Privacy Policy
Operator: NINE INTERNATIONAL LOGISTICS MANAGEMENT S.R.L. · Platform ATH | CO₂ · Last updated: September 15, 2026
Version Română English Italiano Français Español
This translation is provided for information purposes. The Romanian version is the only legally binding one; in the event of any discrepancy, the Romanian version prevails. Read the Romanian version
1. Who we are
The controller of the personal data collected through the ATH | CO₂ platform is NINE INTERNATIONAL LOGISTICS MANAGEMENT S.R.L., with its registered office at Bd. Decebal nr. 25-29, et. 6, spațiul 2, Sector 3, București, cod poștal 137456, România, registered with the Trade Register under no. J2016001135159 (former format: J15/1135/2016), VAT no. RO 36738530, share capital 200 lei. Data protection contact: co2.suport@nineinternational.eu.
We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian law.
2. What data we process
- Account and contact: name, email, phone, job title.
- Company: name, VAT number, trade register number, address, NACE code.
- Data you enter: emission records, factors, reporting periods, supporting documents, GRI reports.
- Technical: an audit log of actions (cryptographically signed), IP address and device/browser information (user agent), for security, fraud prevention and compliance. For relevant actions we record who, when and which fields were changed.
3. Purpose and legal basis
- Providing the service — performance of the contract (Art. 6(1)(b)).
- Security and audit log — legitimate interest (Art. 6(1)(f)).
- Legal obligations (invoicing, accounting) — legal obligation (Art. 6(1)(c)).
4. Retention
For as long as the account exists, and afterwards for the periods required by law. When the account is deleted, the associated data is removed, except for data we are legally required to retain.
5. Disclosure and processors (sub-processors)
We do not sell personal data. We disclose it only to providers strictly necessary for the service to work and to authorities where the law requires it. The processors we use:
- Hosting and database — the infrastructure the application runs on (in the EEA/EU).
- Transactional email (SMTP) — for account verification, invitations and notifications.
- Cloudflare Turnstile (Cloudflare, Inc., USA) — anti-bot protection at sign-up and sign-in; receives the IP address and technical browser signals.
- OpenAI (OpenAI, L.L.C., USA) — only if you use the AI invoice scanning feature: the text extracted from the uploaded invoice (which may contain supplier names and tax codes) is sent for automatic data extraction.
- ANAF, ListaFirme.ro and public company registers — we query the VAT number you enter in order to prefill the company’s official data (public company data).
- ATH Directory — an internal service of the ATH ecosystem for linking the account to a company (one administrator per VAT number).
International transfers: some processors (Cloudflare, OpenAI) are outside the EEA (USA). Transfers are carried out on the basis of the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) and are limited to the data strictly necessary for that purpose. AI invoice scanning is optional; if you do not use it, no data is sent to OpenAI.
6. Your rights
Access, rectification, erasure, restriction, portability, objection. For requests: co2.suport@nineinternational.eu. You have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro).
7. Cookies
We use only strictly necessary cookies (session, security). We do not use marketing or third-party tracking cookies.