Privacy Policy
This policy explains which personal data we process through the radicalprotect.ro website, why, on what legal basis, how long we keep it, to whom we disclose it and what rights you have. It applies to website visitors, to people who send us requests and to participants in Radical.PROTECT Academy courses.
1. Who the controller is
The controller is Radical Vision Soft SRL, with its registered office in Sibiu, Str. Gladiolelor, Bl. 7, Sc. B, Ap. 108, Romania, tax identification number (CUI) 47024127, registered with the Trade Register under no. J32/29/2022 (“Radical.PROTECT”, “we”).
For any question or request concerning personal data, write to us at privacy@radicalprotect.ro. We have not appointed a data protection officer, as the law does not require us to; requests sent to this address are handled directly by the company’s management.
2. Our principles
- We collect only the data needed for the purpose for which you provide it.
- We do not sell data and do not use it for targeted advertising.
- We do not use marketing cookies, tracking pixels, profiling or third-party analytics tools.
- We do not store IP addresses when forms are submitted, with consents or in statistics.
- The website and its data are hosted on our own servers, in Romania.
3. What data we process, for what purpose and on what legal basis
The legal bases are those in Article 6(1) of Regulation (EU) 2016/679 (GDPR): (a) consent; (b) performance of a contract or steps taken at your request prior to entering into a contract; (c) a legal obligation; (f) our legitimate interest, which we have balanced against your rights.
3.1 Contact form
Data: the subject, your name, email address, phone number (optional), the organisation and its type (for some subjects) and your message. Purpose: to answer your request. Legal basis: Article 6(1)(b), when you contact us on your own behalf, and Article 6(1)(f), our legitimate interest in answering people who write to us on behalf of an organisation. Please do not send us sensitive data (for example, health data) or passwords in your message.
3.2 Free Audit with appointment
Data: the time slot chosen, your name, the organisation and its type, your phone number and email address. Purpose: scheduling the phone call with a consultant, confirming the appointment (with an .ics calendar file) and sending reminders 24 hours and one hour before. The consultant receives the appointment details in order to call you. The appointment becomes final only once you confirm it through the link sent to you by email; an appointment not confirmed in time expires, and its data are deleted automatically after 30 days. Legal basis: Article 6(1)(b) and (f).
3.3 Professional Audit, Radical.CORE orders and quote requests
Data: your name, the organisation and its type, your email address and phone number and, as applicable, your job title, locality, the organisation’s tax identification number, the package and options chosen and your message. Purpose: analysing the request, preparing an offer and preparing the contract. Legal basis: Article 6(1)(b) and (f). Radical.CORE is licensed under a separate contract and licence agreement (EULA), which contain their own data protection provisions.
3.4 Online Free Audit (full and Express)
Data about you: first name, last name, email address, phone number and, optionally, your job title. Data about the organisation: tax identification number (CUI), name, address, county and Trade Register number. Your answers to the questions, with the history of changes, and the source through which you reached the audit (for example, a QR code).
Purpose: providing the audit and sending the PDF report to your email address. Legal basis: Article 6(1)(b), performance of the service you request, under the Terms and Conditions. The checkboxes at the start of the audit confirm that you have read this policy and accept the Terms; we keep the version of each document and the time of acceptance, without the IP address.
Pre-filling the organisation’s data: we send the public service of the Romanian Tax Administration (ANAF) only the tax identification number entered and retrieve the organisation’s public data (name, address, registration number, county). Legal basis: Article 6(1)(f), our legitimate interest in avoiding input errors.
The level shown in the report is calculated automatically, using fixed rules, and concerns the organisation, not you as a person. The report is generated from templates, without artificial intelligence. We do not take decisions based solely on automated processing that produce legal effects concerning you.
3.5 Radical.PROTECT Academy
Quote and enrolment requests: the type of request, the course, the group, the number of participants, your name, the organisation and its type, your email address, phone number (optional) and message. Legal basis: Article 6(1)(b) and (f).
Course participants: name, organisation and, optionally, email address, group, assessment results (date, percentage obtained, any technical interruptions), diploma number and the personal Academy ID. This data is usually provided to us by the organisation that enrols you. Purpose: organising the course, assessment, issuing the diploma and confirming its authenticity upon request. Legal basis: Article 6(1)(b), the contract with the organisation or with you, and Article 6(1)(f), our legitimate interest in keeping records of assessments and diplomas issued.
Courses are held live, online, via Zoom or Microsoft Teams. The platform displays the name under which you join the session and processes your data under its own privacy policy.
Course 0 (free): your email address, the format chosen (PDF or EPUB) and the source. Purpose: only keeping a record of downloads. Legal basis: Article 6(1)(f), our legitimate interest in keeping a record of the materials distributed. We do not use this address for commercial messages and do not add it to the newsletter list; you receive the newsletter only if you subscribe separately.
3.6 Newsletter
Data: email address, language, subscription source and consent history (version of the text accepted, time of confirmation or unsubscription). Subscription uses double opt-in: you receive an email and confirm with a button. Legal basis: Article 6(1)(a), consent, which you may withdraw at any time using the unsubscribe link in every email. We do not track email opens or clicks.
3.7 Cookies and statistics
We use only the cookies described in the Cookie Policy. Your cookie choice is stored in a cookie and, as proof, on the server, with a random identifier, the version, the categories chosen and the time, without the IP address.
Website statistics are aggregated per day only (for example, the number of visits per page, language, country, device type, source). They use no cookies or identifiers and do not store IP addresses. Browser statistics are collected only if you accept the “Statistics” category. The country is determined on our server from an offline database (DB-IP Lite), without the IP address being sent to anyone else or stored. Legal basis: Article 6(1)(f) for the momentary use of the IP address; the aggregated result no longer allows anyone to be identified.
3.8 Security
To protect the website against abuse, we temporarily use the IP address to limit the number of requests and for invisible anti-bot checks, without CAPTCHA. This data is kept only in the server’s memory, for a few minutes. The web server’s technical logs may contain the IP address, date and time, the page requested and the browser type. Legal basis: Article 6(1)(f), our legitimate interest in ensuring the security and operation of the website.
4. How long we keep data
| Data | Period |
|---|---|
| Requests submitted through forms (contact, Professional Audit, orders, quotes, Academy requests) | until the request is closed and then for no more than 3 years (the general limitation period); if a contract follows, for the term of the contract and then in accordance with the statutory archiving periods |
| Free Audit appointments | no more than 1 year after the date of the call, unless a request or contract follows |
| Free Audit appointments not confirmed through the link in the email (expired) | deleted automatically after 30 days |
| Unfinished online Free Audit (draft) | can be resumed for 30 days; deleted within 6 months at the latest |
| Completed online Free Audit and PDF report | 3 years after completion |
| Academy participants without a diploma | 3 years after the end of their last group |
| Assessment results and diplomas | 10 years after issue, to confirm the diploma’s authenticity |
| Course 0 downloads | 2 years |
| Unconfirmed newsletter subscription requests | deleted automatically after 30 days |
| Newsletter subscribers | until unsubscription; then the address and consent history for 3 years, as proof |
| Proof of the cookie choice | 3 years |
| Server technical logs | no more than 30 days |
| Aggregated statistics | unlimited (not personal data) |
We periodically review the data we hold and delete or anonymise it when these periods expire. We may keep it longer only where the law requires us to or for the establishment, exercise or defence of legal claims.
5. Who we disclose data to
- Our email provider, in the European Union, which sends operational emails and the newsletter, as a processor, under a contract.
- The consultants who hold the Free Audit calls and the Academy instructors, who are bound by confidentiality.
- Zoom Communications, Inc. or Microsoft (Teams), for the live course sessions.
- ANAF, which receives only the organisation’s tax identification number, when the online audit is pre-filled.
- Public authorities, only where the law requires us to.
We do not sell or rent personal data.
6. Transfers outside the European Economic Area
The website does not transfer data outside the EEA. For live sessions, Zoom or Microsoft may also process data in the United States; such transfers are based on the EU-US Data Privacy Framework (the European Commission’s adequacy decision of 10 July 2023), under which these providers are certified, or on standard contractual clauses.
7. Your rights
Under the GDPR, you have the right:
- of access to your data and to receive a copy of it;
- to rectification of inaccurate or incomplete data;
- to erasure (“right to be forgotten”), under the conditions laid down by law;
- to restriction of processing;
- to portability of the data you have provided to us, where processing is based on consent or contract and is carried out by automated means;
- to object to processing based on legitimate interest, including, at any time, to any processing for direct marketing purposes;
- to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal;
- not to be subject to a decision based solely on automated processing that produces legal effects concerning you.
To exercise your rights, write to us at privacy@radicalprotect.ro. We reply within one month at the latest; this period may be extended by two further months for complex or numerous requests, in which case we will let you know. We may ask you for additional information to confirm your identity.
You have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, postal code 010336, Romania, www.dataprotection.ro, anspdcp@dataprotection.ro. Please contact us first; we try to resolve any issue quickly.
8. How we protect data
- an encrypted connection (HTTPS) across the whole website;
- our own servers, in Romania, with separate networks and backups;
- website administration is accessible only from the internal network, with two-step authentication;
- access to data only for the people who need it, with a log of administrative operations;
- access tokens (for example, for resuming the online audit or confirming the newsletter) are stored only as a cryptographic fingerprint;
- collection of a minimum amount of data and no tracking tools.
If a personal data breach occurs that may affect your rights, we notify ANSPDCP and, where the law requires, we also inform you.
9. Children
Our services are intended for organisations and adults. We do not knowingly collect data about children under 16. If you become aware that a child has sent us data, write to us and we will delete it.
10. Changes to this policy
We may update this policy when our services, the law or the way we process data change. Each version has a number and an effective date, shown at the top of the page. For significant changes we will inform you on the website and, where appropriate, ask for your consent again.
This English version is a translation of the Romanian version; in case of discrepancy, the Romanian version prevails.