Compliance & Data Protection
Record of Processing Activities
Record of processing activities in accordance with Art. 30 GDPR
The Record of Processing Activities (ROPA) documents the processing of personal data carried out through the SSM.ro platform, in accordance with Art. 30 GDPR.
Processing activities
| Activity | Data categories | Purpose / legal basis | Recipients | Retention |
|---|---|---|---|---|
| Platform account and access | Name, email, phone, employer, badge number | Contract performance (Art. 6(1)(b)) | Employer, IT providers | For the duration of the account + legal deadlines |
| Advanced electronic signature (standard flow) | Document hash (no national identification data) | Contract performance (Art. 6(1)(b)) | Electronic Signature Provider (QTSP) | 5-year audit trail |
| Qualified signature certificate (exceptional) | CNP, ID document series/number, ID card copy | Legal obligation (Art. 6(1)(c)) | Electronic Signature Provider (QTSP) | 5-year audit trail |
| Communication (notifications, OTP) | Email, phone | Contract performance (Art. 6(1)(b)) | Postmark (Shared) / AWS SES (Dedicated) | For the duration of the relationship |
| Training and courses | Employee data, training results | Contract performance | Employer | For the duration of the account |
| Marketing | Consent (Art. 6(1)(a)) | — | Until consent is withdrawn | |
| Invoicing | Billing data (company name, tax ID, address, contact person) | Legal obligation (accounting) (Art. 6(1)(c)) | — | Legal accounting deadlines |
| Activity logs | Online identifiers, events | Legitimate interest / security | — | 3 months |
Categories of data subjects
- Platform administrators and users (on behalf of tenants)
- Employees invited for training and signing
- Billing contact persons
Data source
Data is collected directly from the data subject, through intermediaries (partner applications), or from the employer, in accordance with the Privacy Policy.
Security measures
Details of the technical and organizational measures are in the Security section: encryption in transit/at rest, tenant isolation, RBAC, minimization (hashing at signing).