Privacy policy

Updated: 15 October 2026 · Interim version

1. Who we are. RomiProperty is a brand of Y.R. PROPERTIES HOLDINGS S.R.L., a company registered in Romania, with its registered office at Bulevardul Pipera nr. 198/8, Vila 33B, Cam. 1, Oraș Voluntari, jud. Ilfov, România (CUI 53181510, J2025100396002) ("we"). We are responsible for the personal data collected on romiproperty.com, on RomiProperty's WhatsApp and in the investor portal. Questions or requests: invest@romiproperty.com.

2. What we collect.

• Contact details you give us: name, email, phone, country, preferred language, and who referred you (if you tell us).
• What you write to us: messages through the form and WhatsApp, and preferences you choose (for example area of interest and timing).
• In the portal: account details; email and phone verification; the consents you gave and when; projects you marked as interesting, feedback you sent and declarations you accepted; a log of security events (sign-ins, re-authentication). We never store your password in readable form.
• Before any transfer of funds or signature (in the future): identity documents and information on the source of funds, as the law requires. They are kept in an internal vault and are never visible to any other user.
• Necessary technical data: see "Cookies and storage" on this page.

3. Why we use it, and on what basis.

• To contact you and answer your enquiry, at your request, as a step towards a possible engagement.
• To run the portal: invitation, registration, access approval, showing projects and keeping your preferences; under the portal terms you accepted. If you registered through WhatsApp, we may send your personal portal invitation in the same WhatsApp chat.
• Security and abuse prevention: authentication, logging and checks; our and your legitimate interest in keeping the system safe.
• Legal compliance: identity checks, sanctions screening and record keeping before any transfer of funds; a legal obligation.
• Ongoing updates: only if you consented, and you can withdraw at any time.

4. The digital assistant. On WhatsApp you are answered by an AI-based digital assistant, using information we approved in advance. It says that it is one, does not give investment advice, and passes personal questions to our team. The conversation is kept so it can continue and so we can improve the answers. We make no automated decisions with legal effect on you; every access or investment approval is made by a person.

5. Who else sees the data.

• Service providers working for us, processing data only on our instructions: hosting and servers (Amazon Web Services, Frankfurt data centre), WhatsApp and SMS messaging (Twilio, Meta/WhatsApp), the assistant's AI model (Anthropic), email (Google Workspace), and contact management (Attio).
• The person who referred you, if you registered through a personal link: sees only your first name and your stage up to "invited". Anything more only with your explicit consent, which you can withdraw.
• Authorities, where the law requires it.
• We do not sell personal data and do not use it for anyone else's advertising.

6. Transfers outside the EU. Some providers (for example Twilio, Meta, Anthropic, Google and Attio) may process data outside the European Union. In those cases the transfer relies on a safeguard recognised by EU law.

7. How long we keep it. Only as long as needed for the purpose it was collected for, or as the law requires.

• Backups. We keep encrypted backups of our systems for up to 12 months, so we can recover from a failure. If you ask us to delete your data, it is deleted from our live systems promptly. Copies held in backups are never restored for use, and are deleted automatically when the backup expires, within 12 months at the latest.
• Access logs. When you use the contact form on our website or our WhatsApp assistant, our servers record technical details of each request (such as the time, the page or service used and the browser type), to keep the service secure and to investigate faults. These logs do not include your IP address and are deleted automatically after 30 days. When you send an inquiry through the form, we keep the IP address it was sent from together with the inquiry, to help identify abuse, for as long as we keep the inquiry.

8. Your rights. You can ask for a copy of your data, correction, erasure, restriction, a portable copy, or object to its use; and you can withdraw any consent at any time. In the portal: under "Profile", "My data"; or by email to invest@romiproperty.com. We answer within one month. We may need to keep some data after an erasure request where the law requires it (for example financial records). You may also complain to the Romanian data protection authority (ANSPDCP) or to the authority where you live.

9. Security. Portal sign-in requires a password and a code from an authenticator app; access to data is limited by role; and sensitive actions are logged. No security is perfect, and we will notify you as the law requires if an incident affects your data.

10. Cookies and storage. We use only what is necessary for the website and the portal to work. We do not use marketing, advertising or tracking cookies, or any third-party tools.

• On romiproperty.com: nothing is stored in your browser.
• In the portal: (1) your sign-in details, to keep your secure session, deleted when you sign out, and in any case after 12 hours at most; (2) the language you chose, kept in your browser until you delete it.

These are necessary for the service and therefore do not require consent. If we ever add an analytics tool or any other non-essential tool, we will ask for your consent first, and you can refuse or change your choice at any time. Questions: invest@romiproperty.com.

11. Minors. The service is for adults only (18 and over).

12. Changes. We will update this policy from time to time. We will announce material changes in the portal and, where needed, ask you to accept again. This is an interim version and will be replaced by a final one.

If the language versions of this document differ, the English version prevails.