Information and Consent on the Processing of Personal Data
Last updated: 26.07.2026
This document explains the conditions under which PURPOSEHAT SRL collects, processes, and protects the personal data of its clients, in accordance with Regulation (EU) 2016/679 (GDPR).
1. Introduction
PurposeHat processes personal data mainly to provide the services you purchase (performance of a contract). Where we rely on your consent — for special-category data, for marketing communications, or for using testimonials with identifying data — that consent is requested separately, is specific, and can be withdrawn at any time without affecting the lawfulness of processing already carried out. This document explains how we process personal data; it does not replace the separate, granular consent we request where the law requires it.
2. Data Controller
Controller: PURPOSEHAT SRL (hereinafter "PurposeHat" or "the Provider") CUI (Tax ID): 53635500 Trade Register: J23/2918/2025 Registered Office: Popești-Leordeni, Ilfov County, Romania Legal Representative: Claudiu Dorobanțu Contact: hello@purposehat.com
3. Categories of Data Processed
In the course of providing career counseling services, we may process the following categories of personal data: a) Identification data: first name, last name b) Contact data: email address, phone number c) Payment data: information necessary for payment processing (managed through the Stripe payment processor) d) Service-related data: CV, professional history, skills, career goals, professional assessment results, notes and observations from counseling sessions
4. Purposes of Processing
Personal data is processed for the following purposes: • Providing the contracted career counseling services • Personalizing professional recommendations • Conducting and delivering competency assessments • Communication regarding appointments, deliverables, and service updates • Issuing invoices and managing payments • Improving the quality of services provided • Compliance with applicable legal obligations
5. Legal Basis for Processing
Data processing is carried out based on the following legal grounds, pursuant to Article 6 (and, for special categories, Article 9) of the GDPR: • Performance of a contract – for providing the purchased services • Consent – for processing special-category data, for the newsletter and marketing communications, and for using testimonials or feedback together with identifying data; this consent is specific and can be withdrawn at any time • Legal obligation – for issuing invoices and fiscal compliance • Legitimate interest – for improving services and, for existing clients, for information about similar services (with an opt-out available)
6. Data Recipients
Your personal data may be shared with: • IT and hosting service providers • Payment processors (Stripe) • Professional partners involved in the counseling process, under GDPR-compliant data processing agreements • Public authorities, where required by law
7. Sub-processors and Data Transfers Outside the EU
Our main processors are: Supabase (database and hosting) – EU (Frankfurt, Germany); Stripe (payments) – US, under the EU-US Data Privacy Framework and Standard Contractual Clauses; Brevo (newsletter) – EU (France); Resend (transactional email) – US, under Standard Contractual Clauses; Google Analytics (only with consent) – Google Ireland, US transfer under the EU-US Data Privacy Framework. Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards are in place (the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission). See the Privacy Policy for details.
8. Data Retention
Personal data is stored only for as long as necessary to fulfill the purposes for which it was collected: billing and accounting data for 10 years (fiscal obligations); contract and service data for the contractual relationship plus up to 3 years; data based on consent until consent is withdrawn. After the retention period expires, data is deleted or anonymized. Full details are in the Privacy Policy.
9. Data Subject Rights
In accordance with Regulation (EU) 2016/679, you have the following rights: • Right of access to personal data • Right to rectification of inaccurate data • Right to erasure of data ("right to be forgotten") • Right to restriction of processing • Right to data portability • Right to object to processing • Right to withdraw consent at any time To exercise these rights, please contact us at: hello@purposehat.com You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) – www.dataprotection.ro.
10. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including: • Access control and secure authentication • Data encryption • Secure backup procedures • Staff training on data protection
11. Use of Feedback
Art. 1 – PURPOSEHAT SRL may use feedback received from clients (reviews, testimonials, comments) for marketing and service promotion purposes. Art. 2 – Feedback may be used in anonymous form, without disclosing the client's identity, without requiring additional consent. Art. 3 – If feedback is to be used together with the client's name or other identifying data, this will only be done with the client's explicit, separately given consent.
12. Amendment of This Document
PURPOSEHAT SRL reserves the right to modify this document. Any changes will be communicated to clients by email or by publication on the official website. For processing based on consent, material changes will be notified and, where required, we will ask for renewed consent.
13. Acknowledgment
By purchasing PurposeHat's services, the client agrees to the processing necessary to provide those services (contract). Processing that is based on consent (marketing, special-category data, testimonials with identifying data) is requested separately and can be withdrawn at any time.