Privacy Policy

IIntroduction

Your privacy is essential to ENLAW SRL (“ENLAW”, the “controller”, “we”). This Policy explains which personal data we process in connection with the website eraseforever.com (the “Site”) and with the digital hygiene and online reputation services provided under the “Erase Forever” trade name (the “Services”), for which purposes, on which legal bases, to whom we disclose them, for how long we keep them and what your rights are.

This Policy applies to:

1. a)visitors of the Site;
2. b)persons who send us requests through the form on the Site, by e-mail, telephone or WhatsApp;
3. c)clients and persons we represent under a power of attorney (including where the request is submitted by a family member or another representative);
4. d)persons whose data appear in the content reviewed (authors, third parties mentioned), to the extent strictly necessary for the steps taken.

Processing is carried out in accordance with Regulation (EU) 2016/679 (the “GDPR”), available at eur-lex.europa.eu/eli/reg/2016/679/oj, Romanian Law no. 190/2018 and Romanian Law no. 506/2004, in the consolidated versions applicable on 18 September 2026. Where you are located outside the European Union, the GDPR applies to our processing because we are established in Romania; the rights described in Section VIII are available to you regardless of your location.

IIThe controller

1. a)Company name: ENLAW SRL;
2. b)Tax identification number (CUI): 50711719; Trade Register number: J2024031765004;
3. c)Registered office: Str. Alexandru Roman nr. 2F, Oradea, Bihor County, Romania;
4. d)E-mail: hello@eraseforever.com; telephone: +40 774 628 094;
5. e)Data protection contact: hello@eraseforever.com (please mention “Data protection” in the subject line).

IIIWhich data we process

(a)Data submitted through the form on the Site

Name and surname, e-mail address, telephone number (optional), the links to the content concerned and the description of the situation, in the form you choose to present it. The form is intended for a preliminary assessment of the situation. We recommend that you submit through the form only the information needed for a first assessment; documents will be requested later, through the channel we indicate.

(b)Data submitted by e-mail, telephone or WhatsApp

Contact details, the content of the correspondence and the documents you send us. If you choose the WhatsApp button, you leave the Site and start a conversation in the service provided by Meta Platforms Ireland Limited; ENLAW does not control the processing carried out independently by WhatsApp. See the WhatsApp policy at www.whatsapp.com/legal/privacy-policy-eea. Do not send via WhatsApp copies of identity documents, court decisions, special categories of data or data relating to criminal convictions and offences; use the secure channel we indicate for the necessary documents.

(c)Data processed as a client (after conclusion of the contract)

For the provision of the Services we process: identification data (including a copy of the identity document, which search engines and platforms require for identity verification), the signed power of attorney, all variants of the name under which you appear in the content concerned, billing data, correspondence with search engines, platforms, publishers and authorities, as well as the content reviewed (articles, pages, images, videos) and the documents supporting the request (court decisions, criminal record certificate, other records).

(d)Special categories of data and data relating to criminal matters

Given the nature of the Services, the content you ask us to review may contain special categories of data referred to in Article 9 GDPR (for example, data concerning health, sex life or beliefs) or data relating to criminal convictions and offences within the meaning of Article 10 GDPR (for example, information about accusations, criminal proceedings, acquittals or rehabilitation). Special categories of data are processed only where an exception under Article 9(1) GDPR applies, in particular explicit consent, Article 9(2)(a), or the necessity for the establishment, exercise or defence of legal claims, Article 9(2)(f). Data governed by Article 10 GDPR are processed only under the conditions authorised by Union or national law and with the applicable safeguards; where no adequate legal basis exists, we do not request them and we delete or anonymise them. In all cases, we limit processing to what is necessary for the step, restrict access and do not use these data for profiling.

(e)Data collected automatically when accessing the Site

IP address, browser and device type, pages accessed, date and time of access and server security logs. These data are processed exclusively for the operation, security and troubleshooting of the Site, on the basis of the legitimate interest described in Section IV(d). The Site uses only cookies that are strictly necessary for its operation and security (session, protection of the form against automated messages, remembering your choices), which do not require consent under Article 4(6) of Romanian Law no. 506/2004. We do not use traffic analytics, marketing or behavioural tracking tools. Details in the Cookie Policy, available at eraseforever.com/cookie-policy.

IVPurposes and legal bases

(a)Preliminary assessment of the situation and communication of an indicative opinion

Legal basis: steps taken at the request of the data subject prior to entering into a contract, Article 6(1)(b) GDPR. For special categories of data, as the case may be: explicit consent, which must be expressed through a distinct and unequivocal statement, Article 9(2)(a) GDPR, or the necessity for the establishment, exercise or defence of legal claims, Article 9(2)(f) GDPR. The mere submission of a request is not, in itself, considered explicit consent; explicit consent is given by ticking the dedicated box in the form on the Site or through a separate written statement sent by e-mail. Consent may be withdrawn at any time, without affecting the lawfulness of prior processing. Data relating to criminal convictions and offences are processed only under the conditions of Article 10 GDPR and of the applicable Union or national law.

(b)Provision of the Services under the contract and the power of attorney

Drafting and filing requests, handling correspondence with recipients, escalations, monitoring and invoicing. Legal basis: performance of the contract, Article 6(1)(b) GDPR; for special categories of data and data governed by Article 10 GDPR, the conditions described under (a) and in Section III(d) apply separately.

(c)Compliance with legal obligations

Issuing and retaining accounting documents, responding to requests from authorities, handling data subject requests. Legal basis: Article 6(1)(c) GDPR.

(d)Legitimate interests

We pursue legitimate interests in the security of the Site and of our systems, the prevention and investigation of abuse, and the establishment, exercise or defence of ENLAW's legal claims. For each category of processing we verify the purpose, the necessity and the balance between the interest pursued and the rights, freedoms and reasonable expectations of the data subjects, applying data minimisation measures. Legal basis: Article 6(1)(f) GDPR. You may object at any time on grounds relating to your particular situation; we will cease processing unless we demonstrate compelling legitimate grounds which override your interests or the processing is necessary for the establishment, exercise or defence of legal claims.

VWho receives access to the data

(a)Recipients of the steps taken on your behalf

For the provision of the Services, we transmit the necessary data (the identity of the data subject, the power of attorney, the links, the justification of the request and, where required by the recipient, supporting documents) to:

1. a)search engine operators: Google Ireland Limited (Google Search) and Microsoft Ireland Operations Limited (Bing), including their affiliated entities that process the requests;
2. b)the operators of the online platforms hosting the content concerned, as the case may be: Meta Platforms Ireland Limited (Facebook, Instagram, WhatsApp), TikTok Technology Limited, Google Ireland Limited (YouTube), X Internet Unlimited Company, Reddit, LinkedIn Ireland Unlimited Company and others;
3. c)publishers, website administrators and hosting providers of the content concerned, for rectification or removal requests and DSA/DMCA notices;
4. d)ANSPDCP or other competent authorities, in the case of escalations requested by you.

Each recipient processes the data as an independent controller, in accordance with its own policies. We transmit only the data necessary for each step, with your consent expressed through the power of attorney and your prior approval of the steps.

(b)Providers processing data on behalf of ENLAW (processors)

1. a)the web hosting provider of the Site;
2. b)the professional e-mail and document storage provider;
3. c)the invoicing software provider and the accounting services provider;
4. d)IT and security service providers, to the extent necessary.

We select providers offering sufficient guarantees and, where they act as processors, we govern the processing by a contract under Article 28 GDPR. Up-to-date information on the categories of providers and, to the extent permitted by confidentiality obligations, their identity may be requested at hello@eraseforever.com.

(c)Meta Platforms Ireland Limited (WhatsApp)

If you choose to contact us via WhatsApp, the data associated with the conversation are also processed by Meta Platforms Ireland Limited, under conditions determined independently by it. The policy applicable to the European Economic Area is available at www.whatsapp.com/legal/privacy-policy-eea.

(d)Professional advisers and authorities

Accountants, auditors, legal advisers, to the extent necessary; public authorities, courts, criminal investigation bodies, where required by law.

We do not sell or rent personal data. We do not disclose your data for third-party marketing purposes.

VITransfers outside the European Union

Some recipients or providers may process data outside the European Economic Area. Before any transfer under ENLAW's control, we verify the existence of a valid adequacy decision under Article 45 GDPR or we use appropriate safeguards under Article 46 GDPR, such as the European Commission's standard contractual clauses, together with a transfer assessment and supplementary measures where necessary. The derogations provided for in Article 49 GDPR are used only in exceptional situations and where their conditions are met; where applicable, a transfer may be necessary for the establishment, exercise or defence of legal claims. You may request at hello@eraseforever.com information on the applicable mechanism and a copy or description of the safeguards, subject to the protection of confidential information.

If you contact us from outside the European Union, your data are transmitted to us in Romania and processed here in accordance with the GDPR.

VIIHow long we keep the data

We keep data only for as long as necessary for the purposes for which they were collected:

1. a)requests submitted through the form, by e-mail or via WhatsApp and not followed by a contract: 12 months from the last communication, after which they are deleted;
2. b)the case file (power of attorney, correspondence with recipients, requests filed, decisions received, supporting documents): for the duration of the contract and 3 years from the closure of the case, corresponding to the general limitation period, in order to evidence the steps taken and to defend legal claims;
3. c)copy of the identity document: for the duration of the steps for which recipients required it and no longer than 3 years from the closure of the case, with restricted access; earlier deletion may be requested at any time after the steps are completed;
4. d)accounting documents (including invoices and proof of payment): 5 years calculated from 1 July of the year following the end of the financial year in which they were drawn up, unless a legal provision requires a different period;
5. e)subscription-based monitoring data: for the duration of the subscription and 12 months after termination;
6. f)technical and security logs of the Site: no longer than 12 months from generation.

Upon expiry of these periods, data are deleted or irreversibly anonymised. Cases presented publicly by ENLAW for information purposes are anonymised.

VIIIYour rights

Under the GDPR you have the following rights:

1. a)the right of access to the data processed and to information about the processing (Article 15);
2. b)the right to rectification of inaccurate or incomplete data (Article 16);
3. c)the right to erasure, in the cases provided by law (Article 17);
4. d)the right to restriction of processing (Article 18);
5. e)the right to data portability for data you provided and processed by automated means on the basis of the contract or consent (Article 20);
6. f)the right to object to processing based on legitimate interests and, at any time, to any processing for direct marketing purposes (Article 21);
7. g)the right to withdraw consent at any time, without affecting the lawfulness of prior processing;
8. h)the right not to be subject to a decision based solely on automated processing (Article 22);
9. i)the right to lodge a complaint with ANSPDCP or with the supervisory authority of your habitual residence and to bring proceedings before the competent courts.

To exercise your rights, write to us at hello@eraseforever.com. We respond within one month of receipt of the request; this period may be extended by two months in complex cases, in which case we will inform you. To protect the data, we may request additional information to verify the identity of the requester. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

IXHow we protect the data

We apply technical and organisational measures appropriate to the nature of the data processed, including:

1. a)protecting communications and access to the Site and to the systems used, through measures appropriate to the risks identified;
2. b)controlling access to case documents and limiting access to the persons for whom it is necessary for the provision of the Services;
3. c)transmitting to recipients only the data necessary for each step;
4. d)confidentiality obligations for the persons with access to the data;
5. e)deleting data upon expiry of the retention periods;
6. f)managing and documenting security incidents and, where the legal conditions are met, notifying ANSPDCP and informing the data subjects within the time limits set by Articles 33 and 34 GDPR.

ENLAW documents its processing activities to the extent required by Article 30 GDPR, the legal bases and balancing tests for legitimate interests, retention decisions and security measures. We periodically assess the risks to the rights and freedoms of data subjects. Before starting processing likely to result in a high risk, we carry out a data protection impact assessment under Article 35 GDPR and, where the residual high risk cannot be mitigated by appropriate measures, we consult ANSPDCP in advance under Article 36 GDPR.

XChildren's data

The Site and the Services are not intended to be contracted directly by persons lacking the necessary legal capacity. Requests concerning a minor must be submitted by the parent or legal representative, who will provide only the necessary data and will prove their capacity as representative where necessary. If we learn that a minor's data have been transmitted to us without an adequate basis or beyond what is necessary, we restrict processing and delete them, unless retention is required by law or necessary to protect the minor's rights.

XIAutomated decision-making

We do not use solely automated decision-making and we do not carry out profiling producing legal or similarly significant effects concerning you. Each case is assessed by people.

XIIRequests submitted by third parties

If you submit a request on behalf of another person (for example, a family member), please make sure that you have that person's consent and inform them of this Policy. Steps are taken exclusively on the basis of the power of attorney signed by the data subject or their legal representative.

XIIIData obtained indirectly and Article 14 GDPR

We may obtain from the client, a representative, publicly accessible sources, search engines, platforms, publishers, authorities or the recipients of the steps taken data about authors, persons mentioned and other third parties. These may include identification and contact data, statements, opinions, images, professional information, special categories of data or data governed by Article 10 GDPR, only to the extent necessary to review the content and to exercise or defend legal claims. The purposes, legal bases, recipients, transfers, retention periods and applicable rights are those described in this Policy. Where Article 14 GDPR requires individual information, we provide it within the applicable statutory period. We do not provide individual information where the person already has the information or where another exception under Article 14(5) applies, including where informing the person proves impossible or would involve a disproportionate effort, subject to appropriate measures, or where the data must remain confidential under a statutory obligation of secrecy. We assess and document the application of each exception.

XIVLinks to other websites

The Site may contain links to third-party websites (authorities, publications, platforms). This Policy applies only to processing carried out by ENLAW. We recommend that you consult the policies of third-party websites.

XVSupervisory authority

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

1. a)address: B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, postal code 010336, Romania;
2. b)e-mail: anspdcp@dataprotection.ro;
3. c)website: www.dataprotection.ro.

Data subjects habitually resident in another EU Member State may also lodge a complaint with the supervisory authority of their country of residence.

XVIChanges

We may update this Policy to reflect legislative, technical or Service-related changes. The updated version will be published on the Site, with the date of the last update. Significant changes will also be communicated to clients by e-mail.

XVIIContact

ENLAW SRL, Str. Alexandru Roman nr. 2F, Oradea, Bihor County, Romania, e-mail hello@eraseforever.com, telephone +40 774 628 094.