAT Information Exchange System"). VIES asks the tax authority of the Member State that issued the number whether the number is registered and valid for intra-EU trade. The answer is valid or not valid; it may also be "not confirmed" when the national system does not answer.
Our system then decides automatically, with no person involved:
- valid, and the billing country is an EU Member State other than Romania: your licence code is issued and e-mailed to you;
- not valid, missing, a Romanian or non-EU number or billing country: no licence is issued. We are alerted, we cancel the order and refund the payment in full (terms of sale §2.2);
- not confirmed: we try again, and check manually within 5 working days. If the number still cannot be confirmed, the order is cancelled and refunded in full.
What this check is. It is a check of a legal condition for the sale: we sell only to EU businesses outside Romania, and EU VAT rules require us to verify the buyer's VAT number. It does not assess you as a person and does not involve profiling. It concerns the company's VAT number, not you. We therefore consider that it is not a decision about you within Article 22 GDPR; we explain it here anyway.
If you think the result is wrong, for example because the national system was down, write to support@ppftec.com. A person at PPFTEC will check the number again manually in VIES and tell you the result. You can also check the number yourself on the European Commission's VIES page.
Apart from this check, we make no decisions based solely on automated processing, and we do no profiling.
6. Transfers outside the European Union
Some of our providers process data outside the European Economic Area (EEA), mainly in the United States.
| Provider | Transfer | Safeguard |
|---|---|---|
| Stripe | to Stripe, LLC and other Stripe entities in the USA and other countries | the EU-U.S. Data Privacy Framework (European Commission adequacy decision (EU) 2023/1795), for which Stripe states it is certified; and the European Commission's Standard Contractual Clauses in Stripe's data processing agreement |
| Cloudflare | network traffic, security processing (including Turnstile on the waitlist form) and support may involve Cloudflare, Inc. in the USA and other locations | the EU-U.S. Data Privacy Framework, for which Cloudflare states it is certified; and the Standard Contractual Clauses in Cloudflare's data processing agreement, which also apply if the Data Privacy Framework stops applying |
| Zoho (ZeptoMail) | data are stored in Zoho's EU data centre; Zoho group companies outside the EEA may access them, for example for support | the Standard Contractual Clauses in Zoho's intra-group agreements and data processing agreement |
You can check a company's Data Privacy Framework certification on the official list: https://www.dataprivacyframework.gov/list. You can ask us for a copy of the safeguards (the relevant clauses) at support@ppftec.com.
7. How long we keep the data
| Data | How long |
|---|---|
| Invoices, receipts and the accounting records based on them (including the company and billing data and VAT number on them) | 5 years from 1 July of the year after the financial year in which they were issued (Romanian Accounting Law 82/1991, Article 25) |
| Licence record and acceptance record | for the life of the licence and 3 years after it ends, or for the invoice period above if that is longer (3 years is the general limitation period for claims under the Romanian Civil Code, Article 2517) |
| E-mails about your order or licence, sent by you or by us | together with the licence record they relate to |
| Records of Stripe events in our payment back-end (event type and reference only) | 90 days |
| Stripe's own records | as set by Stripe under its privacy policy, where Stripe acts as a separate controller |
When a period ends, we delete the data or make them anonymous. A longer period applies only where we need the data to establish or defend a specific legal claim, until that claim is settled.
Part B — The waitlist
8. Waitlist data
| Topic | Detail |
|---|---|
| What we collect | your e-mail address; what describes you (company, HR consultant or accountant, other); your country; your company size band (needed only if you are a company); the page you signed up on (path only); the label of the link you came from (utm_source), if any; the version of the consent text you saw and when you agreed; and the dates you confirmed and were last active |
| What we do not store | your IP address. It is used in passing to limit abuse and to run the bot check below, and is not saved in our database |
| Why | to confirm your address and to tell you when early access to Bandplain opens |
| Legal basis | your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in our e-mails, on the unsubscribe page, or by writing to support@ppftec.com. Withdrawal does not affect what we did before |
| Double opt-in | you join only after you open our confirmation e-mail and press "Confirm" |
| Bot protection | the sign-up form uses Cloudflare Turnstile, which reads technical signals from your browser and your IP address to check that the sign-up is not automated. Its purpose is only to protect the form from abuse. It sets no advertising or tracking cookies |
| Where it is stored | in a Cloudflare D1 database stored in the EU. E-mails are sent through Zoho ZeptoMail (EU data centre). Transfers: see section 6 |
| Required fields | e-mail, role, country and consent are needed to join; company size is needed only if you are a company. Without them you cannot join the waitlist; nothing else happens |
| Automated decisions | none, and no profiling |
| Tracking | our e-mails contain no tracking pixels and no tracked links. The site uses no analytics and no cookies |
How long we keep waitlist data:
- unconfirmed sign-ups: deleted after 7 days;
- confirmed sign-ups: until you unsubscribe, or until 24 months pass without activity from you (confirming, or asking to stay on the list). We then delete your entry;
- when you unsubscribe, we delete your entry at once. For 30 days we keep only a one-way coded value (a keyed hash) of your address, so that nobody can flood you with new sign-up e-mails and your deletion survives a restore from backup;
- deleted data disappear from our database backups within 7 days;
- Zoho keeps a log of the e-mails it sent for the period set in its own service terms.
Joining the waitlist does not create an account and does not commit you to buy. If you later buy a licence, Part A applies to the purchase.
Part C — For everyone
9. Your rights
You have the right to:
- access the personal data we hold about you and receive a copy (Article 15 GDPR);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17). We cannot erase data we must keep by law, such as invoices, until the legal period ends;
- restrict our processing, for example while we check a disputed point (Article 18);
- receive the data you gave us in a structured, machine-readable format and have them sent to another controller (portability, Article 20), where the processing is based on consent or contract and carried out by automated means;
- object at any time, for reasons relating to your situation, to processing based on our legitimate interests (Article 21). We will then stop, unless we have compelling legitimate grounds or need the data for a legal claim;
- withdraw your consent at any time where we rely on it (the waitlist), without affecting what we did before (Article 7(3));
- ask that a person reviews the VAT number check result (section 5).
To use these rights, write to support@ppftec.com. We may ask you to confirm the request from the e-mail address we hold, so that we do not give your data to someone else. We answer within one month; if a request is complex, we may extend this by up to two more months and will tell you why (Article 12(3)). Using your rights is free of charge.
10. Complaints
You can complain to the Romanian data protection authority:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) — https://www.dataprotection.ro — complaints: https://www.dataprotection.ro/?page=Plangeri_pagina_principala
You can also complain to the data protection authority of the EU Member State where you live, work, or where you think the problem happened (Article 77 GDPR). We would be glad if you contacted us first, so that we can try to solve the problem.
11. Security
We keep as little data as we can. Our own licence and waitlist databases hold no card data, no VAT numbers and no billing addresses, and only our own back-end services can read them. Records kept after an unsubscribe hold only a keyed hash of the address, not the address itself.
12. Changes to this notice
If we change this notice, we publish the new version here with a new version date and keep the earlier versions available. If a change affects how we use your data, we tell buyers and confirmed waitlist members by e-mail before it applies.