The National Supervisory Authority for Personal Data Processing completed, in November 2025, an investigation at the controller S.C. iHUNT TECHNOLOGY IMPORT-EXPORT SA and found a violation of the provisions of Article 4 paragraph (5) letters a) and b) of Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

As such, the controller was fined a fine of 20,000 lei.

The investigation was initiated following a complaint from an individual regarding a possible violation of the provisions of the legislation in the field of personal data protection.

During the investigation, the National Supervisory Authority for Personal Data Processing found that, on the website owned by the controller, cookies were stored that were not technically necessary on the users' equipment, without providing correct and complete information and without the prior express consent of the data subjects.

It was found that the controller allowed the storage of information and the obtaining of access to the information stored on the users’ equipment, when accessing the owned site, through certain cookies modules that were not technically necessary, installed in the user’s terminal before expressing his/her consent option.

As such, the controller was fined for violating the provisions of Article 4 paragraph (5) letters a) and b) of Law no. 506/2004, according to which the storage of information or obtaining access to the information stored in the terminal equipment of a subscriber or user, is permitted only with the cumulative fulfillment of the conditions provided for in this paragraph.

Legal and Communication Department

A.N.S.P.D.C.P