Privacy Policy
How we collect, use and protect the personal data related to your account and billing for the goned mail service.
In effect from 8 September 2026 · version 2026-09-08
1. Data controller
The controller of the personal data described in this policy is GENERAL OFFICE SOLUTIONS S.R.L., with its registered office at Sat Rancaciov, Com. Calinesti, nr. 9, Arges county, 117202, Romania, CUI 44854196, Trade Register no. J03/2103/2021.
For any data protection question or to exercise your rights, contact us at hello@goned.studio.
2. Our role
- -We are the controller for data related to the portal account and billing (identification, subscription, payments, company details).
- -We are a processor for the personal data contained in the email messages and other data you store or transmit through the Service. We process that data on your behalf, under the Data Processing Agreement (/legal/dpa).
3. What data we collect, why, and for how long
The table below summarises the processing we carry out as a controller. Legal bases are those in Article 6(1) of Regulation (EU) 2016/679 (GDPR).
| Data category | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Account email address, preferred language | Account creation and sign-in, service communications | Performance of the contract (Art. 6(1)(b)) | For the duration of the contract + 30 days |
| Plan, interval, subscription status, period start/end dates | Providing the Service according to the chosen Plan | Performance of the contract (Art. 6(1)(b)) | For the duration of the contract + 30 days |
| Stripe identifiers (customer, subscription), payment history | Processing payments, managing the subscription | Performance of the contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | 10 years (accounting records) |
| Company details: name, fiscal code (CUI), trade register no., VAT number, registered address, VAT-payer status | Issuing invoices, verifying the company, tax obligations | Legal obligation (Art. 6(1)(c)) | 10 years (accounting records) |
| Email domains added to the account | Setting up and maintaining the email hosting | Performance of the contract (Art. 6(1)(b)) | For the duration of the contract + 30 days |
| Date of the last mailbox password change | Account security, support | Legitimate interest (Art. 6(1)(f)) | For the duration of the contract |
| Technical logs: IP address, user-agent, timestamps of actions and sign-ins | Security, prevention and investigation of abuse and fraud | Legitimate interest (Art. 6(1)(f)) | Maximum 12 months |
| Content of support messages (email, WhatsApp) | Answering requests, assistance | Legitimate interest (Art. 6(1)(f)) | Maximum 24 months after the last interaction |
4. Cookies and similar technologies
The portal uses only strictly necessary cookies for its operation. We do not use analytics, advertising or tracking cookies and we do not embed any third-party analytics tools. For this reason, the portal does not show a cookie consent banner.
- -NEXT_LOCALE - remembers the chosen language (Romanian or English). Duration: 1 year.
- -Authentication session cookie (managed by the Auth.js library) - keeps you signed in after authentication and protects forms against request forgery. Duration: the session, or up to 30 days.
5. How we use the data
- -to create your account, provide the Service and manage your subscription;
- -to issue invoices and meet our tax and accounting obligations;
- -to keep the Service secure and prevent abuse, spam and fraud;
- -to send you service communications (confirmations, failed-payment notices, security warnings, changes to the terms);
- -to answer your support requests.
6. Marketing communications
We do not send marketing communications through this service. If we ever introduce a newsletter or offers, they will be sent only on the basis of your explicit consent and you will be able to opt out at any time.
7. Who we share data with
- -Providers that help us operate the Service (sub-processors), listed in the Data Processing Agreement: Hetzner Online GmbH (server hosting, Germany), Amazon Web Services (outbound email delivery, EU), Stripe Payments Europe, Limited (payment processing, Ireland).
- -ANAF - we query the public register of the Romanian Ministry of Finance to verify company details from the fiscal code at subscription. ANAF acts as an independent controller of the public register.
- -Accounting and professional advisers (lawyer, accountant), under a duty of confidentiality, where necessary.
- -Public authorities, where we are required by law or by a valid legal request.
- -A possible successor in interest, in case of reorganisation, merger or transfer of business, with prior notice to you.
We do not sell data
We do not sell, rent or make personal data available to third parties for marketing purposes.
8. International transfers
Data is processed mainly within the European Economic Area (Germany, Ireland). Some providers (Stripe, Amazon Web Services) may also process data in the United States. These transfers are covered by the standard contractual clauses adopted by the European Commission and, where applicable, by certification under the EU-US Data Privacy Framework. You can request a copy of the applicable safeguards at hello@goned.studio.
9. Security
We apply appropriate technical and organisational measures, including:
- -encryption in transit: TLS required for IMAP, SMTP and all portal web traffic;
- -passwords stored as cryptographic hashes, never in clear text;
- -restricted administrative access, authentication over secure channels, and separation of privileges for operations on the mail server;
- -service isolation through containerisation and exposure of the portal only behind a reverse proxy;
- -anti-spam filtering, sending rate limits, and monitoring of volumes and blocklists;
- -regular backups stored separately, and restore capability;
- -automatic application of security updates and periodic configuration reviews.
10. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent where processing is based on consent. You can exercise these rights by writing to hello@goned.studio; we respond within one month.
For data contained in email messages (where we are a processor), address the controller - usually the account holder or your organisation. We will support them in responding.
You have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro.
11. Children's data
The Service is intended for professional use and is not directed at people under 18. We do not knowingly collect minors' data. If you learn that a minor has given us data, contact us for deletion.
12. Changes to this policy
We may update this policy. The version in force is identified by the date at the top of the page. Material changes are communicated to you by email or through the portal before they take effect.
13. Contact
GENERAL OFFICE SOLUTIONS S.R.L. - Sat Rancaciov, Com. Calinesti, nr. 9, Arges county, 117202, Romania. Email: hello@goned.studio.