Skip to content

Rules & compliance

Official rules without the email chains

The rules document is drafted from your mechanic, following the applicable Romanian law, and goes to your legal team for approval in the same workflow. Personal data is handled the GDPR way by design.

Definition

What does campaign legal compliance involve?

Every promotional campaign in Romania needs an official rules document (the regulament): the organizer's legal identity, prize taxes, eligibility, GDPR data processing, and dispute handling. Recefly drafts it from your campaign setup, following Romanian law for promotions, routes it through a versioned legal approval flow, and keeps personal data separate from purchase data for the whole campaign.

Official rules, drafted in minutes

The rules generator builds a structured rules document from your campaign setup: company details, prizes, taxes, eligibility, GDPR clauses, and dispute procedures.

  • Follows the Romanian legal framework for promotions
  • Legal defaults saved per organization and per client, reused next time
  • Edit by chat: describe the change, review what changed
  • Export to PDF or Word for notaries and stakeholders

A real approval flow

The rules document moves from draft to review to approval, with a dedicated legal role, comments on the exact clause, and versions that can't change once submitted.

  • Statuses: draft, in review, approved, rejected, archived
  • Comment threads on the exact clause
  • A compliance checklist with critical, warning, and info items
  • Versions locked once submitted: no silent edits

GDPR by design, not by promise

Recefly keeps purchase data and personal data apart at the database level. Receipts are pseudonymized; personal data sits separately and can be deleted on request without breaking campaign statistics.

  • Purchase data and personal data stored separately, linked only by a hash
  • Deletion requests honored without breaking reporting
  • Cloud infrastructure in the EU
  • Recefly is the Data Processor under your DPA; you stay the Controller

Exports that don't leak

Winner lists and participant data leave the platform only through a secured channel: encrypted, gated, and logged.

  • AES-256 encrypted ZIP exports
  • Downloads gated by a one-time code, with the password sent separately
  • A full export log: who exported what, and when
  • Mandatory two-factor login for every platform user

See also

Frequently asked questions

What teams ask before their first campaign on Recefly.

No, it makes them faster. Recefly drafts a structured document following Romanian law, and your legal team (or the agency's) reviews and approves it in the built-in workflow, with every comment and version tracked. Final legal responsibility stays with the organizer.

Personal data is stored separately from receipt purchase data, linked only by a pseudonymous hash. A deletion request removes the personal data while campaign statistics stay intact: no choosing between compliance and reporting.

Yes. An organization can turn on a “legal approval required” policy, which blocks a campaign from going live until someone with the legal role approves the rules document.

On cloud infrastructure in the EU. Recefly acts as Data Processor under your Data Processing Agreement and processes personal data only on your documented instructions.

Next campaign coming up? Don't start it from zero.

Tell us the mechanic. We'll show you how it runs on Recefly and what you'd reuse next time. Reply within 24 hours.