PayWise Log in to platform
Legal

Privacy Policy

Version 2026-10-20 (informative update: data of demo account applicants)

1. Who we are

DO IT WISE NOT TWICE S.R.L. (VAT ID RO29782754, Reg. No. J2012001682400, registered office at Intrarea Gheorghe Simionescu no. 19, ap. B26, Sector 1, Bucharest, Romania) operates the PayWise platform (paywise.ro). For any question about your personal data, you can write to us at contact@paywise.ro.

2. Our two roles

We have a dual role, depending on the type of data:

  • For data related to your account (name, company email, billing details), we are the data controller — we determine the purpose and means of processing.
  • For the client company's employee pay data, entered into the platform for job evaluation and pay-gap calculation, we are the data processor — the client company remains the controller of this data, and our processing is governed by the Data Processing Agreement (DPA), accepted online by each client or signed as an annex to the service agreement.

3. What data we collect

  • Account data: name, email, job title, company, billing details.
  • Data entered by the client into the platform: job-identification data and individual employee pay data (from the D112 declaration), used for the calculation; reports show only aggregated figures, with a confidentiality threshold of 3 people. The national ID (CNP) does not appear in any audit log, technical log, or response returned to the application interface.
  • Personal numeric code (CNP). When you import REGES-Online or D112 files, employees' CNP is used only at the moment of import, to match the same person's data across files and months. The CNP is not stored. A pseudonymous code is calculated from it automatically, using a secret key kept separately; the code differs from one company to another, and the CNP cannot be derived from it without the key. The pseudonymous code is kept for as long as the employee's data remains in the platform and is deleted together with it.
  • Technical data: the audit log (who changed what and when, logins and downloads of certain documents), needed for the traceability required for compliance.
  • Data of demo account applicants (the “Request a demo account” form on the website or a request made directly to the PayWise team): name, company, tax ID (optional) and the company’s public data from ANAF (name, address, registration number), e-mail address, phone (optional) and the company’s number of employees; for the demo account, only activity counters (number of sign-ins, first and last sign-in, number of pages opened, not the pages themselves); the commercial status of the request and the PayWise team’s internal notes. The demo account contains only fictitious data; real data cannot be uploaded to it.

Job descriptions. The Client may upload job descriptions (PDF or Word) as the source for job profiles. We ask for the generic version, without names, signatures or pay, and the Client confirms this when uploading. PayWise does not take the identification, pay and signature sections into the job profile.

Only users with the HR Administrator and Approver roles in the Client's company can see the document. The evaluation committee sees only the job profile, not the document. Job descriptions are not sent to any external service and are not used by the AI module.

We keep a job description for as long as the job exists, or for as long as an approved decision of the company (the job scores) relies on it, as evidence of the evaluation. The HR Administrator can delete, at any time, a job description that no approved decision relies on; the deletion is recorded in the audit trail. Job descriptions are stored in the PayWise database on our server and in the daily backups, which are kept for 14 days.

4. Purpose and legal basis for processing

The legal basis depends on our role (point 2):

a) Data for which DO IT WISE NOT TWICE S.R.L. is the controller — account, billing and security data:

  • account data (name, e-mail, job title, company), to provide the platform: performance of the contract (art. 6(1)(b) GDPR);
  • billing data, to issue and keep invoices: performance of the contract (art. 6(1)(b) GDPR) and legal accounting and tax obligations (art. 6(1)(c) GDPR);
  • security data (logins, technical and access logs), for the security of the platform and the prevention of unauthorised access: our legitimate interest (art. 6(1)(f) GDPR).

b) The client's employees' data and other data the client uploads to the platform, for which we are the processor: the legal basis is established by the client, as controller — as a rule, the legal obligation under Directive (EU) 2023/970 and the Romanian transposing law (art. 6(1)(c) GDPR). We process this data only on the client's instructions, in accordance with the Data Processing Agreement (DPA); the optional AI module uses it only if the client activates it.

c) Data of demo account applicants, for which DO IT WISE NOT TWICE S.R.L. is the controller:

  • creating and administering the demo account (including the link for choosing the password, extending and closing the account): steps taken at your request before entering into a contract (art. 6(1)(b) GDPR);
  • contacting you about the demo request and the subscription offer: our legitimate interest in answering your request and presenting the offer (art. 6(1)(f) GDPR). You may object to this processing at any time by writing to contact@paywise.ro; after an objection we no longer contact you and the data is deleted, except for what we need in order to respect the objection.

We do not use this data for the newsletter or other marketing communications without a separate consent.

5. Who we share data with

For the data the client enters into the platform, we use only the sub-processors listed in point 5 of the Data Processing Agreement (DPA):

  • ROMARG SRL (Romania) — hosting of the platform's production server, with its data centre in Brașov, Romania, and the mailboxes of the paywise.ro domain, through which we send the platform's emails (questionnaire-completion invitations, password resets, course/newsletter opt-in confirmations, operational notifications) and receive automatic delivery reports. For email, the data transmitted is the recipient's name and email address and the content of that message. The data stays in the European Union; there is no international transfer.
  • Anthropic Ireland, Limited (Ireland) — only if the client activates the optional AI module, used for narrative writing and, if activated at the client's request, for COR code suggestions. It receives STRICTLY the aggregated figures already calculated, passed through the anonymization threshold, and the texts needed for narrative writing; if COR code suggestions are activated at the client's request, it also receives the job title, the department and the job profile. It never receives names, personal numeric codes (CNP), employee codes or individual salaries. Processing may take place in the EU and the USA; the transfer relies on the standard contractual clauses included in Anthropic's data processing agreement and, where applicable, the EU–US Data Privacy Framework. Data sent via the API is not used to train models and is deleted after the retention period set out in Anthropic's terms (currently, at most 30 days), except where Anthropic keeps it longer because of a breach of its usage policy or for legal obligations.

Encrypted backup copies are kept on the production server. An external storage provider for the encrypted copies (without access to the decryption key) may be added only after clients have been notified by email at least 30 days in advance, in accordance with point 5.3 of the DPA.

SmartBill (Intelligent IT SRL, Romania) is used only to issue pro forma and tax invoices. It receives only our customers' billing data (company name, tax ID, address, contact person and their e-mail address), for which DO IT WISE NOT TWICE S.R.L. is the controller, not employee data. It is not a sub-processor for the data the client enters into the platform.

6. How long we keep data

Account data and data entered into the platform are kept for the duration of the active contract. After the contract ends, the client has 30 days of read-only access and, on request, a full export of the data; the data is then deleted within 30 days at most, and backup copies are overwritten within 14 days at most of the deletion. On request, we confirm the deletion in writing. If an account in the platform testing period is abandoned or not paid, the account is closed and the data is deleted within 30 days at most, with backup copies overwritten within 14 days at most of the deletion.

Data of demo account applicants is kept for 12 months from the last interaction (the request, activity in the demo account or the last communication with the PayWise team), then deleted automatically; backup copies are overwritten within 14 days of deletion. If the applicant becomes a client, the rules above apply. The demo account and its fictitious data are deleted automatically when the demo account expires (usually after 7 days).

7. Your rights

You have the right of access, rectification, erasure, restriction, objection, and data portability, as well as the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP). To exercise any of these rights, write to us at contact@paywise.ro.

8. Security

We apply appropriate technical and organizational measures — strict data separation between clients, encrypted communications, role-based access restrictions, periodic backups, an immutable audit log — reviewed and updated periodically.

9. Changes

We may update this policy; any significant change will be communicated to active clients by email or an in-platform notification.