Privacy Policy

CUI: 49743547 · VAT: RO49743547 · J2024005188408 · Bucharest, Romania

Data Protection contact: merakihr.ro@gmail.com · merakihr.eu/privacy

This Privacy Policy explains how MERAKI HR SRL ("we", "us", "our") collects, uses, stores, and shares personal data across all our services:

• merakihr.eu — our public website and consultancy services

• prismclearpay.eu public webpages — product information and, with consent, Google Ads advertising measurement; separate from the app

• PRISM Core HR (prismclearpay.eu) — our HR information system (HRIS) platform

• Prism ClearPay — our EU Pay Transparency Directive diagnostic module (prismclearpay.eu)

• The Prism ClearPay Diagnostic Questionnaire (merakihr.eu/pay-check) — our paid EU pay transparency assessment

• Digital Lab products — HR automation and AI tools under development

This Policy applies to all visitors, prospective customers, subscribers, and their employees whose data is processed through our platforms. Please read it carefully.

1. Who We Are and How to Contact Us

MERAKI HR SRL is a Romanian HR consultancy and technology company registered in Bucharest, Romania (CUI: 49743547, VAT: RO49743547, J2024005188408). We operate the merakihr.eu website and the PRISM Core HR, Prism ClearPay, and Digital Lab platforms.

For all privacy and data protection enquiries:

Email: merakihr.ro@gmail.com

Website: merakihr.eu

Address: MERAKI HR SRL, Bucharest, Romania

We process personal data in accordance with GDPR (EU 2016/679) and Romanian Law 190/2018. We maintain a Record of Processing Activities (ROPA) as required by GDPR Article 30. You may lodge a supervisory complaint with ANSPDCP (Autoritatea Natională de Supraveghere a Prelucrării Datelor cu Caracter Personal) at anspdcp.ro at any time.

2. Data We Collect — Website Visitors (merakihr.eu)

2.1 Data you provide directly

When you contact us, book a consultation, download a resource (templates, checklists, guides), subscribe to our newsletter, or complete the Prism ClearPay Diagnostic Questionnaire, we collect:

• Name, email address, and company name

• Job title and phone number (optional)

• HR and business queries you describe in contact forms

• Diagnostic Questionnaire responses (13 questions about your pay equity practices)

2.2 Data collected automatically

When you visit merakihr.eu, our hosting infrastructure and analytics tools collect:

• IP address, browser type, operating system, and device type

• Pages visited, time on page, and navigation path

• Referring website and search terms

• Cookie identifiers (see our Cookie Policy for the full list)

2.3 Lawful basis — website

Contact forms and consultation booking: Legitimate interests (responding to your enquiry) — Art. 6(1)(f) GDPR

Free resource downloads: Legitimate interests (providing requested content) — Art. 6(1)(f) GDPR

Newsletter subscription: Consent — Art. 6(1)(a) GDPR. You may withdraw at any time.

Analytics cookies: Consent — Art. 6(1)(a) GDPR (via our cookie banner)

Google Ads advertising measurement on prismclearpay.eu public webpages: Consent — Art. 6(1)(a) GDPR, through that website's cookie banner. Measurement helps us understand advertising performance and attribute webpage visits and conversions to campaigns. Data may include cookie identifiers, advertising click identifiers, IP address, device and browser information, and webpage interaction events. This does not cover the PRISM Core HR app or Prism ClearPay module and does not use employee HR records. You can withdraw consent through the cookie settings on prismclearpay.eu.

Strictly necessary cookies: Legitimate interests — no consent required

3. Prism ClearPay Diagnostic Questionnaire

The Prism ClearPay Diagnostic Questionnaire is a paid EU pay transparency assessment available at merakihr.eu/pay-check. It asks 13 questions about your organisation's pay equity practices and produces a risk tier assessment (Low / Medium / High / Critical). Current pricing is shown at merakihr.eu/pay-check.

3.1 Data collected

• Company name (used to personalise the report)

• Work email address (to deliver the report)

• 13 questionnaire responses (organisational pay equity practices — no individual employee data is entered)

3.2 Retention

Questionnaire data is kept for 12 months from submission so we can support you and let you compare results if you repeat the diagnostic, then deleted automatically. We do not use questionnaire data for marketing purposes without your explicit consent.

3.3 AI-generated report

Your answers are processed through Lovable AB's AI gateway (see §9.2) to generate your report narrative.

3.4 Lawful basis

Questionnaire data: Performance of a contract / pre-contractual steps — Art. 6(1)(b) GDPR

Email delivery of report: Legitimate interests — Art. 6(1)(f) GDPR

4. PRISM Core HR — Your Organisation as Data Controller

IMPORTANT: PRISM Core HR is fundamentally different from the data processing described in Sections 2 and 3 above. When your organisation subscribes to PRISM Core HR:

4.1 Data controller / processor split

• YOUR ORGANISATION (the employer) is the Data Controller for all employee data entered into PRISM Core HR (names, job titles, salaries, leave records, contract details, etc.)

• MERAKI HR SRL is your Data Processor under GDPR Article 28 — we process employee data on your instructions only, as set out in your Subscription Agreement (Schedule 3: Data Processing Agreement)

This means: employees whose data is entered into PRISM Core HR have a right to make GDPR requests (access, erasure, correction, portability) directly to YOU as their employer. You are responsible for responding to those requests. We will assist you in fulfilling data subject requests in accordance with our Data Processing Agreement.

4.2 What employee data can be stored in PRISM Core HR

PRISM Core HR is an operational HR information system (HRIS). It is designed to hold:

• Employee register data: name, contact details, job title, department, start date, employment type

• Contract information: contract type, notice period, probationary period, work location

• Compensation data: salary, pay grade, bonus structure, pay frequency

• Leave and absence records: annual leave entitlement, taken, remaining; sick leave records

• Performance notes and HR communications (stored securely, HR-visible only)

• Gender data for pay gap analysis. As controller, the employer decides the legal basis — usually a legal obligation under pay transparency law, or legitimate interest.

• Employees are identified by a system-generated unique ID and/or an identifier assigned by the employer. The employer should enter only the personal data necessary for HR management.

4.3 What PRISM Core HR is NOT

PRISM Core HR is NOT an official electronic document management system (EDMS), certified electronic archive, payroll processing system, or REVISAL filing system. Specifically:

• PRISM Core HR does not satisfy Romanian legal archiving requirements (OUG 135/2007, Archiving Law 16/1996). Contracts, addenda, and payslips stored in PRISM Core HR do not constitute your legally required employer archive.

• PRISM Core HR does not calculate, validate, or process payroll (stat de plată, D112 declarations, ANAF contributions).

• PRISM Core HR does not integrate with or file data to REVISAL (Registrul General de Evidenţă a Salariaţilor). You must file all REVISAL registrations through the Inspectia Muncii portal directly.

• As Data Controller, you remain fully responsible for maintaining separate, legally compliant archives for contracts, signed documents, and payroll records.

4.4 Special category data

If you choose to store GDPR Article 9 special category data (health data, ethnic origin, biometric data, criminal records) in PRISM Core HR, you must have a documented lawful basis and implement appropriate safeguards. You are solely responsible for lawful basis documentation as Data Controller. We recommend obtaining legal advice before storing any special category data.

4.5 Lawful bases for PRISM Core HR processing

Operating the platform on your behalf: Performance of contract between MERAKI HR SRL and your organisation — Art. 6(1)(b) GDPR

Processing employee data on your instructions: Your lawful basis as Data Controller — we act on your instructions only

Billing and account management: Performance of contract — Art. 6(1)(b) GDPR

Security monitoring and fraud prevention: Legitimate interests — Art. 6(1)(f) GDPR

5. Data Lifecycle — PRISM Core HR Post-Cancellation

When your PRISM Core HR subscription ends (whether by cancellation, non-renewal, or termination), the following lifecycle applies to all employee data stored in the platform:

• Days 0–30 post-cancellation: Your account enters a grace/export period. Self-service data export is available during this window, Export is available during this period even if invoices are unpaid. You can export your full employee register, contract data, leave records, and other stored data via the platform dashboard.

• Days 31–180 post-cancellation: Data moves to encrypted cold vault storage, hosted in the EU. It is no longer accessible via the platform interface. Data restoration during this period is subject to a Data Restoration Fee (see our Refund Policy at merakihr.eu/refund-policy for applicable fees). Contact merakihr.ro@gmail.com to request cold vault restoration.

• Day 181+ post-cancellation: All data is permanently and irreversibly deleted from all systems including cold vault storage. This deletion is a CASCADE DELETE operation — once executed, recovery is impossible under any circumstances.

We strongly recommend exporting all data before your subscription lapses. We will send email reminders at 30 days, 7 days, and 3 days before the export window closes.

6. Prism ClearPay — Pay Equity Analysis Module

Prism ClearPay is a module available to PRISM Core HR subscribers on Scale and Pro plans. It uses your employee data already stored in PRISM Core HR to generate pay gap analyses, job evaluation outputs, and EU Pay Transparency Directive diagnostic reports.

6.1 AI processing

AI-generated text (the Prism ClearPay pay equity narrative and, where applicable, the Diagnostic Questionnaire report) is produced through Lovable AB's AI gateway. The gateway uses models from Anthropic, OpenAI or Google, run on EU-hosted infrastructure (Google Cloud Vertex AI, AWS Bedrock or Microsoft Azure AI Foundry, EU regions). For ClearPay, only pseudonymised, aggregated group statistics are sent: no names, identifiers or individual salaries, and no group of fewer than 5 people. Your data is not used to train AI models. Lovable's full list of AI sub-processors is published at trust.lovable.dev/subprocessors.

You (as Data Controller) are responsible for ensuring you have lawful basis and employee notice under GDPR Arts. 13–14 before processing employee data for pay equity purposes.

7. Marketing, Newsletter, and Consultancy Services

7.1 Newsletter and marketing communications

If you subscribe to our newsletter or opt in to marketing communications, we process your name and email address to send you HR insights, product updates, and event invitations. You may unsubscribe at any time by clicking the unsubscribe link in any email or emailing merakihr.ro@gmail.com.

7.2 Consultancy services

When we provide HR consultancy services (audits, HR process design, employment law guidance, recruitment support), we process data you share with us about your organisation and employees. This data is used solely to deliver the agreed service. We process it on the basis of performance of contract (Art. 6(1)(b)) and/or your explicit consent for any special category data.

7.3 Free resources

When you download HR templates, checklists, or guides from merakihr.eu, your name and email are used to deliver the resource and may be used to send related content. You may opt out of follow-up communications at any time.

7.4 Calendly booking

We use Calendly for consultation and demo booking. When you book through our Calendly link, Calendly processes your name, email, and calendar data under Calendly's own Privacy Policy. We receive the booking details to prepare for and conduct the session.

8. How We Use Your Data

We use personal data for the following purposes:

• To provide and operate our platforms and services

• To respond to enquiries, provide consultancy advice, and support your HR needs

• To deliver resources, tools, and the Prism ClearPay Diagnostic Questionnaire report

• To process subscription payments and issue invoices

• To send you transactional emails (subscription confirmations, invoices, export reminders)

• To send you marketing communications (with your consent, or on legitimate interests for existing subscribers)

• To improve our website and platforms using aggregated analytics data

• To detect and prevent fraud, abuse, and security incidents

• To comply with our legal obligations under Romanian and EU law

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects, except where you have explicitly requested an automated assessment (such as the Diagnostic Questionnaire risk tier).

9. Sub-Processors and Third-Party Services

We share personal data with the following categories of service providers (sub-processors) who process data on our behalf:

9.1 Infrastructure and platform

Lovable AB (Stockholm, Sweden): Application hosting and deployment for merakihr.eu, PRISM Core HR and Prism ClearPay; also provides the AI gateway described in §9.2.

Supabase, Inc. and Amazon Web Services, via Lovable Cloud: Database, authentication and session handling.

• merakihr.eu and the Diagnostic Questionnaire: hosted in the United Kingdom (London), covered by an EU adequacy decision.

• PRISM Core HR and Prism ClearPay: hosted in the EU.

Stripe Payments Europe Ltd (Ireland): Subscription billing and payments. Acts as an independent controller for payment data; does not receive employee HR records.

Resend, Inc. (USA): Transactional emails for PRISM Core HR (invitations, password resets, notices). Standard Contractual Clauses.

Lovable Emails, provided by Lovable AB: Emails from merakihr.eu, including questionnaire reports.

9.2 AI processing

AI-generated text (the Prism ClearPay pay equity narrative and, where applicable, the Diagnostic Questionnaire report) is produced through Lovable AB's AI gateway. The gateway uses models from Anthropic, OpenAI or Google, run on EU-hosted infrastructure (Google Cloud Vertex AI, AWS Bedrock or Microsoft Azure AI Foundry, EU regions). For ClearPay, only pseudonymised, aggregated group statistics are sent: no names, identifiers or individual salaries, and no group of fewer than 5 people. Your data is not used to train AI models. Lovable's full list of AI sub-processors is published at trust.lovable.dev/subprocessors.

9.3 Website and marketing

The separate Marketing choice in merakihr.eu Cookie settings covers Google Ads and Meta Pixel, when configured, for advertising measurement, relevant advertising and remarketing. With marketing consent, these technologies may share browser and advertising click identifiers, device information and website interactions with Google and Meta. Analytics permission is separate. You can withdraw either choice through Cookie settings in the public footer. Dated choices, a browser-generated visitor identifier and the notice shown are stored in your browser as consent evidence; previous acceptance is preserved when you withdraw. This does not enable tracking within the PRISM Core HR app or Prism ClearPay module.

Google Analytics / Google Tag Manager: Website analytics (merakihr.eu only — not used inside PRISM platforms). Activated only with your consent. US transfer under Standard Contractual Clauses.

Google Ads: Advertising performance and conversion measurement on https://prismclearpay.eu public webpages only, activated with your consent through that website's cookie banner. Not used within the PRISM Core HR app or Prism ClearPay module. US transfer under Standard Contractual Clauses / the EU-US Data Privacy Framework, as applicable.

Meta (Facebook) Pixel: Advertising attribution (merakihr.eu only). Activated only with your consent. US transfer under Standard Contractual Clauses.

Calendly: Consultation and demo booking. US company — EU transfer under Standard Contractual Clauses.

FGO / i-Tom Solutions SRL (invoicing): Romanian fiscal invoicing tool used to issue invoices. Romanian provider.

9.4 No tracking within PRISM platforms

Neither the PRISM Core HR app nor the Prism ClearPay module uses Google Analytics, Google Ads measurement, Meta Pixel, or any marketing or advertising cookies. Authentication session cookies only are used within those platforms. Google Ads advertising measurement on the public webpages at prismclearpay.eu is separate from the app and module.

10. International Data Transfers

The following transfers of personal data outside the EEA occur:

• United Kingdom: merakihr.eu and questionnaire hosting (EU adequacy decision)

• USA: Resend (SCCs), Google, Meta and Calendly (SCCs / EU-US Data Privacy Framework, as already stated)

11. Retention Periods

Website contact forms: 2 years from last interaction, then permanently deleted

Newsletter subscribers: Until you unsubscribe or request deletion

Free resource download data: 12 months from download, then anonymised

Diagnostic Questionnaire data: 12 months from submission, then deleted automatically

PRISM Core HR subscriber data: Duration of subscription + post-cancellation lifecycle (see Section 5)

Billing and invoice data: 10 years (Romanian accounting law retention requirement)

Change history: 5 years from the logged event. Security and login logs: 12 months.

Agreement acceptance records: for the duration of the subscription and 5 years after it ends.

Cold vault data (post-cancellation): Days 31–180 post-cancellation, then permanently deleted on Day 181

12. Your Data Protection Rights

Under GDPR and Romanian data protection law (Law 190/2018), you have the following rights:

• Right of access (Art. 15): Request a copy of the personal data we hold about you

• Right to rectification (Art. 16): Ask us to correct inaccurate personal data

• Right to erasure (Art. 17): Ask us to delete your personal data (subject to legal retention obligations)

• Right to restriction (Art. 18): Ask us to restrict processing of your data in certain circumstances

• Right to data portability (Art. 20): Receive your data in a machine-readable format

• Right to object (Art. 21): Object to processing based on legitimate interests or for direct marketing

• Right to withdraw consent: Where we rely on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, email merakihr.ro@gmail.com with your name, company, and the right you are exercising. We will respond within 30 days (as required by GDPR Art. 12).

If you are an employee whose data has been entered into PRISM Core HR by your employer, your rights should be directed to your employer (who is the Data Controller). They may contact us for assistance.

You have the right to lodge a complaint with ANSPDCP (anspdcp.ro) at any time.

13. Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption at rest and in transit (TLS 1.2+) for all PRISM platform data

• Row-level security in Supabase — each subscriber can only access their own data

• Access control: role-based permissions within PRISM Core HR (Admin, HR Manager, Employee)

• Audit logging: all data access, changes, and agreement acceptances are logged

• Cold vault encryption: post-cancellation data stored in encrypted form with restricted access

• Stripe handles all payment card data — we do not store card numbers

For data we control, we notify ANSPDCP within 72 hours where required. For employee data in PRISM Core HR, the employer is the controller; we notify the employer without undue delay and within 48 hours, so they can meet their own obligations.

14. Cookies

We use cookies on merakihr.eu and, with consent, Google Ads advertising measurement on the public webpages at https://prismclearpay.eu. The prismclearpay.eu cookie banner includes advertising measurement. We do not use analytics, marketing, or advertising measurement cookies within the PRISM Core HR app or Prism ClearPay module. For details of cookies and your choices, please read our Cookie Policy at merakihr.eu/cookies. The `meraki-cookie-consent` cookie stores your merakihr.eu consent preferences for 12 months; advertising measurement choices for prismclearpay.eu are managed separately through that website's cookie settings.

15. Children's Data

Our services are intended for organisations and business users only. We do not knowingly collect personal data from individuals under 16 years of age. If you believe we have inadvertently collected data about a child, please contact us immediately at merakihr.ro@gmail.com.

16. Updates to This Privacy Policy

We may update this Privacy Policy when we change our services, add new sub-processors, or in response to changes in applicable law. We will notify subscribers of material changes by email at least 30 days before they take effect. Changes required by law may apply sooner. The current version is always available at merakihr.eu/privacy. Continued use of our services after the effective date of an update constitutes acceptance.

MERAKI HR SRL · CUI 49743547 · Bucharest, Romania · merakihr.eu · merakihr.ro@gmail.com

Change log

Version	Date	What changed
3.3	21.10.2026	Google Ads advertising measurement added for prismclearpay.eu public webpages only; PRISM Core HR app and Prism ClearPay module remain excluded.
3.2	15.10.2026	Questionnaire retention set to 12 months; AI data described as pseudonymised group statistics (no groups under 5); gender-data and employee-ID wording; CNP sentence removed; Stripe, Resend and Lovable entries updated; retention and breach-notification wording updated; export available even if invoices are unpaid; change-notice period 30 days. Hosting locations, sub-processors and AI processing updated.
3.0	12.10.2026	Previous version (archived).

Previous versions: merakihr.eu/legal/archive