Legal Bases and Consent
The legal bases for processing (art. 6 GDPR) and consent management
Every processing activity on the SSM.ro platform has a documented legal basis in accordance with art. 6 GDPR.
Processing bases
| Purpose | GDPR Basis |
|---|---|
| Platform access and use (account, training, courses) | Art. 6(1)(b) — performance of a contract |
| Advanced electronic signature (standard flow — only the document hash) | Art. 6(1)(b) — performance of a contract |
| Qualified signature certificate (exceptional — CNP, ID document series/number, ID copy) | Art. 6(1)(c) — legal obligation; art. 6(1)(b) — performance of contract with the signature provider |
| Communication (email, SMS — notifications, OTP) | Art. 6(1)(b) — performance of a contract |
| Marketing (newsletter, updates) | Art. 6(1)(a) — consent |
| Legal obligations (archiving, accounting, security) | Art. 6(1)(c) — legal obligation |
| Financial management (invoices, payments, debt recovery) | Art. 6(1)(c) and (f) — legal obligation / legitimate interest |
| Dispute resolution | Art. 6(1)(f) — legitimate interest |
| Customer care (surveys, service audits) | Art. 6(1)(f) — legitimate interest |
Consent management
Processing based on consent (mainly marketing and non-essential cookies):
- Consent is explicit, freely given, and informed, obtained separately from acceptance of the terms
- Consent can be withdrawn at any time, as easily as it was given (art. 7(3) GDPR)
- Upon withdrawal, data processed solely on the basis of consent is irreversibly deleted immediately
- Withdrawal does not affect the lawfulness of processing carried out before withdrawal
For cookies and similar technologies, see Cookie Policy.
Consent upon signing
Electronically signing a document constitutes explicit acceptance of its content. In the standard advanced electronic signature flow, only the document hash is processed, without national identification data. Identifying the signatory (CNP, identity document) is a legal obligation only exceptionally, for issuing a qualified signature certificate — without this data, the qualified certificate cannot be issued, but the standard advanced signature remains available.