1. Data controller
The controller is PNT ENTERPRISE SRL, tax identifier 55275289, trade register number J2026045848003, with registered office at 41 Covasna St., Bl. F19, Entrance 3, Floor 4, Apt. 30, postal code 041676. Data-protection contact: contact@bucharestcardshow.ro, 0767.018.307.
2. Data, purposes and legal bases
For ticket orders we process the name, email address, phone number, language, ordered products and quantities, order number, payment status, issuance/delivery data and history needed for support. This data is necessary for steps taken before entering into a contract and performance of the contract: checking the order, processing payment, issuing and delivering the ticket, communicating relevant changes and providing support. If an invoice is requested or fiscal documents are required by law, we process the necessary billing data to comply with applicable legal obligations. For security and fraud prevention, we may process IP address, user agent, session identifiers, timestamps, access logs, payment and validation attempts and technical references, based on the legitimate interest of protecting the service, buyers and the controller's rights. On the same legitimate interest we count visits to the site with our own counter, without cookies and without an identifier: the IP address and the browser are turned on the spot into a key that changes daily and cannot be turned back into data about you, and from each page opened we keep only the page address, the referring site, the language, the kind of screen and the minute, for 90 days. Consent is used only for separately presented optional purposes and may be withdrawn without affecting processing carried out before withdrawal. For exhibitor requests we may process contact, company/billing and product-category data, notes, operational requirements and supplied profile materials, for pre-contractual steps, contract performance and legal obligations. This notice does not make exhibitor commercial rules part of the visitor-ticket rules.
3. Payment data
Full card data is entered and processed in the secure NETOPIA Payments environment. Bucharestcardshow.ro does not collect, access or store the full card number or CVV/CVC code. The controller retains only metadata needed for the order and reconciliation, including the processor reference, amount, currency, status and relevant transaction timestamps.
4. Recipients and transfers
Data may be disclosed, to the extent necessary, to contracted providers for hosting and storage, security and content delivery, payment processing, transactional email, technical support, accounting and professional advice, and to public authorities where required by law. Providers include, as applicable, OVHcloud for infrastructure and storage, Cloudflare for DNS/security, NETOPIA Payments for payments and Scaleway Transactional Email for transactional email. Only if you accept third-party cookies in the dialog on the site, Google Ireland Limited (the venue map), TikTok Technology Limited and Meta Platforms Ireland Limited (measuring our TikTok and Meta ads) receive the addresses of the pages visited, the IP address and browser data; the legal basis is your consent (art. 6(1)(a) GDPR), which you can withdraw at any time on the Cookie policy page, and all of them may transfer the data outside the EEA under standard contractual clauses. Services are configured in the European Union where that option is available. If an operation involves a transfer outside the European Economic Area, the controller will use a mechanism permitted by the GDPR and applicable appropriate safeguards, such as standard contractual clauses, where relevant.
5. Retention
We do not apply one fixed period to all data. Order, payment, invoicing and accounting data is retained for periods required by tax and accounting law. Data needed for delivery, support, complaints and the defense of rights is retained for as long as needed for the purpose and applicable limitation periods. Security logs are kept for a period proportionate to the risk and investigation need. Once the applicable criteria expire, eligible data is deleted or anonymized; data protected by legal obligations, litigation or invoicing is not removed prematurely.
6. Mandatory data
Fields marked as required at checkout, including the billing data requested by the form, are needed to enter into and perform the order and issue and deliver the ticket. Without them we cannot process the order. Company fiscal fields are collected only when the buyer selects that option or when they are legally required. Promotional communication data is not a condition of purchase.
7. Data-subject rights
Subject to the GDPR, a data subject may request access, rectification, erasure, restriction of processing and data portability, and may object to processing based on legitimate interests. Where consent is the legal basis, it may be withdrawn. Some requests may be limited by legal obligations, contract-performance needs or the defense of rights. Requests should be sent to contact@bucharestcardshow.ro. A data subject also has the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing; official information is available at https://www.dataprotection.ro/index.jsp?lang=ro&page=procedura_plangerilor.
8. Automated decisions
PNT ENTERPRISE SRL does not use buyer data for decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the buyer. Technical security checks and payment confirmation may determine whether an operation continues, without creating commercial profiles about the buyer.
9. Security and updates
We apply access control, encryption in transit, backups, logging and least-privilege access according to role and need. This notice may be updated when operations or legal obligations change; the current version will be published on the website. If you give your explicit consent, we collect your email address and the page language in order to send you future news and offers about Bucharest Card Show and its future editions. The legal basis is your consent, and giving it is never a condition of purchase: you can complete any order without it, at the same price. Consent is given by ticking the optional box in the order form or by submitting the subscribe form published at the bottom of the pages; the box is unticked by default, and leaving it unticked means refusal. Besides the address and language we keep evidence of the consent: the moment, the source (ticket order, table order, or the public form), and the version and cryptographic fingerprint of the exact wording you read, together with an internal reference to the order the tick came from. We do not copy your name, phone, billing details, purchased products, or order amounts into this record. You can withdraw at any time, without an account, by requesting a neutral preference-management link from the subscribe form, which we email to you; withdrawal takes effect immediately and the evidence of what you previously agreed to is retained. No email marketing provider has been selected at this time and we send no campaigns: we are only collecting permission. Before any first campaign we will update this notice with the provider actually used and with any additional transfer or processing it involves.