GDPR & Privacy Policy
1. General Information
This Privacy Policy describes how SC Simplix QWERTY SRL, a company registered in Romania under trade registry number J10/25/2017, fiscal identification code (CUI) 36902772, with its registered office at Str. Scolii 64A, Plesesti, com. Berca, jud. Buzau, Romania (the "Company", "we", "us"), collects, uses, stores, and protects personal data in connection with the software platform dunDesk, available at dundesk.com (the "Service").
For the purposes of Regulation (EU) 2016/679 ("GDPR") and applicable Romanian data protection legislation, the Company acts as a data controller with respect to the personal data of the Service's users. Where users upload or process personal data of third parties within the Service (e.g., data of their own clients), the Company acts as a data processor on behalf of the respective user, who remains the controller of that data.
This Policy applies to all users of the Service, including during the beta period. Please read it together with the Terms of Service.
2. Categories of Personal Data We Process
Depending on how you use the Service, we may process the following categories of personal data:
Account and identification data: name, surname, e-mail address, username, password (stored in encrypted/hashed form), and, where applicable, telephone number, company name, position, and other details provided at registration or in your profile;
Communication data: the content of messages and requests submitted through the ticketing (support) system available within the Service, together with the related metadata (date, time, status);
Technical and usage data: IP address, browser type and version, operating system, device type, language settings, pages accessed, actions performed within the Service, timestamps, error logs, and security logs;
Cookie and similar-technology data: as described in Section 8;
Content data: personal data that may be contained in the files, records, or content you upload or generate within the Service ("User Content"). For such data, you act as controller and we act as processor;
Feedback data: information contained in bug reports, suggestions, or evaluations submitted during the beta program.
We do not intentionally collect special categories of data (e.g., health data, biometric data, data revealing racial or ethnic origin, political opinions, or religious beliefs), unless you voluntarily include such data in your User Content, in which case you are responsible for having a legal basis to do so.
3. Purposes and Legal Bases of Processing
We process personal data for the following purposes and on the following legal bases:
Creating and managing your account, providing the Service — legal basis: performance of the contract (Art. 6(1)(b) GDPR);
Providing support through the ticketing system — legal basis: performance of the contract (Art. 6(1)(b) GDPR);
Operating, testing, debugging, and improving the beta Service, including analyzing errors, performance, and usage patterns — legal basis: our legitimate interest in developing a functional, secure, and high-quality product (Art. 6(1)(f) GDPR);
Ensuring the security of the Service, preventing fraud, abuse, and unauthorized access, maintaining security logs — legal basis: our legitimate interest (Art. 6(1)(f) GDPR) and, where applicable, legal obligations;
Communicating important information about the Service (changes to features, terms, security incidents, termination of the beta) — legal basis: performance of the contract and our legitimate interest (Art. 6(1)(b) and (f) GDPR);
Complying with legal obligations (e.g., accounting, tax, responding to requests from public authorities) — legal basis: legal obligation (Art. 6(1)(c) GDPR);
Establishing, exercising, or defending legal claims — legal basis: our legitimate interest (Art. 6(1)(f) GDPR);
Optional communications or non-essential cookies, where applicable — legal basis: your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
We do not use personal data for automated decision-making producing legal effects or similarly significant effects on you, and we do not sell personal data to third parties.
4. Data Processed in the Context of the Beta Program
The Service is provided as a beta version, for testing and evaluation purposes. In this context:
we may process detailed technical logs and diagnostic data to identify and fix errors;
feedback and bug reports you submit may be analyzed and stored for product development purposes;
we recommend that you do not enter into the Service real personal data that is sensitive or critical, whenever test data can be used instead, given the inherent risks of a beta version (as described in the Terms of Service).
5. Recipients of Personal Data
Personal data may be disclosed, strictly to the extent necessary, to the following categories of recipients:
Service providers (processors) acting on our behalf and under our instructions, such as: hosting and infrastructure providers, e-mail delivery providers, backup and monitoring providers. These providers are contractually bound to ensure the confidentiality and security of the data;
Professional advisors (lawyers, accountants, auditors), where necessary;
Public authorities and institutions, where disclosure is required by law or necessary for the protection of rights;
Successors in the context of a reorganization, merger, or transfer of business, subject to appropriate confidentiality safeguards.
We do not disclose personal data to third parties for their own marketing purposes.
6. Transfers Outside the EU/EEA
As a rule, personal data is stored and processed on servers located in the European Union / European Economic Area. If certain providers involve a transfer of data outside the EU/EEA, we will ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR (e.g., an adequacy decision of the European Commission or the Standard Contractual Clauses), and further information can be obtained through the ticketing system available within the Service.
7. Retention Periods
We retain personal data only for as long as necessary for the purposes for which it was collected:
Account data: for the duration of the account's existence and for a reasonable period after its closure (as a rule, no more than 90 days, unless the law requires or permits a longer period);
User Content: for the duration of the account's existence; after account closure or termination of the beta program, it may be permanently deleted after a reasonable period, as described in the Terms of Service;
Support (ticketing) data: for the period necessary to resolve requests and for a subsequent period justified by service history and legal claims;
Technical and security logs: for limited periods, proportionate to security and debugging purposes;
Data subject to legal retention obligations (e.g., financial and accounting documents): for the periods required by applicable law.
Upon expiry of the retention periods, data is deleted or irreversibly anonymized.
8. Cookies and Similar Technologies
The Service uses cookies and similar technologies as follows:
Strictly necessary cookies: required for the operation of the Service (e.g., authentication, session maintenance, security, load balancing). These do not require consent;
Preference cookies: retain settings such as language or interface options;
Analytics/performance cookies, where used: help us understand how the Service is used, in order to improve it. Where legally required, such cookies are used only with your consent, which you can manage through the Service's cookie settings.
You can also control cookies through your browser settings; however, disabling strictly necessary cookies may make the Service unusable.
9. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction, including: encrypted connections (HTTPS/TLS), password storage in hashed form, access control and the least-privilege principle, activity logging, backup copies, and periodic infrastructure updates.
Nevertheless, please note that no system is completely secure and that, given the beta nature of the Service, the level of maturity of security measures may evolve. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority in accordance with Articles 33 and 34 of the GDPR.
10. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
Right of access — to obtain confirmation as to whether we process your data and a copy of that data;
Right to rectification — to have inaccurate data corrected and incomplete data completed;
Right to erasure ("right to be forgotten") — to obtain the deletion of data, under the conditions of Art. 17 GDPR;
Right to restriction of processing — in the situations provided by Art. 18 GDPR;
Right to data portability — to receive data provided by you in a structured, commonly used, machine-readable format and to transmit it to another controller;
Right to object — to processing based on legitimate interest, on grounds relating to your particular situation;
Right to withdraw consent — at any time, for processing based on consent, without affecting the lawfulness of processing carried out before withdrawal;
Right not to be subject to automated individual decision-making, including profiling, producing legal or similarly significant effects;
Right to lodge a complaint with the supervisory authority: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro — as well as the right to address the courts.
To exercise these rights, please submit a request through the ticketing (support) system available within the Service. We will respond within one month of receiving the request; this period may be extended by two further months where necessary, in which case you will be informed. We may request additional information to verify your identity.
11. Children's Data
The Service is not intended for persons under the age of 18, and we do not knowingly collect personal data from minors. If we become aware that we have collected data of a minor without an appropriate legal basis, we will delete it as soon as possible. If you believe that a minor has provided us with personal data, please notify us through the ticketing system available within the Service.
12. User Content Containing Third-Party Data
Where you upload or process, within the Service, personal data relating to third parties (e.g., your own clients, collaborators, or employees), you act as controller of that data and we act as processor. In this case:
you are responsible for having a valid legal basis for the processing and for informing the data subjects;
we process such data only on your documented instructions, resulting from the use of the Service's functionalities, and only for providing the Service;
we apply the security measures described in Section 9 and do not use such data for our own purposes;
upon closure of the account or termination of the beta, such data is deleted in accordance with Section 7.
13. Changes to This Policy
We may update this Privacy Policy periodically, in particular as the Service evolves during and after the beta period. In the event of material changes, we will notify you through the Service. The current version is permanently available within the Service and at dundesk.com. We encourage you to review this Policy regularly.
14. Contact
For any questions, requests, or complaints regarding the processing of personal data, the official contact channel is the ticketing (support) system available within the application.
Controller identification details:
Controller: SC Simplix QWERTY SRL, CUI 36902772, Trade Registry No. J10/25/2017
Registered office: Str. Scolii 64A, Plesesti, com. Berca, jud. Buzau, Romania
Website: www.simplix.ro
Supervisory authority: National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania — www.dataprotection.ro