PRIVACY POLICY AND PROTECTION OF PERSONAL DATA RELATED TO SOCAR PAY

Last update: 10.02.2026

This Policy regulates the way in which SOCAR PETROLEUM SA (“we” or the “Operator”) collects and processes the personal data of the Authorized Users designated by the Client in the context of the use of the payment system for car fleets, in compliance with REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of personal data. and repealing Directive 95/46/EC (General Data Protection Regulation).

1. WHAT DATA DO WE COLLECT?

For the operation of the payment system and fleet management, we collect the following categories of data:

  • Mandatory identification data: mobile phone number.
  • Optional identification data: Name, surname, image, e-mail address, only if they are inserted into the SOCAR PAY application by the User.
  • Vehicle data: License plate number, if provided by the Customer.
  • Transaction data: The location of the station where the transaction is made, the date and time, the value of the products, the type of fuel/product purchased.
  • Technical monitoring data: Odometer index (mileage) entered manually.
  • Geolocation data: The GPS coordinates of the mobile device strictly at the time of the transaction (to validate presence at the filling station and prevent fraud).
  • Technical access data: IP address, device type, operating system and error logs.

 

2. PURPOSE AND LEGAL BASIS OF THE PROCESSING

We process your data for the following purposes:

  • Performance of the contract (Art. 6 para. 1 lit. b GDPR): To enable payments and fleet card management.
  • Legitimate interest of the Operator or the Customer (Art. 6 para. 1 lit. f GDPR): * Fraud prevention (e.g. checking whether the user is present at the pump at the time of payment).
  • Fulfillment of legal obligations (Art. 6 para. 1 lit. c GDPR): Correct invoicing, tax reporting and compliance with the legislation in force.

 

3. WHO ELSE HAS ACCESS TO YOUR DATA?

Your data may be shared with:

  • Your employer (Client): They have access to transaction reports, mileage, and payment history made through the app.
  • Service providers: Petrol station networks, IT service providers, payment processors and technical support services.
  • Public authorities: Only if there is a legal obligation to respond to a request from any public authority (ANAF, police, courts, etc.).

 

4. GEOLOCATION AND MONITORING

Important note: SOCAR PAY does not perform continuous monitoring (track & trace) of your location during business hours. The collection of GPS coordinates takes place exclusively within the time window of the transaction, to confirm that the payment is legitimate and is made at the authorized point of work.

 

5. DATA RETENTION PERIOD

We keep your data:

  • For the duration of the user account.
  • 10 years for the data contained in the financial-accounting documents (fleet invoices), for the purpose of fulfilling tax obligations.
  • Until you withdraw your consent or exercise your right to erasure, unless we are required by law to retain the data.

 

6. YOUR RIGHTS (GDPR)

As a data subject, you have the following rights:

  • Right of access: To know what data we process about you.
  • Right to rectification: To correct inaccurate data.
  • Right to erasure (“right to be forgotten”): As long as the data is no longer necessary for tax purposes.
  • Right to restriction of processing.
  • Right to data portability.
  • The right to lodge a complaint with the ANSPDCP (dataprotection.ro).

 

7. DATA SECURITY

We implement advanced technical measures (SSL/TLS encryption, two-factor authentication, anonymization of test data) to protect information from unauthorized access or accidental loss.

 

8. CONTACT

For any questions related to data protection, you can contact us at the e-mail address: dpo@socarpetroleum.ro.

 

Back to SOCAR PAY