Privacy Policy
Last updated: 23.08.2026
PURPOSEHAT SRL (CUI: 53635500, Trade Register: J23/2918/2025), with registered office in Popești-Leordeni, Ilfov County, Romania, legally represented by Claudiu Dorobanțu (hereinafter "PurposeHat" or "the Provider"), is committed to protecting the personal data of its clients and website visitors, in accordance with EU Regulation 679/2016 (GDPR). This policy describes how we collect, use, store, and protect your personal data within our career counseling services.
1. What Data We Collect
Depending on the type of interaction, we may process the following categories of personal data: • Identification data: full name, email address, phone number • Professional data: CV, professional history, skills, career goals • Sensitive data (only with explicit consent): information regarding health status or other special categories, if voluntarily provided during counseling sessions • Website usage data: IP address, browser type, cookie identifiers
2. How We Collect Data
Personal data is collected through: • Direct interaction with the client: registration forms, emails, phone calls, online or in-person meetings • Video communication platforms: Zoom, Google Meet, or similar tools • Documents provided by the client: CV, portfolio, self-assessment questionnaires
3. Purpose and Legal Basis for Processing
We process your personal data for the following purposes: • Providing career counseling services – legal basis: performance of a contract • Conducting professional evaluations and providing personalized recommendations – legal basis: your consent • Sending our newsletter and marketing communications – legal basis: your consent (which you can withdraw at any time); for existing clients, we may send information about similar services on the basis of our legitimate interest, and you can opt out at any time • Billing and accounting – legal basis: legal obligation
4. Data Retention Period
Personal data is retained only for as long as necessary to fulfill the purposes described in this policy: • Billing and accounting data: 10 years from the issuance of the invoice, in accordance with fiscal and accounting obligations (Law 82/1991) • Contract and service-related data: for the duration of the contractual relationship and up to 3 years afterward (the general limitation period), to handle any subsequent claims • Career assessment data (email, scores, and quiz answers): 30 days from the date of the assessment, then permanently deleted • Newsletter contact data in our email system (Brevo): until you unsubscribe or ask us to delete it • Data processed on the basis of consent: until you withdraw your consent You can delete your account at any time — directly from your account settings (Settings → Delete account) or by emailing hello@purposehat.com. When you do, we immediately erase your personal data (profile, career assessments and test results, notes, goals, uploaded documents, and course access), and you permanently lose access to any purchased programs. We retain only what the law requires — order and payment records, for the fiscal retention period (10 years) — together with a minimal, anonymized record that the deletion was carried out (a one-way hashed reference and the date), kept to demonstrate our compliance.
5. Data Recipients
Your personal data may be shared with: • IT and hosting service providers • Professional partners involved in the counseling process, under GDPR-compliant data processing agreements • Payment processors (e.g., Stripe) • Public authorities, where required by law
6. Sub-processors and Data Transfers Outside the EU
To run our services we rely on a number of providers that may process personal data on our behalf. Our main processors are: • Supabase (database and application hosting) – servers in the EU (Frankfurt, Germany); no transfer outside the EEA • Stripe (payment processing) – may process data in the United States, under the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses • Brevo (email and newsletter) – EU (France) • Resend (transactional email) – may process data in the United States, under Standard Contractual Clauses • Google Analytics (website analytics, only with your consent) – Google Ireland Limited; data may be transferred to the United States under the EU-US Data Privacy Framework • Video meeting tools (e.g., Google Meet, Zoom), if used for sessions – may involve transfer to the United States under the EU-US Data Privacy Framework and/or Standard Contractual Clauses Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards are in place (the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission).
7. Your Rights as a Data Subject
In accordance with EU Regulation 679/2016, you have the right to: • Access your personal data • Rectify inaccurate data • Request erasure of data ("right to be forgotten") • Restrict processing • Data portability • Object to processing • Withdraw your consent at any time To exercise these rights, please contact us at: hello@purposehat.com You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) – www.dataprotection.ro.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including: • Passwords and restricted access to systems • Data encryption • Secure backup procedures • Staff awareness regarding data protection
9. Changes to This Policy
This privacy policy may be updated periodically. Any changes will be published on our website. We recommend checking this page regularly. For questions or requests regarding the processing of personal data, please contact us at: hello@purposehat.com
10. Special Data Categories: Minors (16-17 years)
For young people aged 16 and 17 who enroll in the program, PurposeHat processes both the young person's data and the data of the parent or legal guardian. Data of the minor young person: first and last name, age and date of birth, email address, phone number (optional), county of residence, current situation (high school, university, first or second job), content of the application. Data of the parent or legal guardian: first and last name, email address, phone number (optional), capacity (parent or legal guardian), data required for concluding the contract. These data are processed on the basis of consent and of the contract concluded with the parent or legal guardian, in accordance with art. 8 GDPR and art. 8 of Law 190/2018. Although in Romania a minor over 16 may give consent for information society services, the conclusion of the service contract requires the involvement of the parent or legal guardian, in accordance with the Romanian Civil Code.
11. Minors' Data and Sponsored Places
PurposeHat does not operate a public list of identifiable young people and does not publish minors' photographs, full names, addresses, schools, or direct contact details. Where a funded (sponsored) place is allocated to a minor, this is handled together with a partner NGO or care center; the funder does not receive the minor's personal data. If, for illustration, PurposeHat shares a real story of a minor, it does so exclusively in anonymized form (a first name — real or fictitious —, age, county of residence, and a short description drafted after anonymization) and only on the basis of the explicit written consent of the parent or legal guardian, expressed through a publication consent document. Consent may be withdrawn at any time, without justification, by emailing hello@purposehat.com. PurposeHat will remove the story from the website within a maximum of 72 hours from receipt of the request and will confirm the withdrawal by email. Participation in the program never depends on such publication.
12. Retention Period for Minors' Data
Data of minors and their parents is retained as follows: • data from the application form: for the duration of the program plus 3 years after completion, for handling any subsequent requests • documents and contract signed with the parent: in accordance with the legal terms applicable to contracts and to the obligation to prove consent • billing data: 10 years from the issuance of the invoice, in accordance with fiscal and accounting obligations • any story published on the website: only for the period in which consent is active; upon withdrawal of consent or completion of the program, the story is removed within a maximum of 72 hours After the expiry of these periods, the data is deleted or permanently anonymized.
13. Specific Rights of Minors and Parents
In addition to the general rights provided by the GDPR (access, rectification, erasure, restriction of processing, portability, objection), parents or legal guardians of minors aged 16-17 have, through representation, extended access to the minor's data and may exercise all rights on behalf of the minor. In particular, they may: request at any time to see what data is stored about the minor, request the rectification of inaccurate data, withdraw consent for publication at any time with immediate effect, request the erasure of the minor's data within the limits of legal retention obligations, lodge a complaint with the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro). For any request, the parent or guardian may contact hello@purposehat.com. PurposeHat responds within a maximum of 30 days, in accordance with the GDPR.
14. Persons Funding a Youth's Program: Data Processing
PurposeHat processes the data of persons funding a young person's program (natural persons or companies) for the following purposes: issuing the fiscal invoice, allocating the funding to a young person, communicating the anonymized impact summary at the end of the program, and displaying on the partners page (only with explicit consent). Billing data is retained for 10 years in accordance with fiscal obligations. Contact data may be retained for the duration of the relationship and 3 years thereafter. These persons have all the rights provided by the GDPR and may contact hello@purposehat.com.