Legal · GDPR
Privacy Policy
In accordance with Regulation (EU) 2016/679 (GDPR)
Last updated: 6 October 2026
1. Data controller
WERRO is the controller of the personal data collected on this platform, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
Name: WERRO
General contact: contact@werro.ro
2. The data we collect
At registration:
- Full name, email address, phone number
- City and county of residence
- Role on the platform (client or artist)
- For artists: stage name, category, location, price, bio, uploaded photos and videos, packages, availability calendar, cancellation policy
- If you sign in with Google: the name and email address of your Google account (we receive neither your password nor your phone number)
When booking:
- Event details: date, location, event type, number of guests, special requirements
- Messages exchanged with the artist or client through the platform, offers and the generated contract
- When a booking is confirmed, contact details (name and phone number) are shared between client and artist so they can coordinate the event directly — see section 4
- The reviews you write and the artists you save to favourites
- For "past events": the artist gives us the name and email of a client from an event held before WERRO; we write to them so they can confirm the event and, if they wish, leave a review. If they do not confirm, we do not use the address for anything else
Collected automatically:
- IP address, browser type, operating system (for security and debugging)
- Strictly necessary authentication cookies and, only with your consent, analytics and marketing cookies (section 6)
- Our own cookieless visit statistics: page visited, traffic source, device type. We do not keep your IP; visitors are counted with a code that changes daily and cannot be linked to you
- Approximate location, only if you press the location button in search: the coordinates are sent to OpenStreetMap to find the city and are not stored
3. How we use the data and the legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Account authentication and security | Art. 6(1)(b) — performance of the contract |
| Processing bookings | Art. 6(1)(b) — performance of the contract |
| Transactional notifications | Art. 6(1)(b) — performance of the contract |
| Sharing contact details (phone number) between client and artist for a confirmed booking, in order to coordinate the event | Art. 6(1)(b) — performance of the contract |
| Generating digital contracts and keeping them as evidence | Art. 6(1)(b) — performance of a contract; retention: Art. 6(1)(f) — legitimate interest (evidence in case of a dispute) |
| Ad measurement (Meta Pixel) and Google Analytics statistics | Art. 6(1)(a) — consent ("Accept all" in the cookie banner) |
| Emails with WERRO news and offers | Art. 6(1)(a) — consent (the sign-up checkbox; withdraw any time in Settings → Notifications) |
| Our own cookieless visit statistics, security and abuse prevention | Art. 6(1)(f) — legitimate interest |
4. Who we share data with
Between client and artist (the parties to a booking)
When a booking is confirmed, WERRO shares the strictly necessary contact details between the two parties involved — name and phone number — so that the client and the artist can coordinate directly regarding the event (confirmations, schedule changes, unforeseen situations on the day). These details appear in the transactional confirmation and event reminder emails.
Legal basis: Art. 6(1)(b) GDPR — performance of the contract between client and artist.
What is shared: name and phone number. The email address, password and other account data are not shared.
When: only after the booking is confirmed. For unconfirmed requests, contact details are not disclosed to the other party.
Purpose: coordinating the event only. Using these details for any other purpose (e.g. the other party's own marketing) is not permitted.
From the moment they receive it, each party becomes an independent controller for the other party's contact data and is responsible for using it in accordance with the GDPR. You may object to this sharing by writing to contact@werro.ro, but note that without contact details it is not possible to coordinate the event directly.
With contracted processors
We use the following providers, who process data on our behalf under contract:
Supabase — Frankfurt, Germany (EU)
Database hosting and authentication
Resend — USA
Sending transactional emails
Vercel — EU (Frankfurt) — US company
Web platform hosting
Cloudinary — USA
Storing and serving the photos and videos uploaded by artists
Zoho — EU
The @werro.ro mailboxes (our correspondence with you)
Meta Platforms — Ireland (EU) / USA (with SCCs)
Ad measurement (Meta Pixel), only with your consent
Google — Ireland (EU) / USA (with SCCs)
Sign-in with Google (if you choose it) and Google Analytics statistics, only with your consent
OpenStreetMap Foundation — United Kingdom
Finding the city from coordinates, only when you press the location button
We do not sell personal data. Meta and Google receive browsing data only if you accept analytics and marketing cookies.
5. Your rights under the GDPR
Under Regulation (EU) 2016/679 you have the following rights, which you can exercise free of charge:
Right of access (Art. 15)
You can request a copy of all the data we hold about you, in JSON format.
Right to rectification (Art. 16)
You can correct inaccurate data in your account at any time.
Right to erasure / "right to be forgotten" (Art. 17)
You can ask us to delete your account (or do it yourself in Settings). Data is deleted within 30 days, except what we must keep as evidence (signed contracts).
Right to restriction of processing (Art. 18)
You can request that the processing of your data be temporarily suspended.
Right to data portability (Art. 20)
You can receive your data in a structured, machine-readable format (JSON/CSV).
Right to object (Art. 21)
You can object to processing based on legitimate interest, including marketing.
Withdrawal of consent
Where processing is based on consent, you can withdraw it at any time without any consequences.
Send requests to contact@werro.ro. We reply within one month.
You also have the right to lodge a complaint with ANSPDCP (the Romanian data protection authority) — www.dataprotection.ro.
7. Security
We apply appropriate technical and organisational measures to protect the data:
- HTTPS across the whole platform (TLS 1.3)
- Passwords hashed with bcrypt
- Row Level Security (RLS) on the database
- Data access restricted through strict authorisation policies
8. Data retention
| Data category | Retention period |
|---|---|
| Active account data | For as long as the account exists |
| Data after account deletion | 30 days (grace period) |
| Our own visit statistics (non-identifying) | 400 days |
| Digital contracts | 5 years from the event date (evidence in case of a dispute) |
| Technical logs | 12 months |
| Marketing data (with consent) | Until consent is withdrawn |
9. International data transfers
Some providers (Vercel, Resend, Cloudinary and, only with your consent, Meta and Google) are US companies. Transfers rely on the safeguards provided by the GDPR:
- The EU-US Data Privacy Framework, for certified providers
- Standard Contractual Clauses (SCC) approved by the European Commission, for the others
- Only the data needed for that service leaves the EU
10. Contact
Personal data requests: contact@werro.ro
General support: contact@werro.ro
ANSPDCP: www.dataprotection.ro
See also: Terms and Conditions →