Privacy Policy

1. Data Controller

The data controller is HOLA25 S.R.L., registered office: Str. Dealului Nr. 8, Farcașești, Gorj County, Romania. Contact: contact@hola25.com

2. Data Protection Officer (DPO)

In accordance with Article 37 of the GDPR, HOLA25 S.R.L. is not required to appoint a Data Protection Officer (DPO) because:

• We are not a public authority or body;

• Our core activities do not involve regular and systematic monitoring of data subjects on a large scale;

• We do not process special categories of data or data relating to criminal convictions on a large scale.

For any data protection inquiries, contact us at: contact@hola25.com

3. Data We Process

• Account data: email, authentication identifiers (e.g., Google), account settings.

• Profile data: display name, username, bio, nationality, sex, profile image, languages/skills and self-assessed levels, date of birth (public/private), phone number (private).

• Usage data: call minutes (host/guest), minutes per skill (where applicable), interactions (requests, private message requests, reports).

• Private messaging data: text messages, message request status, thread metadata, and block/unblock records needed to prevent unwanted contact.

• Technical data: IP (where applicable), device/browser info, security logs, error logs.

• Moderation data: reports, reasons, outcomes of enforcement actions.

4. Purposes, Legal Bases, and Data Categories

5. Public Data

Certain profile data is public and required for the Platform to function (e.g., display name, username, profile picture, nationality, sex, languages/skills and minutes). By using Hola25, users explicitly consent to the public display of such data.

5a. Call Photo Preferences

During video calls, the platform can capture a single photo at the 25th second as a memory of your connection. You have full control over this feature through the following preferences:

• Enable call photos: Controls whether photos are captured during your calls. Enabled by default.

• Allow others to have my photo: Controls whether other users can save combined photos that include you. Disabled by default to protect your privacy.

• Prefer self-only in call history: Controls whether to display only your own photo (instead of combined photos with others) in your call history. Enabled by default.

These preferences are stored in your private profile data and can be changed at any time in your profile settings. Call photos are stored securely and deleted when you delete your account.

6. Recipients and Sub-Processors

We share data with the following service providers:

Note: SCCs = Standard Contractual Clauses; DPF = Data Privacy Framework (Privacy Shield successor). All transfers outside the EEA are protected pursuant to GDPR Articles 44-49.

7. Data Retention

8. Your Rights

Under GDPR, you have the following rights:

• Access (Art. 15): Obtain a copy of your personal data being processed;

• Rectification (Art. 16): Correct inaccurate or incomplete data;

• Erasure (Art. 17): Request deletion of your data ("right to be forgotten");

• Restriction (Art. 18): Limit processing in certain conditions;

• Portability (Art. 20): Receive your data in structured format (JSON);

• Objection (Art. 21): Object to processing based on legitimate interests;

• Automated decisions (Art. 22): Not be subject to decisions based solely on automated processing.

To exercise your rights, email contact@hola25.com. We respond within 30 days (per GDPR Article 12).

9. Automated Decision-Making and Profiling

Hola25 does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. The waitlist displays available users, but there is no automated matching - users manually choose who they want to connect with. Announcement ranking is based on objective factors (publication date, Premium status) and not behavioral profiling.

10. Security

We implement technical and organizational measures to protect data:

• Encryption in transit (HTTPS/TLS);

• Secure authentication via Firebase Authentication;

• Database access rules (Firestore Security Rules);

• PCI DSS Level 1 certified payment processing (Stripe);

• Monitoring and logging for anomaly detection.

No transmission or storage method is 100% secure. Users should protect their credentials and immediately report any suspicious activity.

11. Data Breach Notification

In case of a data breach posing risk to the rights and freedoms of data subjects, we will notify ANSPDCP within 72 hours (Art. 33 GDPR) and, if necessary, inform affected users without undue delay (Art. 34 GDPR).

12. Complaints

You have the right to lodge a complaint with the supervisory authority:

13. Policy Updates

This policy may be updated periodically. For substantial changes, we will notify you by email and/or in-app at least 30 days before the effective date. The last update date is displayed at the top of this page.

14. Contact

For any questions about data protection: