Privacy notice

In short

Licurici sends you by email the power outages announced by Distribuție Energie Electrică Romania (DEER).

What we keep. Your email address and the addresses you follow. We do not ask for your name.

Why. We keep your email address to send you the alerts, and we keep it encrypted. Only with your consent.

For how long. Until you delete the subscription. If you do not confirm it from the email within 7 days, it deletes itself.

Who else sees the data. Google Cloud, where the application runs, in Germany. Resend, which sends the emails, from the USA. Cloudflare, through which the site passes, from the USA.

How to delete it. On the “My addresses” page, the “Delete all data” button. You stop the alerts with one click, using the link in any message.

Whom to write to. At info@licurici.app.

The details are below.

Who is responsible for the data?

Licurici is an independent service. It does not belong to DEER and does not act on behalf of DEER.

We take the list of outages from DEER’s public website. The list contains no data about you.

The data controller, that is, the one who decides what data is kept and why, is Gabriel Popa, a private individual.

Contact for any request about data: info@licurici.app.

What data do we keep?

• The email address. Required: without it you cannot subscribe.
• The addresses you follow: the county, the locality and, if you enter it, the street. At least one is required.
• The address label, for example “Home”. Only if you enter it.
• The language of the messages. You choose it when you subscribe and change it in “My addresses”.
• The consent log: when you subscribed, when you confirmed, when you stopped the alerts, when you asked for deletion.
• The history of sent messages.

We keep the email address encrypted. Without the application’s key, it cannot be read.

The application does not keep visitors’ IP addresses. The site passes through Cloudflare, which sees the IP address in order to deliver the pages. Google Cloud, where the application runs, records visits to the site in its logs, with the IP address. The logs are deleted after 30 days.

Why do we use the data?

Only with your consent, which you give by ticking the box in the form. We use it to:

• send you by email the alerts for the addresses you follow;
• send you the confirmation link and the link to “My addresses”.

We also keep the consent log, as proof that you gave your consent and that you asked for deletion. We keep it because the law requires us to be able to prove consent.

You can withdraw your consent at any time. Withdrawing it does not make unlawful what was done before it.

Who else sees my data?

Only companies that work for us, following our instructions. The law calls them processors.

• Google Cloud: all the data above. The application runs here and the data is stored here, in the europe-west3 region, Frankfurt, Germany. The contract is with Google Cloud EMEA Limited, Ireland.
• Resend, Inc.: the email address and the text of the emails. United States of America (USA).
• Cloudflare, Inc.: the IP address and the requests sent to the site, for as long as delivering the page takes. All traffic to licurici.app passes through Cloudflare. USA.

The text of an alert contains the address it refers to: the label, or the street and the locality.

The healthchecks.io service tells us when the application stops working. It receives no data about subscribers.

Does the data leave the European Union?

Yes, to Resend and to Cloudflare, companies from the USA.

The safeguard for these transfers: the standard contractual clauses approved by the European Commission, in our contracts with Resend and with Cloudflare.

You can ask us for a copy of the safeguard, at the contact address.

How long do we keep the data?

• An unconfirmed subscription, with its addresses: 7 days from the last confirmation request, then it is deleted. The confirmation link is also valid for 7 days.
• A confirmed subscription: until you delete it.
• The history of sent messages: 30 days from sending. If the outage is still in progress, 30 days from its end.
• Google Cloud logs, with the IP address: 30 days.
• DEER’s public data, as we received it: 30 days. It contains no data about subscribers.
• The consent log, after deletion: 3 years, without the email address in clear text.
• The outages and the statistics: no limit. They contain no personal data.
• The monthly totals of messages: no limit. They are only figures, with no link to you.

The sign-in link to “My addresses” is valid for 15 minutes and only once. It opens a 30-day session, only on that browser. The session is kept in a cookie, described below.

Cookies

Licurici uses a single cookie, called “session”. We set it when you enter “My addresses” with the 15-minute link and delete it when you press “Sign out of this browser”. It lasts 30 days and keeps the session open only on that browser. We use no other cookies, no visit measurement, no cookies of other companies, and we store nothing else in the browser. The cookie is strictly necessary for “My addresses”, so we do not ask for your consent to it.

For specialists: HttpOnly, Secure, SameSite=Lax, Path=/, Max-Age 30 days.

What happens when I delete my data?

You ask for deletion from “My addresses”, with the “Delete all data” button. Or from the page that confirms the alerts are stopped, with the “Stop everything and delete my data” button.

1. Immediately: the subscription, the email address and the addresses you follow are deleted. Licurici can no longer read them and will not send you any more messages.
2. During the following night: the history of sent messages is deleted.
3. Later, at the automatic cleanup: the deleted data also disappears physically from storage.

Kept, without contact details:

• the consent log, 3 years, as proof of consent. It is linked to the email by a code from which the address cannot be reconstructed;
• the monthly totals of messages, with no link to you;
• the outages, which contain no personal data.

The deletion cannot be undone. You can subscribe again at any time, as a new subscriber.

What rights do I have?

• To see what data we have: in “My addresses”. For a full copy, write to us.
• To correct it: change the addresses and the language in “My addresses”.
• To delete it: the “Delete all data” button.
• To withdraw your consent: the unsubscribe link in any message.
• To object to use based on legitimate interest (the access logs with the IP address): write to us.
• To ask for restriction: we keep the data but no longer use it. Write to us.
• To receive the data in a machine-readable format: write to us.

We reply within one month of receiving the request at the latest. If the request is complex, the time limit may be extended by two further months. We tell you about the extension within the first month.

Where can I complain?

To the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), www.dataprotection.ro.

Legal bases

Regulation (EU) 2016/679 (GDPR):

• the alerts, the confirmation and sign-in links: Art. 6(1)(a), consent;
• the consent log: the proof required by Art. 7(1); Art. 6(1)(c), legal obligation;
• the access logs with the IP address and the delivery of pages through Cloudflare: Art. 6(1)(f), the legitimate interest in keeping the site working and secure;
• the rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), withdrawal of consent (Art. 7(3)), objection (Art. 21), restriction (Art. 18), portability (Art. 20), complaint (Art. 77).