Atria Privacy notice

Version 1.0, in force from 8 November 2026. It applies to the Atria portal (atriaurbanism.ro). For the narla.digital website, the privacy policy published on narla.digital applies. This is a translation; the Romanian version prevails.

1. Who we are

The Atria portal is operated by NARLA S.R.L., CUI 55631866, Trade Register no. J2026055707008, registered office at Str. Rezervelor nr. 58C, bl. 1, et. 1, ap. 9, Sat Dudu, Comuna Chiajna, județul Ilfov, Romania, represented by Aris Madalina. Contact: contact@narla.digital.

2. What Atria does

The Atria portal lets public institutions and design offices submit planning and permit dossiers for a pre-check and receive a preliminary, non-binding note. The decision on the dossier remains entirely with the chief architect and the planning team, or with the specialist who reviews it.

3. What data we process

  • account data: name, email address, institution, password (stored only in irreversibly hashed form) and the access code used, if any;
  • acceptance of the terms and of this notice: the version accepted and the date;
  • the files uploaded with each dossier (PDF, DWG, DXF) and the pre-check note generated; these may contain personal data of applicants or designers (for example names and addresses in the documents);
  • the audit log: which action was taken and when (for example signing in or submitting a dossier), with the identifiers of the account and of the institution; the log stores no IP address and none of the content of the dossiers.

4. Purpose and legal basis

  • creating and managing the account, checking dossiers and sending notes: Article 6(1)(b) GDPR, performance of the service requested;
  • the audit log and protection against unauthorised access: Article 6(1)(f) GDPR, the legitimate interest of keeping data safe.

For personal data contained in dossiers submitted by an institution or office, NARLA S.R.L. acts as processor, on behalf of and on the instructions of the institution or office, which remains the controller. We conclude a data processing agreement under Article 28 GDPR.

5. Where data is stored and who processes it

  • Amazon Web Services EMEA SARL (Luxembourg), region Frankfurt, Germany (eu-central-1), in the European Union: hosting of the portal, file storage, database, the language model (Amazon Bedrock, eu-central-1) and email (Amazon SES, eu-central-1);
  • Amazon Bedrock: the language model used only as a fallback for ambiguous table rows; the model receives only text excerpts from the relevant pages, not whole files;
  • Amazon SES: sending the portal's emails (address confirmation, password reset, invitations, notifications that a dossier has been checked); emails do not contain the files.

Dossiers and account data are not transferred outside the European Union.

6. How long we keep data

  • the dossier files: deleted automatically 30 days after the check; failed or unfinished dossiers, 30 days after creation; you can delete them at any time from the portal;
  • account data: while the account is active; on your request to delete the account, sent to contact@narla.digital, it is deleted;
  • the audit log: for the duration of the contract with the institution and for 3 years after it ends; entries not linked to an institution are kept for 3 years;
  • database backups (accounts, audit log, dossier records, without the uploaded files): 14 days.

7. Cookies

The portal uses only strictly necessary cookies: atria_session, to keep you signed in, and atria_lang, which remembers the language you chose and is set only when you change the language. We use no tracking, analytics or marketing cookies.

8. Your rights

Under the GDPR, you have the right to:

  • request access to the data we hold about you;
  • request correction of inaccurate data;
  • request deletion of data, under the conditions of the law;
  • request restriction of processing;
  • object to processing based on legitimate interest;
  • request data portability, where applicable;
  • lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Bucharest, https://www.dataprotection.ro.

For the data in dossiers, requests go to the institution that submitted the dossier, as controller; we help it answer them. For any other request, write to contact@narla.digital.

9. Data security

We take reasonable technical and organisational measures to protect the data against unauthorised access, loss or accidental disclosure: encrypted connections, access separated by institution and an audit log that cannot be altered.

10. Changes

This notice is versioned. The version and date are shown at the top. We tell you by email before an important change.