Legal · Last updated · Also available in Romanian
Privacy policy
1. Who is responsible for your data
Qidora S.R.L., registered office Aleea Slt. Adrian Cârstea nr. 13, bl. 37, sc. 2, et. 8, ap. 141, Sector 3, 031838 Bucharest, Romania, Trade Register no. J2026017988007, tax ID (CUI) 54283607 (“Qidora”, “we”) is the controller of the personal data described in this policy: data from visitors to this website, from people who write to us or apply for a job, and from the contact persons of our clients.
We process personal data under Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and Law no. 190/2018, which implements it in Romania.
Contact for data protection questions: contact@qidora.com, or by post at the registered office. We have not appointed a data protection officer.
2. Data we process for our clients
When we host a website, run a campaign or provide another service for a client, we may process personal data on the client’s behalf, for example the data of the people who visit the client’s website. For that data we are a processor (Art. 28 GDPR): the client is the controller, decides how the data is used, and its own privacy policy applies.
We sign a separate data processing agreement with each client, based on the client’s needs and requirements. This policy does not cover that data. If you have a question about it, contact the organisation concerned.
3. What data we process, why, and on what legal basis
| Activity | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Email and phone | Name, organisation, email address, phone number, the content of your message | Answering your request and preparing an offer | Art. 6(1)(b), steps before a contract; Art. 6(1)(f), legitimate interest in answering enquiries |
| WhatsApp, Telegram and Viber | Your phone number or user name, your profile name as the app shows it, the messages you send | Answering your request | Art. 6(1)(b); Art. 6(1)(f). Each app is run by its own provider, under its own terms and privacy policy |
| Job applications | Name, contact details, your message, your CV and the work you link to | Assessing your application | Art. 6(1)(b), steps you ask for before a contract |
| Clients | Name, role, business email and phone of our clients’ contact persons; offers, contracts, invoices and payments | Performing the contract, invoicing and accounting | Art. 6(1)(b), the contract; Art. 6(1)(f), legitimate interest in working with the people a client names; Art. 6(1)(c), legal obligations under Romanian accounting and tax law |
| Website operation and security | IP address and the technical data your browser sends with each request, such as the page requested and the browser version | Delivering the pages to you and keeping the site secure | Art. 6(1)(f), legitimate interest in a working, secure website |
| Legal claims | The data relevant to a dispute, for example messages and offers | Establishing, exercising or defending legal claims | Art. 6(1)(f), legitimate interest in protecting our rights |
We receive most of this data from you. The details of a client’s contact persons may also come from the client organisation they work for.
Where we rely on legitimate interest, that interest is answering the people who write to us, working with the people our clients name, keeping this website secure and protecting our rights. You can object at any time (see section 9).
Please do not send us health data or other special categories of data (Art. 9 GDPR), your personal numeric code (CNP) or a copy of your identity card, in a message or in a job application. If you do, we use it only to answer you and delete it as soon as it is no longer needed.
4. Whether you have to provide data
You are not obliged to give us any data. Without contact details we cannot answer a request or assess a job application. For clients, the data needed for the contract and for invoices is a contractual requirement, and Romanian tax law requires it on invoices; without it we cannot work together.
5. Who receives your data
We use these service providers, who process data on our behalf and only on our instructions (processors), under a data processing agreement (Art. 28 GDPR):
- statichost.eu (Sweden), which hosts this website;
- Infomaniak (Switzerland), for our email and file storage.
Where needed, our accountant, lawyers or auditors also see data. They are bound by confidentiality.
If you write to us on WhatsApp, Telegram or Viber, the app’s provider processes your messages as a separate controller, under its own terms and privacy policy.
We do not sell personal data. We disclose data to authorities and courts only where the law requires it (Art. 6(1)(c)) or to defend a legal claim.
6. Transfers outside the EU/EEA
This website is hosted in the European Union. Our email and files are stored by Infomaniak in Switzerland, a country for which the European Commission has adopted an adequacy decision (2000/518/EC), so no further safeguards are needed. We do not transfer personal data to any other country outside the EU/EEA. If that changes, we will update this policy first and rely on an adequacy decision or on the EU Standard Contractual Clauses.
7. How long we keep data
We keep data only as long as its purpose needs it, or longer where a law requires it. Then we delete or anonymise it.
- Enquiries that do not lead to a contract: two years after the last contact.
- Job applications: at most six months from when we receive them. If we offer you a contract, the documents needed for it move to your contract file.
- Clients: contact persons’ details for the duration of the contract; contracts, invoices and accounting records for the periods required by Romanian tax and accounting law.
- Data for legal claims: until the claim is settled and the limitation period has passed, which is three years as a rule.
- Data needed to deliver the pages, such as your IP address: we do not store it, and our hosting provider uses it only to send you the pages and does not keep it.
8. How we protect your data
Only the people who need data for their work can see it. We use encrypted connections (HTTPS) and access control.
If a personal data breach happens, we report it to ANSPDCP within 72 hours, unless it is unlikely to put anyone’s rights at risk. If the risk to you is high, we also tell you without undue delay (Art. 33 and 34 GDPR).
9. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have data erased (Art. 17);
- have processing restricted (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting earlier processing (Art. 7(3)).
To use these rights, write to contact@qidora.com. It is free, unless a request is clearly unfounded or excessive. We may first ask you to confirm your identity, so that we do not give your data to someone else. We reply within one month. For complex or many requests we can extend this by two more months; if we do, we tell you within the first month (Art. 12 GDPR).
10. Complaints
You can lodge a complaint with the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro, or with the authority in the EU country where you live or work.
11. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you (Art. 22 GDPR).
12. Cookies
How this site uses cookies and similar storage is described in the cookie policy.
13. Changes to this policy
We update this page when our processing changes. The date of the last update is shown at the top.