Privacy Policy
Version 1.0, effective from 1 October 2026
Komrce is an eCommerce business simulation where you make pricing, stock, marketing and financing decisions, on your own or in a team. To make it work we need some data about you. This page explains what data, why, how long we keep it and how you can delete it.
1. Who we are
The controller of your data is Pan Development SRL, registered office at Prelungirea Fieni 1B/3B, room 4, Balotești, Ilfov County, Romania, Trade Register no. J23/1497/2022 (EUID J2022001497236), tax ID 30901735.
For any question about your data, write to imunteanu@komrce.eu. We reply within 30 days at most, usually much sooner.
2. What data we collect
When you create an account: your email address, name and password. We store the password only in hashed form (bcrypt); not even we can read it.
When you complete your profile (optional): your organisation, experience level, main field, skills and goal. We use them to match teams and in-game examples. You can leave the profile empty.
When you play: your team name, the decisions you take each round, the simulation results, and the sessions and cohorts you take part in. This is game data, linked to your account.
When you buy a place in a cohort: the billing details you enter (name or company, tax ID, address). Payment is processed by Stripe; we never see or store your card details. Stripe only sends us the payment confirmation, the amount and a customer identifier.
When you write to us through the site's forms (contact, organisations, become a facilitator): your name, email, company and phone (optional), your message and the page you wrote from.
When you join the interest list: your email, the time windows when you would be available and the language you want the training in.
If you are a facilitator: the bio, photo, qualifications and languages you choose to publish on your profile. These are public, on the pages of the cohorts you lead.
Technical data: pages visited, the page you came from and key actions in the app (for example "started the demo"). On public pages we record these without cookies and without identifying you; once you log in, we link them to your account. The server also keeps technical logs (IP address, browser) for security.
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Your account, login and the game itself | account, game data | performance of the contract (Terms and Conditions) |
| Optional profile, for team matching | profile | your consent, given by filling it in; withdraw it by clearing the fields |
| Selling cohort places and invoicing | billing, payment | performance of the contract and legal obligation (tax and accounting law) |
| Account and session emails (confirmation, password reset, session code, schedule) | performance of the contract | |
| Announcements about new cohorts, for people on the interest list | email, availability | your consent; unsubscribe from any email or write to us |
| Replying to form requests | form data | steps taken at your request before a contract, or our legitimate interest in replying |
| Public facilitator profile | bio, photo, qualifications | the collaboration agreement with the facilitator |
| Our own usage statistics, security, abuse prevention | technical data | our legitimate interest in improving and protecting the service |
| Google Analytics statistics | analytics cookies; in the app, an internal account code (not your email) | your consent, through the cookie banner |
| Measuring ads and showing them to people who visited the site (Google Ads, Meta) | marketing cookies, pages visited, sign-up and payment (the amount, no card details) | your consent, through the cookie banner |
| Showing our ads on Facebook and Instagram to existing customers and to people similar to them (custom audiences) | email, name, amount paid; hashed before they reach Meta Platforms Ireland Ltd. | our legitimate interest in promoting our services to our customers; you can object at any time |
We make no automated decisions with legal effect on you. Only if you accept marketing cookies may Google and Meta use your visit to show you our ads; without your consent, they may not. In-game scores are the output of the simulation, not an assessment of you as a person.
Custom audiences. If you have an account with us, we may upload to Meta Platforms Ireland Ltd. a list with your email, name and amount paid, to show you our ads on Facebook and Instagram or to have them shown to similar people. The data is hashed (SHA-256) in the browser before it leaves; the company uses it only to find matches with existing accounts, then deletes it. We receive nothing about you from it. If you do not want to be included, write to us at the address in section 1: we remove you from the next list and from the audience already uploaded.
4. Who else sees the data
Other players. In a session, your teammates see your name and decisions. Other participants see your team name and the leaderboard.
The session facilitator and organiser. Your session's facilitator sees participants' names, emails, teams and decisions. If you take part through a company or university that bought the places, that organisation may learn who registered and who took part.
When you take part through an organisation. If a company, university or other organiser buys the places for you, the roles are split like this:
- for your account, sign-in, the game itself, security and our own statistics, we remain the controller of your data, exactly as in the rest of this policy;
- for the data the organisation sends us (for example, the participant list) and for the reports it receives from us, the organisation is the controller and we process the data on its behalf, as a processor, under a data processing agreement (Art. 28 GDPR).
The organisation receives from us the participants' names and emails and who took part. We do not send your in-game decisions or results to the organisation, unless our contract with it says so and the organisation told you before the session. For questions about this part you can contact the organisation or us; if the request belongs with the organisation, we pass it on.
Our providers, who process data only on our behalf and on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Stripe Payments Europe Ltd. | payment processing and invoices for card payments (Stripe Invoicing) | EU (Ireland); may transfer to the US |
| Twilio Inc. (SendGrid) | sending emails | US |
| DigitalOcean, LLC (managed through Laravel Forge) | hosting the app and database | EU (Frankfurt, Germany) |
| Google Ireland Ltd. (Google Tag Manager, Google Analytics, Google Ads) | statistics and ad measurement, only with your consent | EU; may transfer to the US |
| Meta Platforms Ireland Ltd. (Meta pixel) | measuring Facebook and Instagram ads, only with your consent; joint controller with us for the collection | EU; may transfer to the US |
| Meta Platforms Ireland Ltd. (custom audiences) | matching the customer list with Facebook and Instagram accounts, as a processor, under its Custom Audiences Terms | EU; may transfer to the US |
| factureaza.ro | issuing invoices and submitting them to the Romanian e-Invoicing system (RO e-Factura) | Romania |
| our accountant | bookkeeping | Romania |
Public authorities, only when the law requires it.
We do not sell or rent your data to anyone.
5. Transfers outside the EU
The app and database are hosted in the EU, in Frankfurt. Some providers (SendGrid, and in some cases Stripe and Google) do process data in the US, and our hosting provider, DigitalOcean, is a US company. These transfers rely on the EU-US Data Privacy Framework, for certified companies, or on the standard contractual clauses approved by the European Commission.
6. How long we keep data
| Data | How long |
|---|---|
| Account and profile data | until you delete your account |
| Unconfirmed accounts | 7 days after creation, then deleted automatically |
| Inactive accounts | 3 years without logging in, then we email you and, if you don't come back within 30 days, delete the account |
| Game decisions and results, after account deletion | kept anonymised, with no name or email, so your team's history isn't broken for your teammates |
| Payment records and invoices | as long as accounting law requires (currently up to 10 years), even if you delete your account |
| Form requests | 2 years after the last exchange |
| Interest list | until you unsubscribe |
| Custom audiences on Facebook and Instagram | Meta Platforms Ireland Ltd. deletes the hashed data after matching; the audience lasts while you have an account with us or until you object |
| Our own statistics | 24 months; unlinked from your identity when you delete your account |
| Server logs | 30 days |
7. How to delete your data
Go to My account → Delete account. Deletion is immediate and permanent:
- your email, name, password, profile and billing details are removed from the account;
- your game decisions and results stay in the simulation without your name (anonymised);
- usage statistics can no longer be linked to you;
- we keep only what the law requires: invoices and payment records.
If you prefer, you can also ask for deletion by email at imunteanu@komrce.eu.
8. Your rights
You have the right to:
- find out what data we hold about you and get a copy (access);
- correct inaccurate data (rectification); you can edit most of it yourself in your account;
- ask for your data to be deleted (see section 7);
- ask us to restrict processing;
- receive your data in a structured format to take elsewhere (portability);
- object to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting what was done before;
- lodge a complaint with the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or with the authority in your EU country of residence.
For any of these, write to imunteanu@komrce.eu. We may ask you to confirm that you own the account, so we don't hand your data to someone else.
9. Minimum age
You can create an account from 16 years old. Places in a cohort are bought by an adult or an organisation. If we learn that an account belongs to someone under 16 without parental consent, we delete it.
10. Security
The connection to the site is encrypted (HTTPS). Passwords are stored only as hashes. The login session uses a signed cookie that scripts on the page cannot read. Admin access is limited to the people who need it. If an incident still puts your data at risk, we will notify you and ANSPDCP as the law requires.
11. Cookies
How we use cookies is explained in the Cookie Policy.
12. Changes
If we change anything important in this policy, we will tell you by email or in the app before it takes effect. The current version and its date are always at the top of this page.