Form 230 in your app: how we put Romanian tax-deduction donations into a native mobile flow

If you run a Romanian non-profit and you're not collecting Form 230 every year, you are leaving real money on the table. Romanian individuals can redirect 3.5% of their annual income tax to a registered NGO simply by submitting Form 230 to ANAF — at no cost to them, with the full amount going to the cause they support.

The catch: most NGOs collect that form on paper at street stalls, or via a PDF that the donor must download, fill, sign, scan, email back, and pray nobody loses. That conversion funnel is exactly as bad as it sounds.

We rebuilt that flow inside a real mobile app — the native iOS and Android apps for an independent newsroom. Here is what we learned, end-to-end.

What Form 230 actually requires

Form 230 ("Cerere privind destinația sumei reprezentând până la 3,5% din impozitul anual") is the standardized ANAF declaration through which an individual taxpayer earmarks part of their income tax for a chosen non-profit. The data required is short, but every field must be exactly right:

Full name, CNP (Romanian personal numerical code), domicile address
The non-profit's official name, fiscal code (CIF), bank account (IBAN)
Year of declaration
Optionally: a multi-year designation (up to 2 years)

The non-profit then bundles received forms into borderouri (batch-cover declarations) and submits them to ANAF, which transfers the redirected amounts to the NGO's account.

The mobile UX we shipped

The donor opens the app, taps "Redirecționează 3,5%", and the flow is three screens:

Identity — pre-filled with whatever the user already gave us (we store the minimum: name + email + CNP encrypted at rest); editable; clear copy explaining why each field is needed
Confirmation — a pixel-accurate preview of the generated PDF, with a "what happens next" section that says, in plain Romanian, exactly what we will do with this form
Sign — finger or stylus signature on the device, captured into the PDF, finalized, encrypted, and uploaded

That's it. Forty-five seconds, no leaving the app, no email pong, no "scan and send back".

Engineering details that mattered

Generating ANAF-compliant PDFs on the server

We do not generate the PDF on-device. The user-facing preview is a faithful render, but the legal artifact is generated server-side from the same template ANAF would accept on paper. This way:

The signed PDF is byte-identical regardless of which OS the user is on
The NGO's fiscal data is fetched from a single canonical place, not duplicated in two app bundles
Template updates (and ANAF will update the template, possibly mid-tax-season) ship without an App Store / Play Store release

CNP — the most sensitive field on the form

The Romanian personal numerical code is a 13-digit identifier that encodes gender, date of birth, county of birth, and a checksum. It is personal data under GDPR Article 4(1) and Romanian Law 190/2018, and it must be treated as such.

What we do:

Validate before sending — checksum and date-of-birth coherence on-device, so the user fixes typos before they touch the network
Encrypt at rest at the application level (not just disk encryption) using a key managed by the platform Keychain / Keystore
Minimize retention — once the borderou is filed at ANAF, we keep only the minimum required by Romanian fiscal law for audit purposes
Audit trail every access — every read of a CNP field is logged with actor, timestamp, and reason

Signature capture that holds up legally

The signature is captured as a vector path inside the PDF, not as a flat raster. This preserves intent (you can show in court that the strokes were drawn, not pasted), and the signed PDF includes a SHA-256 fingerprint of the signed bytes that is logged server-side.

Generating borderouri at scale

Once a wave of Form 230 submissions accumulates, the NGO has to file borderouri — batch declarations that cover the individual forms. We built a server-side generator that:

Buckets accepted forms by reporting period
Produces signed PDFs in the official format
Cross-references each row against the original signed declaration so any audit can be answered in minutes, not days
Persists everything in an immutable file tree the accounting team can mirror to their backup

We literally have folders called Trimise, Recipise, Borderouri semnate, Erori — boring, durable, defensible.

The compliance posture

A flow like this lives or dies on its GDPR and fiscal-law posture. The short version of ours:

Lawful basis: explicit consent (Article 6(1)(a)) for the processing of identity data for the purpose of submitting Form 230 on the donor's behalf
Special category data: Romania does not classify CNP as a "special category" under Article 9, but national law treats it as a national identification number under Article 87 GDPR + Law 190/2018. We respect those constraints
Data Processing Agreement with the NGO (we are the processor; the NGO is the controller)
Right to erasure honored on request, except where Romanian fiscal law requires retention for the audit period
No third-country transfers — the data stays within the EU

If you're building this and you're not GDPR-fluent, hire someone who is before you write a line of code. Putting it in afterwards is more expensive than building it correctly the first time.

Why this matters

Every Form 230 submission that lands at ANAF is real funding that didn't have to come from the donor's pocket. For an independent newsroom that runs on reader support, every additional 1% conversion at this step compounds annually for years.

If you run an NGO that's not yet collecting Form 230 inside your own product surfaces, your fundraising stack is leaking money. We can help you fix that.