6310

Authorisation procedure and Trade Register aspects for CAEN 6310

For the registration in the Trade Register of the data processing, web page administration and related activities (CAEN 6310), the following documents are submitted: the standard registration application, the constitutive act (LLC, SA, PFA etc.), the identity document of the administrator/owner, and the proof of professional headquarters (loan contract, lease, property). The headquarters must be real and correspond to the declared purpose – virtual offices without physical space are not accepted by the Trade Register (ONRC). No special operating permits are required for CAEN 6310, as it does not fall under Law 165/2018 (regulated activities). However, when submitting the declaration on own responsibility under Law 359/2004, compliance with the operating conditions is certified. The registration period at the ONRC is 1-3 working days for legal entities, respectively 24 hours for PFAs. After receiving the certificate of registration, the company must request registration for VAT purposes (if turnover exceeds 300,000 lei/year) and obtain the qualified digital certificate for issuing electronic invoices (RO e-Factura).

Regulatory framework, specific permits and control institutions

For CAEN 6310, the main legal framework is Law 365/2002 on electronic commerce, Law 190/2018 on the protection of personal data (GDPR), and Government Emergency Ordinance 111/2011 on electronic communications. No permit from the National Authority for Administration and Regulation in Communications (ANCOM) is required for simple data processing or web page administration, but if the activity involves hosting services that are not merely ancillary, then notification to ANCOM is required under Art. 14 of GEO 111/2011. Compliance with the GDPR is supervised by the National Supervisory Authority for Personal Data Processing (ANSPDCP). For data processing activities, there must be a legal basis under the GDPR (consent, contract, legitimate interest), and the operator is obliged to keep a record of processing activities. The fiscal control institution is ANAF, which verifies compliance with tax obligations, including correct declaration of income and proper use of the e-Factura and e-Transport systems. In case of an audit, supporting documents for each transaction are requested: service contracts, invoices, bank statements, sales ledgers. Primary documents must be kept for 10 years under the Fiscal Code (Art. 26).

Tax management, ANAF audit risk and specific accounting

From a tax perspective, income from CAEN 6310 falls under service provision, subject to corporate income tax (16%) or microenterprise income tax (1% or 3% if exceeding EUR 500,000). For microenterprises, the conditions are: at most 1 employee (as of October 2023), turnover under EUR 500,000 and share capital under RON 500,000. Tax is paid quarterly. VAT: the standard rate of 19% applies to electronic services (data processing, web administration). If services are exported to taxable persons in the EU or non-EU, a 0% VAT rate applies, provided the client's valid VAT code is held and documents proving the actual provision are available. Major risk of ANAF audit: incorrect declaration of income – e.g., failure to invoice all received amounts (cash or cryptocurrency payments) or lack of service contracts. ANAF can conduct cross-checks using information from banks or clients, under the SAF-T system. Specific accounting: recording expenses for energy, software licenses, hosting services, salaries of programmers/administrators. It is necessary to prepare monthly trial balances, and declarations 100, 300 (VAT) and 112 (social contributions). For employees, monthly obligations include: social insurance contribution (CAS), health insurance contribution (CASS) and income tax (10%). If own servers are used, their depreciation must be recorded over the normal useful life (3-5 years). Also, for large-scale data processing activities, hiring an external DPO (Data Protection Officer) service is recommended for GDPR compliance.