Last updated: 2 October 2026
This policy explains which personal data GARAN Tool processes, why, for how long and what rights you have under Regulation (EU) 2016/679 (GDPR).
1. Who is responsible for your data
The data controller is European Advertising Holding SRL, registered office Str. Marasesti Nr. 18, Ap. 2, Trade Register no. J2015000705330, VAT/tax ID RO34860980 (“we”). Contact for data protection matters: [email protected].
2. Which data we process
2.1 Account and profile
- name, e-mail address, password (stored only as a one-way hash), preferred language, optional company name;
- if you sign in with Google: your Google account identifier, name and e-mail address;
- optional public profile: profile photo, website and short bio.
2.2 Content you create
- labels (brand, model identifier, guarantee duration) and, if you publish them, the country, offer period, producer statement link and product link;
- registered sites (domain and display settings) and product guarantees;
- blog articles and comments, including the time they were created.
2.3 Guest comments
Name, e-mail address (never published), optional website and the comment text. To fight spam we store a one-way hash of your IP address combined with a secret key.
2.4 Votes on public labels
For signed-in members the vote is linked to the account. For visitors we store only a one-way hash derived from the IP address and browser identifier, used solely to prevent duplicate votes.
2.5 The embed script on partner shops
When a shop uses our script, we record only aggregated daily counters per shop domain (number of badge look-ups) and when the script was last seen on that domain. We do not collect personal data of the shop’s visitors and the script sets no cookies. Once a day we may load the home page of registered sites to check that the script is still installed.
2.6 Technical data
Our servers keep technical logs (IP address, date and time, requested page, browser identifier) for security and troubleshooting.
3. Purposes and legal bases
- Providing the service you asked for — account, label generation, public directory, blog, embed tools (Art. 6(1)(b) GDPR, contract);
- security, abuse and spam prevention, moderation and the integrity of public data (Art. 6(1)(f), legitimate interest);
- service e-mails such as notifications about your sites, labels and articles (Art. 6(1)(b));
- legal obligations, where applicable (Art. 6(1)(c)).
We do not sell personal data and we do not use it for advertising or profiling.
4. What is public
Labels you publish, your articles and comments are public. Your public profile (name, photo, bio, website, public labels and articles) becomes visible once it meets the conditions shown in your account. Your e-mail address is never published.
5. Recipients and third-party services
- Hosting provider: Cloudify, Romania — stores the website and database;
- E-mail service: Cloudify, Romania — sends account and notification e-mails;
- Google: “Sign in with Google” (only if you choose it) and Google reCAPTCHA on some forms, when enabled — reCAPTCHA is loaded only after you click “Load the security check”;
- Gravatar (Automattic Inc.): if you have not uploaded a photo, profile and comment pictures come from Gravatar, looked up with a one-way hash of the e-mail address. The images are fetched by our server, so visitors’ browsers never connect to Gravatar.
Some of these providers may process data outside the European Economic Area; in that case transfers rely on the European Commission’s adequacy decisions (including the EU–US Data Privacy Framework) or standard contractual clauses.
6. How long we keep data
- account and profile data: while the account exists; deleted or anonymised after you ask us to close it;
- public labels, articles and comments: until you or a moderator remove them;
- spam-prevention hashes and technical logs: up to 30 days, unless needed to investigate abuse;
- embed statistics: aggregated, without personal data.
7. Your rights
You have the right to access your data, to have it rectified or erased, to restrict or object to processing, to data portability and, where processing is based on consent, to withdraw it at any time. Most profile data can be changed directly in Account settings. To exercise your rights write to [email protected]; we reply within one month.
You also have the right to lodge a complaint with a data protection supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro).
8. Cookies
Details are in our Cookie policy.
9. Changes
We may update this policy; the date at the top shows the latest version. Important changes are announced on the website or by e-mail.