Privacy policy
This is an English translation provided for convenience. In case of any discrepancy, the Romanian version prevails.
This policy explains which personal data is processed through the Onement platform (onement.ro and the organizations' subdomains), why, for how long and what rights you have, under Regulation (EU) 2016/679 ("GDPR"), Romanian Law no. 190/2018 and Law no. 506/2004.
1. Who we are and in what capacity
The platform is provided by [Denumire firmă SRL / PFA], VAT/ID [CUI], [Nr. Registrul Comerțului], registered office [Adresa sediului], Cluj-Napoca, România ("we", the "Provider"). Data protection contact: privacy@onement.ro.
- For the data of students and mentors of an organization (usually a student entrepreneurship society — SAS, an association or a university), the organization is the data controller. We are a processor (GDPR art. 28) and process the data only on its instructions, under the Data processing agreement. Please address requests about this data first to the organization; if you write to us, we forward the request without delay.
- For the accounts of the organizations' teams in their contractual relationship with us, for access requests, for correspondence with us and for visits to this website, we are the controller.
2. What data we process
| Data subjects | Data |
|---|---|
| Students | Name, e-mail, password (stored only as an argon2 hash); university, faculty, specialization, year of study, a short bio (optional); skills and their level, domains of interest, roles wanted in a team, hours available per week, languages and preferred format (in person / online); whether the profile is visible to mentors; date of consent. Programme activity: ideas proposed, applications to ideas (with motivation), teams joined, mentoring requests, mentorships, feedback (rating and optional comment). Team workspace content: messages, uploaded documents and links, tasks, notification preference. The organization's activity log (for all members): actions taken in the application with date, time and IP address, including the previous version of edited or deleted messages, tasks and mentoring notes, and failed sign-ins to an existing account. |
| Mentors | Name, e-mail, password (hash), job title, company, years of experience, bio, links (optional); domains and skills with their level, the stages they can help with, how many teams they can take on, languages, format. Ideas proposed, decisions on applications and requests, the mentoring log (date, notes, decisions, next steps), messages in team workspaces. |
| Organization team (coordinators, administrators) | E-mail, name, password (hash), role, sign-in sessions (IP address, browser), log of actions in the application, failed sign-in attempts (IP, e-mail). |
| People requesting access | Name, role, e-mail, phone (optional); organization or institution name, desired subdomain, type, city, estimated number of students, message (optional); for Pro, optionally, billing details. Date of acceptance of the terms, IP address and browser (to limit abuse). The status of the request and related correspondence in our helpdesk. |
| Website visitors | Only the web server's technical logs (IP address, page, browser, date and time). No cookies, analytics or third-party resources. |
The platform is not designed for special categories of data (health, religion, political opinions, etc.). Please do not include such data in profiles, messages or documents.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Matching students, mentors and ideas; applications, mentoring requests, team formation | Set by the organization as controller. Students give consent when signing up (art. 6(1)(a)), which can be withdrawn at any time by deleting the profile. For mentors, usually the organization's legitimate interest in running the programme (f) or the collaboration agreement with the mentor (b). |
| Team workspace and e-mail notifications | Running the programme you take part in (b / f). E-mail notifications can be switched off at any time. |
| Providing the service to organizations and their teams' accounts | Performance of the contract (b). |
| Platform security (sessions, sign-in rate limiting, logs) | Our legitimate interest in protecting the service and data (f). |
| Handling access requests and creating organizations | Pre-contractual steps at your request (b); abuse prevention: legitimate interest (f). |
| Invoicing and accounting (paid plans) | Legal obligation (c). |
4. How matching works
Onement computes a match score between mentors and ideas and between students and ideas from profile data: domains, skills and their level, the skills an idea needs and those the team already covers, the idea's stage, language, format and the mentor's free places. This is a form of profiling (GDPR art. 4(4)), used only to rank recommendations; every score comes with its reasons, shown in the application.
The score has no effect on its own: people decide. Students choose which idea to apply to or which mentor to ask; mentors accept or decline; coordinators can adjust the weights. We do not use the data for advertising or combine it with data from outside the platform.
5. Cookies
The application uses a single, strictly necessary cookie, which requires no consent:
| Name | Purpose | Duration |
|---|---|---|
sid | Sign-in session, bound to the organization's address. | 30 days or until sign-out |
No analytics, advertising or social media cookies; no third-party resources. This website (onement.ro) sets no cookies.
6. How long we keep data
- Profiles and programme activity: while the organization keeps its account, or until you delete your account or the organization removes you. Deleting an account removes your profile, skills, applications and requests; the team's ideas and documents stay with the team, no longer linked to your account. When the contract with the organization ends, data is deleted within 30 days after the organization could export it.
- Archived organizations: read-only until the chosen deletion date; before deletion an encrypted copy of the export is stored in the platform's archive storage in the EU.
- Backups: local (14 days) and encrypted (AES-256) in EU storage, with daily, weekly and monthly rotation. Deleted data disappears from all copies within 190 days.
- E-mail notification queue: at most 30 days. Sessions expire after 30 days, invitations after 7 days, password reset links after 24 hours; failed sign-in attempts are deleted after 24 hours (only those on an existing account remain, for 12 months, in the organization's activity log).
- Organization activity log: 12 months, then deleted automatically. Only the organization's owner and administrators can see it.
- Access requests: approved ones while the organization exists; others at most 12 months. IP and browser are deleted after 90 days.
- Web server logs: short term, usually under 30 days. Correspondence: at most 3 years. Accounting documents: as required by law.
7. Who sees the data and who receives it
- Within the organization: coordinators and administrators see profiles and programme activity. Mentors see the profiles of students who chose to be visible, applications to their ideas and requests they receive; a student's e-mail becomes visible to a mentor only after the request or application is accepted. A team's workspace is visible only to its members, its mentors and coordinators. Nothing is visible across organizations.
- The organization's Nextcloud (optional, Pro): if the organization keeps team documents in its own Nextcloud, uploaded files are stored on its server, under its control.
- Our providers (sub-processors), strictly to operate the service: Oracle Cloud Infrastructure (Oracle Corporation and its affiliates) (hosting, [OCI region, e.g. EU — Frankfurt (eu-frankfurt-1)]; our helpdesk runs on the same infrastructure); Brevo (Sendinblue SAS), France (sending e-mails: invitations, password resets, request notifications and the team digest); external storage in the EU for encrypted backups.
- Authorities, only when the law requires it.
We do not sell or rent data or use it for advertising. Data is stored in the European Union; any access from outside the EEA (e.g. technical support) is covered by the European Commission's standard contractual clauses.
8. Security
Encrypted connections (HTTPS/TLS), argon2 password hashes, revocable sessions bound to the organization's address, CSRF protection, sign-in rate limiting, logical separation of each organization's data, role-based access, audit log, encrypted backups and automatic security updates. Nextcloud app passwords are stored encrypted. Details in Annex 2 of the DPA.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability, to object to processing based on legitimate interest, to withdraw consent at any time, and not to be subject to a decision based solely on automated processing (GDPR art. 15–22). You can correct your profile at any time in the application.
- Students and mentors: address your request to the organization (the SAS), which is the controller. You may also write to privacy@onement.ro; we forward it and help the organization respond.
- Organization teams and others: write to privacy@onement.ro. We answer within one month.
You may lodge a complaint with the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro, anspdcp@dataprotection.ro), or with the authority of your EU member state of residence, and you may go to court.
10. Other information
Minors. The service is aimed mainly at university students. If an organization includes participants under 16 (e.g. high school pupils), it is responsible for having a legal basis and, where needed, parental consent.
Changes. We may update this policy; the date of the last update is shown at the top. Organizations are notified by e-mail at least 30 days before significant changes.
Contact: [Denumire firmă SRL / PFA], [Adresa sediului], Cluj-Napoca, România, privacy@onement.ro.