1. Who We Are
This Privacy Policy applies to hudesa-xapodu.info, operated from Buzesti 82-94, Tiriac Tower, Bucharest, Romania. We are the data controller for all personal data collected through this website. Contact for data protection matters: [email protected] or by post at the address above.
This policy is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR"), as implemented in Romania, and with Law No. 190/2018 on measures to implement Regulation (EU) 2016/679.
2. Data We Collect
We collect personal data in the following circumstances:
2.1 Contact Form. When you submit the contact form on this website, we collect: your full name, email address, phone number, and the content of your message. Submission of this form is voluntary.
2.2 Cookies and Technical Data. When you visit the website, our server and any analytics or advertising tools we have enabled may collect: IP address (anonymized where technically feasible), browser type and version, operating system, referral URL, pages visited, and time spent on pages. See Section 5 for details on cookie use.
2.3 Data You Provide During Course Participation. If you enroll in a course, we collect enrollment-related information including name, email address, and any calendar or workflow materials you voluntarily share as part of course exercises. Such materials are used exclusively for the purposes of delivering the course.
We do not collect sensitive personal data (as defined under Article 9 GDPR) and do not request such data through any channel.
3. Legal Basis for Processing
We process personal data only where a lawful basis exists under Article 6 GDPR:
Consent (Art. 6(1)(a)): For non-essential cookies and for any marketing communications, where you have given explicit, informed consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
Contractual necessity (Art. 6(1)(b)): For processing necessary to deliver a course you have enrolled in or to respond to a pre-contractual inquiry submitted via our contact form.
Legitimate interests (Art. 6(1)(f)): For website security, fraud prevention, and basic analytics that help us understand how the site is used and improve its content. Our legitimate interests are balanced against your rights and freedoms; we have assessed that these interests do not override data subjects' fundamental rights.
Legal obligation (Art. 6(1)(c)): Where Romanian or EU law requires us to retain or disclose certain data.
4. How We Use Your Data
Personal data collected through the contact form is used exclusively to: respond to your inquiry, follow up on a requested introductory call, and, where relevant, process enrollment into a course. We do not use contact form data for unsolicited marketing without separate consent.
Course participation data is used to: deliver module content, facilitate group sessions, and improve the course curriculum based on aggregated, anonymized patterns. Individual calendar materials shared during exercises are never shared with other participants or third parties.
Technical data collected through cookies is used to: maintain website security, monitor site performance, and, where consent has been given, analyze visitor behavior to improve content and user experience.
5. Cookies
This website uses cookies as described in detail in our Cookie Policy. Strictly necessary cookies are placed without consent as they are required for the website to function. All other cookies — including analytics and advertising cookies — are placed only after you have given explicit consent through our cookie consent banner.
You may manage, modify, or withdraw cookie consent at any time by clicking the "Cookie settings" link in the site footer or by adjusting your browser settings. Withdrawing consent for non-essential cookies does not affect your ability to access the website.
6. Third-Party Processors and Transfers
We may share data with trusted third-party service providers who act as data processors on our behalf. All processors are bound by data processing agreements that require them to handle data in accordance with GDPR. Categories of processors include: email service providers, video hosting services for course content, and website hosting providers.
Where any processor is located outside the European Economic Area, we ensure appropriate safeguards are in place in accordance with Chapter V GDPR, including Standard Contractual Clauses approved by the European Commission or other appropriate transfer mechanisms.
We do not sell personal data to third parties.
7. Data Retention
Contact form submissions are retained for up to 24 months from the date of submission, unless a longer retention period is required by law or by the ongoing nature of a contractual relationship. Course enrollment data is retained for the duration of the enrollment and for up to 36 months following the end of course access, to handle any post-course inquiries or disputes.
Technical log data is retained for a maximum of 12 months. Cookie consent records are retained for a period sufficient to demonstrate compliance, typically 13 months.
When data is no longer required, it is securely deleted or anonymized.
8. Your Rights Under GDPR
As a data subject within the European Union, you have the following rights under the GDPR, which we are committed to honoring:
Right of access (Art. 15): You may request a copy of the personal data we hold about you.
Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 17): You may request deletion of your data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other lawful basis applies), or where you object to processing and there are no overriding legitimate grounds.
Right to restriction (Art. 18): You may request that we limit how we use your data in certain circumstances.
Right to data portability (Art. 20): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
Right to object (Art. 21): You may object to processing based on legitimate interests at any time. We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
To exercise any of these rights, contact us at [email protected]. We will respond within one month of receiving a verifiable request, as required by Art. 12 GDPR. If the request is complex or numerous, we may extend this period by a further two months and will notify you accordingly.
You also have the right to lodge a complaint with the Romanian supervisory authority, the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP), at www.dataprotection.ro.
9. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, or alteration, in accordance with Art. 32 GDPR. These measures include: encrypted data transmission via HTTPS, access controls limiting data access to authorized personnel, and regular review of security practices.
No method of electronic transmission or storage is fully secure. We cannot guarantee absolute security but are committed to protecting data using industry-standard practices and to notifying affected individuals and the ANSPDCP in the event of a data breach as required by Arts. 33-34 GDPR.
10. Children's Data
This website and its services are directed at adults. We do not knowingly collect personal data from individuals under the age of 16. If you become aware that a child has submitted personal data to us without parental consent, please contact us at [email protected] and we will delete such data promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The date at the top of this page indicates when the policy was last revised. We encourage you to review this page periodically. Material changes will be communicated through a notice on the website homepage.
12. Contact and Supervisory Authority
For all data protection inquiries, contact us at: [email protected] or by post at Buzesti 82-94, Tiriac Tower, Bucharest, Romania.
If you are not satisfied with our response, you have the right to escalate your concern to the Romanian national supervisory authority:
Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest 010336, Romania
[email protected] | www.dataprotection.ro