Privacy notice

Who controls the data

Car Washers Community, acting through the administrator responsible for this staff portal, determines why and how account and portal data are used. The administrator must provide staff with the organisation's current legal identity and direct privacy contact details.

Data we use

• Staff username or work email and a password hash used to authenticate the account.
• Role, account status, creation time, and administrator actions needed to manage access.
• Session identifiers, CSRF tokens, request timestamps, and limited network/security metadata needed to prevent abuse and keep the service available.
• Discord user ID only when an administrator configures it for account-action notifications.
• Announcements, handbook content, links, and administrative reasons entered by authorised users.

Why we use it

We use this information to authenticate staff, authorise access, maintain the portal, communicate account actions, investigate security events, and meet applicable employment or legal obligations. We do not use portal data for advertising, behavioural analytics, data brokerage, or automated decisions about staff.

Legal basis

The organisation should document the applicable basis for each staff relationship. Portal access will generally rely on performance of the staff relationship, compliance with legal obligations, and legitimate interests in access control and information security. Consent is not requested as a condition of signing in because it is not the appropriate basis for necessary authentication.

Recipients and transfers

Data is available only to authorised portal administrators and service providers needed to operate the portal. Depending on deployment configuration, these may include the hosting and session-storage providers. Discord receives the configured Discord ID and account-action message only when that notification feature is enabled. External staff links open only after the user chooses them.

Retention

Session cookies expire automatically. Account, administrative, and security records should be retained only for the period documented by the organisation and deleted or anonymised when no longer needed. The portal does not set a universal retention period because employment and security requirements must be confirmed by the administrator.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may also complain to Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP). Some records may need to be retained where the organisation has a legal or security obligation.

Changes

Material changes to this notice should be communicated to staff before the new processing begins. This page must be reviewed whenever portal data, providers, or purposes change.