Terms and conditions

1. Identity of FinStream and scope

The contractual and operational contact is contact@finstream.ro. Any dedicated address subsequently communicated by FinStream for security, support or data protection shall prevail for that category of requests.

The Terms form a binding contract between FinStream and the legal entity, authorised self-employed individual (PFA) or professional contracting the Service (the “Client”). The individual accepting the Terms on behalf of the Client represents that they have the capacity and authority required to bind the Client.

2. Definitions

“Client” — the legal entity, authorised self-employed individual (PFA), professional or accounting firm that purchases the Service.

“Managed Company” — the legal entity enrolled in a Workspace by the Client and on whose behalf invoices are retrieved or payments are facilitated.

“Workspace” — the logical organisational space in which the Client manages Companies, Users, roles, accounts and policies.

“Administrator” — the User to whom the Client has granted administrative rights in the Workspace or at the level of a Company.

“Authorised User” — the person to whom the Client or an Administrator has granted access to the Service and certain permissions.

“Initiator” — the Authorised User who selects invoices and prepares or submits a payment request.

“Approver” — the Authorised User who approves or rejects a payment request within a workflow.

“PIS” — the regulated payment initiation service currently provided by SmartFintech S.R.L. or by another authorised provider designated by FinStream. Any reference to “PIS” refers to both the service and its provider.

“Payment Evidence Record” — the electronic, versioned, integrity-protected record associated with a payment transaction.

“Service” — the FinStream SaaS platform and the contracted features, excluding the independent services provided by ANAF, banks, the PIS or other third parties.

“Business Day” — any day other than a Saturday, Sunday or public holiday in Romania.

3. Eligibility and exclusively B2B nature

The Service is intended exclusively for professional use. Consumers, i.e. natural persons acting for purposes outside their trade, business, craft or profession, are not eligible.

The Client represents that it uses the Service only for its professional activity or for the activity of the Managed Companies under valid mandates, powers of attorney or rights.

FinStream may refuse, suspend or terminate access where there are reasonable indications that a person is using the Service as a consumer, without a mandate or for a prohibited activity.

4. Nature and limits of the Service

FinStream is a SaaS platform that facilitates the retrieval and display of invoices from the RO e-Factura system, the configuration of internal controls, the selection of invoices and the transmission to a PIS provider of the information required to initiate a payment.

FinStream is not a bank, credit institution, payment institution, electronic money issuer, accountant, tax advisor, lawyer, auditor or administrator of the Client’s funds, unless a signed document expressly provides otherwise.

FinStream does not hold or control the Client’s funds. FinStream does not access bank account balances within the features available as of version 1.1, cannot guarantee the availability of funds and does not execute the bank transfer. The order is authorised by the User and processed through the PIS and the relevant bank.

Future account information, balance or reconciliation features will be subject to additional terms and disclosures before activation.

5. Registration and acceptance of contractual documents

The Client must provide accurate, complete and up-to-date information. FinStream may request reasonable documents or information to verify identity, authority, eligibility, security or compliance.

Electronic acceptance of the Terms, the DPA, the applicable policies and the commercial order has legal effect. FinStream retains the document version, the UTC date and time, the identity of the actor, the acceptance method and other reasonable evidentiary elements.

In the event of a conflict, the order of precedence is: (a) a signed enterprise agreement or order; (b) the DPA for data protection matters; (c) the SLA; (d) these Terms; (e) the operational policies. An in-app configuration does not implicitly amend the contract.

6. Company onboarding and validation through ANAF

A Company may be enrolled only if the user presents a valid digital certificate and the ANAF mechanisms confirm the right of access to that Company. FinStream relies on ANAF responses and mechanisms as an external validation source.

FinStream does not guarantee that ANAF validation reflects all internal, contractual or corporate limitations of the user’s mandate. The Client is responsible for ensuring that the person holds and maintains the mandate required for all operations performed.

If ANAF does not confirm access, the certificate is invalid or the verification cannot be completed, onboarding is refused or suspended.

7. Digital certificates and access revalidation

FinStream periodically checks the validity of the certificate and, where available, its revocation status and the relevant rights. Upon detecting an invalid, expired, revoked or unaccepted certificate, FinStream may suspend the associated access.

Suspension of the root certificate may extend to all Users and rights created on its basis. Access may be restored after a new certificate is presented and validated and, where applicable, the mandate is re-verified.

The Client must notify without delay any compromise, loss, revocation, expiry or unauthorised use of a certificate. FinStream does not store the certificate’s private key or PIN.

8. Workspaces, roles and authorised users

The Client manages the structure of the Workspace, the Users, roles, Companies and permissions. Any action performed by a User with valid rights is attributed to the Client to the extent permitted by law.

The Client is responsible for: granting least privilege; periodically reviewing access; promptly removing former employees or contractors; protecting accounts; correctly configuring workflows; and monitoring its own activity.

Deactivating a User invalidates their sessions and tokens, blocks payment initiation and approval and removes access to data, in accordance with the technical controls implemented. Payments in progress may be blocked, cancelled or reassigned depending on their status and the applicable policy.

The 4-eyes review feature is an additional control. It does not constitute a guarantee that errors, fraud or internal abuse will be prevented.

9. Connecting and managing bank accounts

Each bank account usable for payments must be associated with a single Company in FinStream. A Company may have several accounts, including in different currencies and with different banks.

FinStream applies server-side validations to prevent the use of an account associated with another Company. The Client may not bypass this mapping and must verify the selected account before confirmation.

Newly added accounts may require verification by micro-transfer or another verification method. A micro-transfer verification demonstrates operational control over the source account, not necessarily absolute legal ownership, if the bank does not confirm the account holder.

An unverified, suspended, revoked, archived or ineligible account cannot be used to initiate a payment. The association between a verified account and a Company cannot be changed retroactively; any change requires a new record and a new verification.

10. Invoices and information retrieved from RO e-Factura

FinStream retrieves and displays data provided by ANAF and/or by the Client. FinStream does not create the invoice, does not verify the reality of the underlying transaction and does not guarantee the accuracy, legality, authenticity, VAT treatment, due date, supplier IBAN or the fact that the amount is owed.

The Client must verify each invoice before payment, including the supplier’s identity, the amount, currency, beneficiary account, due date, any credit notes, payments already made or commercial disputes.

FinStream does not guarantee that ANAF information is available, complete, up to date or error-free and is not liable for delays, unavailability or changes to the RO e-Factura system beyond its reasonable control.

11. Payment initiation and approval

The User selects the invoices, the Company and the source account. Before transmission to the PIS, FinStream displays a confirmation screen with the essential information, including the Company, the masked source account, the number of invoices, the total, the currency and the beneficiaries.

The confirmation expresses the Authorised User’s intention to transmit the instruction to the PIS. FinStream does not verify the economic rationale or commercial intent of the User.

Within an approval workflow, the payment is transmitted only after the configured rules are met. The Client is responsible for designing and updating these rules.

The Client is responsible for having sufficient funds and for ensuring that the bank, account and users are eligible. Insufficient funds, bank refusal, bank limits or failed authentication do not constitute non-performance by FinStream.

A transaction already transmitted to the PIS or the bank may become irrevocable under the provider’s rules and payment legislation. FinStream does not guarantee cancellation or recovery of funds.

12. Relationship with the PIS provider and third-party suppliers

The payment initiation service is provided by the PIS, currently SmartFintech S.R.L., Tax ID (CUI) 41251980, Trade Register No. J40/7728/2019, a payment institution authorised by the National Bank of Romania and entered in the Register of Payment Institutions under no. IP-RO-0011/02.04.2021, verifiable at https://www.bnr.ro/24410-registrul-institutiilor-de-plata-active. The PIS acts under its own authorisations, flows and terms. Any change of PIS provider will be notified to the Client in accordance with Section 33. FinStream provides the interface, the controls and the technical transmission, but does not assume the legal obligations of the PIS.

The Client may be required to accept the terms of the PIS or of the bank. In the event of a dispute regarding the execution of the payment transaction, liability is determined according to the role and actual control of each party and the applicable mandatory rules.

FinStream uses suppliers such as AWS, Okta, Cloudflare, Resend and other subprocessors communicated in accordance with the privacy policy and the DPA. GitHub and Plane are used internally and must not contain operational production data, except in controlled and minimised cases.

13. Legal Evidence Framework and evidentiary value

For each payment, FinStream creates a Payment Evidence Record with a unique identifier and a versioned schema. The record may contain certificate metadata, actors, roles, approvals, technical context, accepted documents, the hash of the PIS payload, the payment status and supplier identifiers.

Records are protected by integrity mechanisms, which may include hashing, canonicalisation, cryptographic chaining and digital signing. Historical records are not overwritten when permissions, accounts or policies change.

The Client acknowledges that such records, audit logs, UTC timestamps, confirmations and supplier responses may be used as evidence. They do not constitute “irrefutable proof”; the competent court or authority determines their evidentiary value.

The Client may not delete or alter Payment Evidence Records. FinStream may retain them after termination of the contract for legal obligations, security, fraud prevention and the defence of legal claims.

14. Obligations of the Client and Users

The Client must use the Service with the diligence of a professional and comply with the law, its mandates, internal policies and contracts.

Without limiting its other obligations, the Client must: verify invoices and beneficiaries; keep its data up to date; protect passwords, certificates and devices; enable the available controls; review access; report incidents without delay; keep its own accounting archive; and cooperate in investigations.

The Client is liable for its Users, the Managed Companies, the authority granted and the actions performed with credentials or certificates under its control, unless it proves the exclusive fault of FinStream that could not have been prevented by reasonable measures.

15. Security and acceptable use

The Client shall not: share credentials; use another person’s certificate without right; circumvent controls; test vulnerabilities without authorisation; introduce malware; perform unauthorised scraping or automation; reverse-engineer; overload the infrastructure; use the Service for fraud, money laundering, tax evasion, sanctions evasion or other illegal activities.

FinStream may apply rate limits, additional checks, temporary blocks, suspensions and anti-fraud measures. FinStream is not required to disclose its internal detection rules if disclosure would reduce their effectiveness or security.

The Client must take reasonable measures to mitigate damage, must not continue a transaction it knows to be affected and must provide the information needed for the investigation.

16. Service availability, performance and maintenance

FinStream targets a monthly availability of 95% for the main application component, calculated in accordance with Annex 1. Availability below 95% may give rise to service credits only under the conditions of Annex 1.

FinStream does not offer a latency SLA for APIs. The operational objective for page and API response is under 5 seconds, but this is a performance target, not a contractual guarantee, and does not give rise to service credits.

Waiting time caused by ANAF, the PIS, banks, authentication in external systems, unusually large exports, batch operations, the Client’s networks and other external dependencies is excluded from measurement.

Planned maintenance is notified at least 24 hours in advance and scheduled, as a rule, outside 09:00–18:00 Romanian time on Business Days or at weekends. Planned maintenance is limited to 8 hours per month, excluding urgent security or continuity interventions.

17. Support and incident management

The application can be accessed 24/7, subject to the SLA. Standard support is provided during the hours communicated by FinStream, and emergency support for Severity 1 is available 24/7.

The initial response targets are: Severity 1 — 30 minutes; Severity 2 — 2 hours within support hours; Severity 3 — 1 Business Day; Severity 4 — 2 Business Days. These are response targets, not resolution guarantees.

FinStream prioritises payment operations between 09:00–18:00 Romanian time on Business Days. For major incidents attributable to FinStream, at the Client’s request, FinStream may provide a post-incident report, which will not include information that would create security risks.

18. Subscriptions, invoicing and payment

FinStream offers monthly and annual subscriptions. The price, limits, features and transaction fees are those set out in the order, offer or subscription page accepted by the Client.

Invoices are due within 30 days of issue, unless otherwise agreed. The Client shall pay all applicable fees, taxes and costs, except taxes on FinStream’s income.

Absent an invoicing error or a legal obligation, fees paid are non-refundable. The Client must dispute an invoice within a reasonable time and pay the undisputed portion.

19. Upgrade, downgrade and price changes

An upgrade to a higher plan takes effect immediately. The price difference is prorated for the remainder of the billing cycle.

A downgrade takes effect at the next renewal or billing date. Before that date, the Client must reduce the number of Companies, Users, transactions or features used to within the limits of the lower plan. Otherwise, the downgrade may be postponed or excess usage may be charged.

FinStream may change prices with at least 30 days’ notice. For prepaid annual subscriptions, the new price applies at renewal; for monthly subscriptions, from the first cycle starting after the notice period expires. The Client may reject the change by not renewing.

20. Service credits

Service credits are available exclusively for eligible unavailability attributable to FinStream and are granted only upon the Client’s request submitted within 60 days of the incident.

The credit applies only to a future invoice, is not payable in cash, may not exceed the subscription fee for the affected service and expires if it cannot be applied within 12 months.

The Client must describe the incident and the affected period, have paid all invoices due and cooperate with the investigation. FinStream verifies the request based on its own monitoring and the available evidence.

The availability credit is calculated once per calendar month, based on total availability, and does not accumulate per incident. The maximum availability credit is 20%; the aggregate cap for all SLA credits in a month is 50% of the monthly subscription fee.

Service credits are the exclusive contractual remedy for SLA breaches, to the extent permitted by law. Double recovery for the same loss is not permitted.

21. Suspension of the Service

FinStream may suspend the Service 30 days after an unpaid invoice is issued. FinStream will attempt to send a notice before suspension, but failure to send a notice does not cancel the payment obligation.

FinStream may immediately suspend access for suspected fraud, security risk, invalid certificate, illegal use, breach of the Acceptable Use Policy, a request from an authority, protection of funds or prevention of damage.

Suspension does not remove payment obligations and does not cancel transactions already transmitted to the PIS. Reactivation may be conditional on remedying the cause, paying outstanding amounts and re-verifying security.

22. Term, renewal and termination

The subscription is concluded for the agreed monthly or annual period and renews automatically for successive equal periods, unless the Client gives notice of non-renewal at least 30 days in advance.

A termination notice stops the renewal. The Client retains access and support until the end of the period already paid. Amounts for the remaining period are not refunded.

The Client may request deactivation of access before expiry, without refund. FinStream may terminate the contract immediately for fraud, serious risk, illegal activities, unremedied material breach, insolvency as provided by law or an order of an authority.

23. Effects of termination and data export

Upon expiry of the paid period, the right of use and support cease, payment initiation and approval are disabled, e-Factura synchronisation stops and Users’ access is suspended.

Transactions already transmitted to the PIS continue according to their status and are not automatically cancelled. All amounts owed remain payable.

The Client benefits from a 30-day export period, except in the case of suspension for security, fraud or a legal order. The export may include invoices, payment history, approvals and available evidence reports.

After the export period, operational data enters a soft deletion period of up to 90 days. Data subject to retention obligations is archived and accessible only through controlled processes.

24. Data protection and subprocessors

The processing of personal data is governed by the Privacy Policy and, where applicable, the DPA. For the Client’s content, FinStream may act as a processor; for security, invoicing, fraud prevention and contract administration, FinStream may act as an independent controller.

Production data and backups are hosted in AWS regions in the EU, the primary region being Frankfurt. FinStream aims to ensure that operational data does not leave Europe, subject to technical and contractual validation of supplier access.

Relevant suppliers include AWS, Okta, the PIS (currently SmartFintech S.R.L.), Cloudflare and Resend. The up-to-date list and the notification mechanism are set out in the DPA and the Subprocessor Register.

Amazon Bedrock is used for a limited-scope chatbot. The chatbot does not accept invoices and must not be used for sensitive data. FinStream aims for zero retention and disabled content logging where the configuration allows. Client data is not used to train models.

25. Data retention, archiving and deletion

FinStream applies differentiated retention periods. As of version 1.1: RO e-Factura invoices — 7 years from the end of the financial year; Payment Evidence Records — 10 years from the final event; contractual evidence — the term of the contract plus 10 years; application logs — 90 days; authentication logs — 24 months; daily backups — 35 days; monthly backups — 12 months.

Payment Evidence Records cannot be deleted by the Client. GDPR requests are assessed for erasure, anonymisation or restricted retention, depending on the applicable legal basis.

FinStream may apply a legal hold for litigation, complaints, fraud, incidents, audits or requests from authorities. During a legal hold, deletion of the relevant data is suspended.

FinStream does not replace the Client’s accounting and tax archiving obligation. The Client must export and retain the necessary documents in accordance with its own legal obligations.

26. Intellectual property and data rights

The Client retains its rights in the invoices, documents, Company data and specific configurations entered into the platform.

FinStream and its licensors own the software, code, architecture, interface, APIs, generic data models, audit mechanisms, know-how, documentation, trademarks and reusable improvements.

The Client receives a limited, non-exclusive, non-transferable and revocable licence to use the Service for the term of the contract. The Client grants FinStream the limited right to host, copy, transform and process the data solely to provide, secure, support and improve the Service, within the limits of the DPA.

Payment Evidence Records are managed by FinStream as system records, and the Client has the right to access and export them for its own transactions. No provision transfers to the Client any rights in the evidence engine.

27. Confidentiality

Each party shall protect the other party’s confidential information with at least the same degree of care it uses for its own similar information and no less than a reasonable degree of care.

Information may be disclosed to employees, subcontractors, lawyers, auditors and authorities only to the extent necessary and subject to appropriate obligations. The obligation does not apply to information that is public, previously known, lawfully received or independently developed.

Upon termination, information is returned, deleted or retained in accordance with retention, backups and legal obligations.

28. Representations, warranties and exclusions

FinStream represents that it will provide the Service with reasonable professional diligence and will apply the security measures described in the applicable documentation.

To the maximum extent permitted by law, the Service is provided “as is” and “as available”. FinStream does not guarantee uninterrupted operation, a complete absence of errors, the prevention of all fraud, acceptance by any bank or the accuracy of third-party data.

FinStream does not provide legal, accounting or tax advice and does not guarantee the compliance of the Client’s decisions. The Client must obtain its own advice.

29. Limitation of liability

To the extent permitted by law, FinStream is not liable for the payment decision, the content or legality of the invoice, insufficient funds, tax obligations, internal fraud, User errors, compromised devices, phishing, malware, loss of credentials, or the unavailability of ANAF, the PIS, banks, the internet or other third parties.

FinStream is not liable for indirect, incidental, special, punitive or consequential damages, loss of profit, revenue, opportunity, savings, goodwill, reputation, data or business interruption, even if the possibility was known.

FinStream’s total aggregate liability, on any legal basis, shall not exceed the amount of subscription fees actually paid by the Client for the affected Service in the 12 months preceding the event giving rise to the claim.

The cap does not apply to the extent that the law prohibits limitation, including for fraud or intent or gross negligence, and does not limit the specific mandatory obligations of a PIS provider that are not assumed by FinStream.

The Client must notify the claim without undue delay and take reasonable measures to mitigate the damage. No party may obtain double recovery for the same loss.

30. Indemnification by the Client

The Client shall defend and indemnify FinStream against third-party claims arising from: the Client’s lack of mandate; unlawful use; incorrect data or instructions; infringement of the rights of a Managed Company; the actions of Users; infringement of intellectual property through the Client’s content; or failure to fulfil tax and accounting obligations.

The obligation applies only to the extent the damage was not caused by FinStream’s own fault and subject to reasonable notice and cooperation in the defence. FinStream may participate with its own counsel at its own expense.

31. Force majeure and events beyond control

Neither party is liable for non-performance caused by unforeseeable and unavoidable events beyond its reasonable control, including disasters, war, large-scale attacks, systemic unavailability, power outages, actions of authorities or urgent legislative changes.

Supplier unavailability is excluded from the SLA when it is beyond FinStream’s reasonable control. The exclusion does not apply if the unavailability was caused or materially prolonged by negligent selection, faulty configuration or the absence of reasonable resilience measures within FinStream’s control.

32. Amendments to the Terms

FinStream may amend the Terms with at least 30 days’ notice for material changes. Urgent changes required by law, security or suppliers may take effect earlier, with notice given as soon as possible.

If the Client does not accept a material change, its remedy is non-renewal or termination before the effective date. Continued use after the effective date constitutes acceptance, where permitted by law.

FinStream keeps the version history and proof of notice or acceptance.

33. Notices

Notices to FinStream are sent to contact@finstream.ro or to the dedicated address communicated. Notices to the Client are sent through the application, to the administrator’s e-mail or to the details in the order.

The Client must keep its details up to date. An electronic notice is deemed received upon sending, unless an error message is returned, and a contractual termination notice takes effect upon confirmation of receipt or on the first Business Day after sending.

34. Assignment and subcontracting

The Client may not assign the contract without FinStream’s consent, except in a reorganisation that does not reduce its ability to pay and with prior notice. FinStream may assign the contract in the context of a reorganisation, financing, merger or sale of the business, subject to data protection requirements.

FinStream may use subcontractors and subprocessors and remains responsible for its contractual obligations within the stated limits. Independent PIS providers and banks are responsible for their own services.

35. Governing law and dispute resolution

The Terms are governed by Romanian law. The official language is Romanian; translations are for information purposes only, unless a signed agreement provides otherwise.

Before bringing an action, the parties shall attempt to settle the dispute amicably for 30 days from written notice of the dispute. This obligation does not prevent urgent measures, injunctions, preservation of evidence or claims at risk of becoming time-barred.

If the dispute is not resolved, jurisdiction lies with the competent courts in Iași, Romania, to the extent the choice of jurisdiction is valid under the law.

36. Final provisions

If a clause is invalid, the remainder stays in force and the clause shall be replaced by a valid one that reflects the economic purpose as closely as possible.

Failure to exercise a right does not constitute a waiver. Headings are for guidance only. The terms “including” and “for example” are not limiting.

The contract, together with the incorporated documents, constitutes the entire agreement and supersedes prior understandings regarding the Service.

Annex 1 — SLA and support

This annex forms part of the Terms. In the case of a signed enterprise agreement, the targets in that agreement prevail.

1. Monthly availability

Monthly availability = (Total eligible minutes − Minutes of eligible unavailability) / Total eligible minutes × 100. Minutes are measured by FinStream’s systems. Unavailability is eligible only if the main function of the application cannot be used by the majority of affected users and the cause is attributable exclusively to FinStream.

2. Exclusions

• notified planned maintenance
• urgent security maintenance
• ANAF, the PIS, banks, Okta, Cloudflare, the internet or other third parties
• actions, configurations, devices or networks of the Client
• force majeure
• permitted suspension
• large exports, batches and external authentication
• beta or free features identified as such

3. Availability service credits

Eligible monthly availability — Credit

• 95% or more — 0%
• Below 95% but at least 90% — 5%
• Below 90% but at least 85% — 10%
• Below 85% — 20%

Credits must be requested within 60 days, apply to a future invoice, are not payable in cash, expire after 12 months and are conditional on payment of invoices due. The aggregate monthly cap is 50%, and the availability credit is limited to 20%.

4. Performance

There is no API latency SLA. The operational target for pages and APIs is under 5 seconds, excluding waiting time caused by external systems and large operations.

5. Maintenance

Minimum 24 hours’ notice; outside 09:00–18:00 Romanian time on Business Days or at weekends; maximum 8 hours/month, except for emergencies.

6. Severity levels and response times

Severity — Example — Response target

• S1 Critical — Platform unavailable, major security incident, widespread payment blockage — 30 minutes, 24/7
• S2 High — Major feature unavailable, significant impact — 2 hours within support hours
• S3 Medium — Degradation with workaround — 1 Business Day
• S4 Low — Question, minor defect, feature request — 2 Business Days

Annex 2 — Responsibility matrix

Area — Primary responsibility — Note

• User identity and mandate — Client / ANAF — FinStream relies on ANAF validation and its own controls.
• Invoice content and legality — Client — FinStream displays the data; it does not certify the underlying transaction.
• Payment decision — Client / Authorised User — FinStream does not verify commercial intent.
• Company–bank account mapping — FinStream and Client — FinStream applies the validation; the Client declares and verifies the data.
• Sufficient funds and bank limits — Client / bank — FinStream has no access to balances at go-live.
• Correct transmission of the payload to the PIS — FinStream — Limited to FinStream’s technical control.
• Payment execution — PIS / bank — In accordance with Law 209/2019 and the relevant contracts.
• Roles and permissions — Client — FinStream executes the configuration.
• Platform security — FinStream — Within the limits of SaaS responsibility and shared responsibility.
• Security of devices and credentials — Client / Users — Obligation of immediate notification.
• Availability of ANAF/PIS/banks — The respective provider — Excluded from the FinStream SLA.
• Retention of FinStream records — FinStream — In accordance with the retention policy and legal hold.

Annex 3 — Main legal sources

This list is for information only. The Terms shall be interpreted in accordance with the legislation in force, including subsequent amendments.

• Law no. 209/2019 on payment services: https://legislatie.just.ro/Public/DetaliiDocument/219736
• Regulation (EU) 2016/679 (GDPR): https://eur-lex.europa.eu/eli/reg/2016/679/oj
• Regulation (EU) No 910/2014 (eIDAS), consolidated version: https://eur-lex.europa.eu/eli/reg/2014/910/2024-10-18/eng
• Romanian Civil Code: https://legislatie.just.ro/Public/DetaliiDocument/175630
• Accounting Law no. 82/1991: https://legislatie.just.ro/Public/DetaliiDocument/1576
• Law no. 365/2002 on electronic commerce (relevant to the electronic conclusion of the Terms)
• Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector