1. Who is responsible
The data controller and provider of the CEI One apps is PORUMBESCU CORNEL-VIOREL PERSOANĂ FIZICĂ AUTORIZATĂ (sole proprietorship, Romania), fiscal code (CUI) 54020058, Trade Register no. F2026009174001 (EUID ROONRC.F2026009174001), registered office at Strada Liliacului nr. 8A, camera 2, Sat Șelimbăr, Comuna Șelimbăr, Județul Sibiu, România. For privacy questions, contact support@ceione.ro.
2. What this policy covers
This policy applies to the CEI One iPhone app, which reads the eID over NFC, the CEI One Mac app, which reads the eID through a smart card reader connected to the Mac (for example a USB CCID reader), the ceione.ro website, and support communication. CEI One operates no servers of its own for the apps and does not receive your documents, eID data, or access codes.
3. Data processed on your device
The apps may process the CAN, entered PINs, identity data available on the eID, holder photo, address, certificates, PDF documents, and the handwritten signature stored on the card. This data is processed locally, on your iPhone or Mac, only for the function you request. PINs are never kept. The CAN is not kept unless, after a successful read, you choose to remember it for that card: it is then stored in the Keychain, only on that iPhone or Mac, without iCloud sync and without being transferable to another device through a backup, together with the document number and a short form of the holder's name (for example "Ion P.") that identifies the entry. A remembered CAN is read only after Face ID, Touch ID, Optic ID, or the device passcode or password, is deleted automatically if the card rejects it twice in a row, and can be deleted at any time in Settings › Privacy. The optional app lock uses the same system authentication: the app never receives or stores biometric data, only the result of the check. A signed PDF contains your signing certificate (including the holder's name) and, if you choose the handwritten-signature appearance, the handwritten signature image read from the eID. To check that the data is authentic (passive authentication), the apps also read the security object EF.SOD, EF.COM, and the MRZ (DG1) from the eID and, when EF.SOD lists them, DG11 and DG12. The data, photo, and handwritten signature are compared with the hashes signed by the issuer, and the issuer's signature is verified on the device against the CSCA Romania certificates bundled with the app. This check does not use the internet and sends no data off the device. Identity reports state which data is cryptographically verified and which data, such as the address, is not covered by the issuer's signature. The apps contain no analytics, advertising, or trackers.
4. Documents and local history
On iPhone, signed PDFs are saved to the local library automatically after signing; other PDFs you create, scan, or import are kept only when you choose to save them. On Mac, the signed copy and verified PDFs are kept in the library only if you choose that option. On iPhone, library documents, the library index, and temporary copies made for sharing or uploading are written with iOS complete data protection, so they can be read only while the phone is unlocked. If the phone locks right at the end of signing, the signed PDF is stored temporarily with "protected unless open" protection, which allows creating the file while the phone is locked, and moves into the protected library at the next unlock. When you open a PDF from another app on iPhone ("Open in"), the PDF is copied into a protected app workspace, and the temporary copy handed over by the system is deleted after import. The library is excluded from device backups (iCloud or computer backups on iPhone, Time Machine on Mac): without iCloud sync, your documents are not restored on a new device. You can preview, export, or delete documents in the app. When you delete a synced document, you choose whether to remove it from this device only or from all devices; the retention rules in Settings remove only the copies on the device. Synced copies stay in iCloud until you choose deletion from all devices or delete them through iCloud. The app keeps on the device a list of documents removed only locally, so it does not download them again.
5. Optional iCloud sync
Sync is off by default and starts only if you turn it on. Then eligible library documents are stored in full in the private CloudKit database linked to your Apple account: on iPhone, signed, scanned, and imported (unsigned) PDFs; on Mac, signed PDFs and PDFs you verified in the app. A signed PDF is synced with its full content, including the signing certificate and, if chosen, the handwritten signature image. Metadata is synced with each document: file name, kind, creation and modification dates, size, page count, SHA-256 fingerprint, signature state and count, and on iPhone also signer names, signing time, whether a trusted timestamp is present, and the certificate fingerprint. Identity reports and proof-of-address documents generated from eID data are never synced, and the CAN and PINs are not synced. The service is provided by Apple and Apple iCloud terms also apply.
6. Network connections
The apps connect to the internet only for: (a) RFC 3161 timestamps when signing: the DigiCert service receives only the cryptographic hash of the signature, not the PDF; GlobalSign and then Sectigo are contacted, with the same hash, only if the previous service did not answer correctly. While you authorize the card, the app may open the connection to DigiCert in advance without sending any signature data; (b) when signing, before the signing operation on the card, downloading certificate revocation lists (CRL) and issuer certificates (AIA) for the chain of your certificate and of the timestamp service from the issuing authorities (MAI for the eID, DigiCert and, if needed, GlobalSign or Sectigo) to embed PAdES-LT evidence in the document. On iPhone, if the issuer's revocation list could not be prepared in advance (for example, the first time you sign with a new certificate), it is downloaded after the certificate is read from the card, and the card has to be held to the phone once more for signing. To prepare the next signing faster, the app keeps on the device the public CRL download addresses of the issuer of your signing certificate, keyed by a fingerprint of the issuer name; they contain no personal data; (c) online signature verification, only when you ask for it: when you verify a PDF on the verification screen, when you open the signatures of a library document that has no saved result, or when you tap "Verify again". The app then downloads CRLs and certificates from the addresses embedded in the certificates of the verified document, which may belong to other trust service providers, and if they give no answer it may use the system's OCSP/CRL check. Automatic verification of library documents runs on the device without any internet connection, using only the document's own data and the built-in trusted certificates; (d) iCloud sync, if you turn it on; (e) support and privacy pages you choose to open. For these requests the contacted servers see your IP address and, for OCSP, the identifier of the certificate being checked.
7. Website and cookies
ceione.ro uses no accounts, advertising, third-party trackers, or analytics cookies. The hosting server may temporarily process standard technical data such as IP address and user agent to deliver and secure the website, based on our legitimate interest in operating a secure site.
8. Support
If you email us, we process your address, message, and any attachments you choose to send to answer the request, based on your request and our legitimate interest in providing support. Do not send CANs, PINs, or unprotected identity-card copies. We retain the conversation only as long as needed for support and legal obligations.
9. Your rights
You can delete documents in the app, from this device or, for synced documents, from all devices, and synced data also through iCloud mechanisms. For access, correction, deletion, restriction, objection, or questions about information received through support, email us. You may also complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or to the competent authority in your country.
10. Security and limitations
We use the security mechanisms provided by iOS, macOS, NFC, smart card readers, and CloudKit. No system can guarantee absolute security; protect your eID codes, device, and exported documents.
11. Changes
We may update this policy when features or legal requirements change. The date of the current version appears at the top of this page.