Privacy Policy

1. Who is responsible for your data

This Privacy Policy explains how Simplix QWERTY S.R.L. (registered no. J10/25/2017, tax identification no. 36902772, Str. Școlii 64A, Pleșești, com. Berca, jud. Buzău, România — the "Operator", "we") collects and uses personal data when you use the platform dunDesk (the "Platform"). For the personal data described here, the Operator is the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 (the "GDPR").

We have not appointed a data protection officer, as the law does not require one for our activity. For anything about your personal data, use the Privacy section of your profile page (most requests are handled there automatically — see section 8) or open a support ticket inside the Platform. Without an account, write to contact@simplix.ro.

Where a Workspace (an organisation created on the Platform) processes the personal data of its own members, pupils, customers or contacts through the Platform, that Workspace decides why and how the data is processed and is the controller of it; the Operator processes it on the Workspace's behalf. The Data Processing Notice describes that relationship.

2. What data we collect

• Account data: name, e-mail address, password (stored only as a cryptographic hash), preferred language, profile settings, the roles and Workspaces you belong to.
• Registration and security data: verification codes sent to your e-mail, sign-in dates, session identifiers, IP addresses and browser information used to secure your Account.
• Workspace data: the details you enter about your organisation (name, identification numbers, address, contact), its members and their roles, the spaces it creates.
• Content: the files, texts and other material you upload or create, including the people they may describe.
• Payment data: the plans you purchase, amounts, dates, invoices, the identifiers our payment provider returns. Card details are entered directly with the payment provider (Stripe); we never receive or store your full card number.
• Support and communication data: the support tickets you open, their messages and attachments, the notifications and e-mails we send you.
• Consent records: which document versions you accepted, when and from which address, and your marketing choice — kept as proof of consent.
• Technical logs: requests to the Platform (address, time, page or action, technical errors) that keep the Platform secure and working.

Most of this data comes from you. Some comes from Workspace owners who invite you or enter your details, or from our providers (for example the payment status from Stripe).

3. Why we use it and on what legal basis

• To provide the Platform — creating and securing your Account, running the Workspaces, delivering the features you use, processing your purchases and sending the service messages this requires (verification codes, password resets, invitations, notifications about your Account or Workspace). Legal basis: the performance of our contract with you (art. 6(1)(b) GDPR).
• To comply with the law — issuing and keeping invoices and accounting records, answering lawful requests of authorities, keeping proof of your consents. Legal basis: our legal obligations (art. 6(1)(c) GDPR).
• To keep the Platform secure and improve it — technical logs, abuse and fraud prevention, error analysis, statistics about how the Platform is used. Legal basis: our legitimate interest in a secure, reliable Platform (art. 6(1)(f) GDPR), balanced against your rights.
• To send you marketing messages — news, offers and information about the Platform, only if you agreed to it. Legal basis: your consent (art. 6(1)(a) GDPR), which you may withdraw at any time.

We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects.

4. Cookies

The Platform uses cookies that are strictly necessary for its operation: a session cookie that keeps you signed in, and functional cookies that store your preferences (for example your chosen language or the appearance of the interface). These cookies do not track you across other websites and require no consent. We do not use advertising cookies. Should a specific service built on the Platform use analytics or other cookies, its own terms and cookie notice describe them and ask for your consent where the law requires it.

5. Who receives your data

We share personal data only as needed to run the Platform, with:

• Workspace owners and members — the members of a Workspace see the data relevant to that Workspace (for example your name and e-mail as a member, the Content shared there).
• Our processors, who act on our instructions under written contracts: our hosting providers (servers located in the European Union); Stripe (payment processing); Cloudflare (content delivery, file storage and protection of the Platform); GetStream.io (real-time features such as chat or activity feeds, where a service uses them); our e-mail delivery provider.
• Authorities and advisers, when the law requires it or to establish, exercise or defend legal claims.
• A successor of the Platform, in case of a merger, acquisition or transfer of the business, who takes over these obligations.

We do not sell personal data.

6. Where your data is processed

The Platform is hosted in the European Union. Some providers (such as Stripe, Cloudflare or GetStream.io) may process data in other countries; where a transfer outside the European Economic Area takes place, it relies on an adequacy decision of the European Commission or on the standard contractual clauses approved by it, together with additional safeguards where needed. You may ask us for details through a support ticket.

7. How long we keep it

• Account and Workspace data, Content: for as long as your Account exists. After you request deletion, a short grace period applies (during which you may cancel the deletion), then the data is deleted or anonymised automatically.
• Accounting documents (invoices, payment records and the Workspace identification they belong to): 10 years, as Romanian accounting law requires. A Workspace with payment history is therefore kept in anonymised form for that period, detached from any person.
• Consent records: for as long as we need to prove that a consent existed — the records survive the deletion of the Account in a form that no longer identifies you beyond what the proof requires.
• Support tickets: for the life of your Account; after deletion, the messages are anonymised.
• Technical logs: 90 days, unless a security incident requires keeping specific entries longer.
• Verification codes and similar transient data: minutes to days.

8. Your rights, and what you can do yourself

Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format, to withdraw a consent at any time (without affecting the lawfulness of processing before the withdrawal), and to lodge a complaint with a supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or the authority of the country where you live.

Most of these rights are exercised directly from the Privacy section of your profile page, automatically and without waiting for us:

• Download your data — an export of everything the Platform holds about you, delivered as a protected download link sent to your e-mail.
• Delete your account — confirmed with a code; after the grace period, your data is deleted or anonymised automatically, across the Platform.
• Manage your consents — see the document versions you accepted, read exactly what you signed, and give or withdraw the marketing consent.
• Correct your data — edit your name, e-mail, language and settings from the profile page; Workspace details are edited by their owners.

For anything the profile page does not cover, open a support ticket; we answer within one month, as the GDPR requires (extendable for complex requests, in which case we tell you).

9. Security

We protect personal data with technical and organisational measures appropriate to the risk: encrypted connections, hashed passwords, access limited to what each role needs, separation between Workspaces, logging of security-relevant actions, and regular updates. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the authority as the law requires.

10. Children

Services offered through the Platform may be used by minors, for instance pupils enrolled by a school. Where the law requires it, the consent of a parent or legal guardian is obtained by the Workspace that enrols the minor, which remains responsible for it. Paid services are purchased only by adults or by the minor's parent or legal guardian.

11. Changes to this Policy

We may update this Policy to reflect changes in the Platform or in the law. Each version is dated; the current version is always available on the Platform, and the version you accepted is shown on your profile page. Where a change materially affects you, we ask for your renewed acceptance.

12. Contact

Simplix QWERTY S.R.L., Str. Școlii 64A, Pleșești, com. Berca, jud. Buzău, România. Signed-in Users: the Privacy section of your profile page and the support tickets. Without an account: contact@simplix.ro.