Form Space, registered at Aleea Stadionului, numărul 2, Cluj-Napoca, Romania, is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR) for the Form Space mobile application.
Form Space is a digital catalogue of menus and events for cafés and event venues. The app displays static or semi-static content — menus, upcoming events, venue information — and is not designed to build detailed commercial profiles of its users.
If you use the app without creating an account, we do not collect any identifying personal data. The system may automatically record limited technical data in anonymous or pseudonymised form:
This data is collected in anonymous or aggregated form and cannot be used to identify you as an individual.
If you create an account in the app, we collect:
If you grant permission for push notifications, we collect:
You can revoke push notification permission at any time in your device settings, without affecting your ability to use the app.
Form Space does not collect precise GPS location, payment information, contacts, photos, biometric data, or any sensitive categories of personal data as defined under Article 9 GDPR.
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your user account | Email, password (hash) | Performance of a contract — Art. 6(1)(b) GDPR |
| Authenticating you in the app | Email, password (hash) | Performance of a contract — Art. 6(1)(b) GDPR |
| Sending push notifications (events, menu updates) | Push token, notification preferences | Consent — Art. 6(1)(a) GDPR |
| Technical diagnostics and crash resolution | Anonymous technical data, crash logs | Legitimate interests — Art. 6(1)(f) GDPR (maintaining app stability) |
| Improving the app based on aggregated usage patterns | Anonymised session data | Legitimate interests — Art. 6(1)(f) GDPR (data is fully anonymous) |
| Compliance with legal obligations | Data relevant to the authority's request | Legal obligation — Art. 6(1)(c) GDPR |
We do not use your data for behavioural advertising, profiling with legal effects, or automated decision-making. We do not sell your data to any third party.
Processing your account data (email and password hash) is necessary to provide you with the authentication service and manage your account. Without this data, we cannot create or maintain your account.
Push notifications are sent exclusively on the basis of your explicit consent, granted through your operating system's permission dialogue. You may withdraw consent at any time without any negative consequence. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
We process anonymous or pseudonymised technical data for diagnostics and app improvement. We have conducted a Legitimate Interest Assessment (LIA): the data is processed in a form that does not permit identification of individual users; the impact on your rights is minimal; and our legitimate interest in maintaining a stable, functional application outweighs any possible adverse effect.
We may process data when required to do so by Romanian or EU law (e.g. requests from judicial or administrative authorities, accounting obligations).
| Data category | Retention period | Reason |
|---|---|---|
| Account data (email, password hash) | For the lifetime of the account + 30 days after deletion | Grace period for accidental deletion recovery |
| Push notification token | Until consent is withdrawn or the app is uninstalled | Required to deliver notifications |
| Crash logs / technical data | Maximum 90 days | Sufficient for diagnostics; automatically deleted thereafter |
| Anonymous session data | Maximum 12 months in aggregated form | Trend analysis; contains no personal data |
| Data retained for legal obligations | As required by applicable law (e.g. 5 years for financial records under Romanian law) | Legal obligation |
Upon expiry of the applicable retention period, data is permanently deleted or irreversibly anonymised.
We do not sell or transfer your data to third parties for commercial purposes. We may share data with:
We work with vendors who process data on our behalf, exclusively under our documented instructions, on the basis of Data Processing Agreements (DPAs) compliant with Art. 28 GDPR:
We may disclose data to competent authorities (e.g. courts, law enforcement, tax authorities) when required by law or a binding court order.
If Form Space is part of a corporate group, we may share minimum necessary data with affiliated entities, subject to appropriate safeguards.
Your data is primarily processed on servers located within the European Economic Area (EEA).
Where technical providers (e.g. Apple and Google for push notification delivery) process data outside the EEA, the transfer takes place on the basis of one of the lawful mechanisms provided under GDPR:
You may request further information about the transfer mechanisms we use by contacting contact@formspace.ro.
As a data subject under GDPR, you have the following rights:
You can request a copy of the personal data we hold about you.
You can request correction of inaccurate or incomplete data.
You can request deletion of your data when it is no longer needed or you have withdrawn consent.
You can request that we restrict processing in certain circumstances (e.g. while accuracy is contested).
You can receive data you have provided to us in a structured, machine-readable format.
You can object to processing based on our legitimate interests.
You can withdraw consent for push notifications at any time without affecting the lawfulness of prior processing.
You can file a complaint with the competent supervisory authority (see Section 13).
Send a request to contact@formspace.ro with the subject line "Data Subject Request — [right you are exercising]". We will respond within 30 calendar days of receipt (extendable by up to two further months for complex requests, with prior notice). We will verify your identity using your existing account credentials — we will not ask for disproportionate documentation.
If you believe we are processing your data in breach of GDPR, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — or with the supervisory authority of the EU Member State where you reside or work:
We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or accidental destruction:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (ANSPDCP) within 72 hours in accordance with Art. 33 GDPR. If the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.
Form Space is intended for users aged 16 and over. We do not knowingly collect personal data from individuals under this age. If you become aware that a minor has provided personal data without parental or guardian consent, please contact us at contact@formspace.ro so we can delete those data promptly.
Note: If the app is intended to be used by children between the ages of 13 and 15, verifiable parental consent must be obtained in accordance with Art. 8 GDPR and applicable national law.
Form Space is distributed via the Apple App Store and is subject to Apple's Review Guidelines. Apple may collect certain aggregated, non-identifiable app analytics when you use the App Store. This data collection is governed by Apple's Privacy Policy, not this document. We act as an independent data controller with respect to data collected within the app itself.
Push notifications on iOS are delivered through Apple Push Notification service (APNs). The push token assigned to your device is generated by Apple and transmitted to our servers solely to route notifications to your device.
Form Space is distributed via Google Play. Google may collect certain diagnostic, performance, and usage data as part of the Android platform and Google Play Services. This is governed by Google's Privacy Policy. We act as an independent data controller for data collected within the app.
Push notifications on Android are delivered through Firebase Cloud Messaging (FCM). The FCM token is generated by Google and used solely to route notifications to your device.
| Permission | Platform | Purpose | Required? |
|---|---|---|---|
| Push notifications | iOS & Android | Send event and menu update alerts | Optional — requested at runtime |
| Internet access | iOS & Android | Load menus, events, and venue content | Required for core functionality |
The app does not request access to your camera, microphone, contacts, location, photos, or any other device resource beyond those listed above.
In compliance with Google Play's Data Safety requirements, the summary below reflects the data practices described in this policy:
The App Store privacy label for Form Space reflects the following:
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or app functionality.
For material changes, we will:
Continued use of the app after the updated policy takes effect constitutes acceptance of the changes. If you do not agree, you may delete your account at any time.
For any questions, requests, or complaints regarding the processing of your personal data, please contact us: