Privacy policy

By visiting www.graalsoft.ro, you signify your agreement to our Privacy Policy.

GRAALSOFT SRL is committed to protecting your privacy online. This Privacy Policy describes the personal information we collect through this website, www.graalsoft.ro (the „Site”), and how we collect and use that information.

The terms „we,” „us,” „our,” and „our” refer to GRAAL SOFT L.L.P. The terms „user,” „you,” and „yours” refer to Site visitors, customers, and any other users of the Site.

Definitions In this Privacy Policy, the following terms have the following meanings:

Personal Data: Information that can be used to identify a natural person, including, but not limited to, first name, last name, address, telephone number, email address, and any other information that, in combination with other data, can lead to the identification of the user.
Data processing: any operation or set of operations performed upon personal data, such as collection, storage, use, disclosure, alteration, modification, erasure or destruction.

Consent: User’s free, specific, informed and unambiguous agreement by which the User signifies his or her willingness to consent to the processing of personal data concerning him or her.

Profiling: Any form of automated processing of personal data consisting of the use of such data to evaluate personal aspects relating to an individual, in particular to analyze or predict aspects relating to an individual’s performance at work, economic situation, health, personal preferences, interests or behavior.

Users: Refers to all individuals who access or use our website, including visitors, customers and any other individuals who interact with us through the website.

Website: refers to the online platform www.graalsoft.ro, which is operated by GRAAL SOFT SRL.

Use of GRAAL SOFT SRL trademarks, including all materials presented here and all online services offered by GRAAL SOFT SRL, is subject to the following Privacy Policy. This Privacy Policy applies to all Site visitors, customers and all other users of the Site. By using the Site or the Service, you agree to this Privacy Policy, without modification, and acknowledge that you have read it.

On this Site, we only collect personal information that you voluntarily provide. This information may include, but is not limited to:

First and Last Name: Identifying details that allow us to contact you directly.
Email Address: Used for communication, updates, and offers.
Phone Number: Required for direct or urgent communication.
Demographic Information: Data such as age, gender, and location to better understand our audience and tailor our services.
Financial Information (only when necessary).

Purpose of Data Collection

The information we collect is used for the following purposes:

Transaction Processing: Ensuring the correct delivery of requested services and products.
Periodic Communications: Keeping you informed about news, special offers, and relevant service updates.
Service Improvement: Analyzing feedback to enhance user experience.
Fulfilling Contractual and Legal Obligations.
Market Research & Analysis: Improving our services based on audience insights.

Third-Party Disclosure

We collaborate with trusted third parties who assist in operating our website, conducting business, and providing services to customers and visitors.

GRAAL SOFT SRL will not disclose your personal data to third parties except:

To our partners who help provide services (e.g., payment processors, IT service providers).
To competent authorities when legally required.
In case of corporate transactions (e.g., mergers, acquisitions) as per applicable laws.
To other third parties, only with your prior consent.

All such third parties are contractually obligated to maintain the confidentiality of the information and use it solely for the specified purposes.

Data Retention

GRAAL SOFT SRL will store personal data only for the period necessary to fulfill the specified purposes, in compliance with legal archiving and other applicable legal obligations.

Once the retention period expires, the data will be deleted or anonymized.

To provide an optimized user experience, we collect and process information related to your activities on the Site. This information is essential for understanding user behavior and improving our services. Below are the details regarding the types of information we collect and how we manage them:

Collected Information

We gather data about your interactions with the Site, including visited pages, time spent on each page, accessed links, and used resources. This helps us analyze how the Site is used and identify areas for improvement.

Additionally, we collect technical data such as browser type, operating system, IP address, referring URL, and date and time of access. This information is essential for ensuring the proper functioning of the Site and identifying potential technical issues.

Legal Basis for Processing

In accordance with applicable laws, we process your personal data based on the consent you provide by using the Site. We may also use this information to enhance our services and tailor our offerings to user needs, based on our legitimate interest in providing an optimized experience.

Your Rights Under GDPR

In accordance with the General Data Protection Regulation (GDPR), individuals have essential rights that ensure transparency and control over their personal data. These rights include:

Right of Access

You can request information about your personal data that we hold, including:

A copy of the processed personal data;
Details about processing purposes, categories of processed data, recipients to whom the data was disclosed, and the estimated storage period.

Right to Rectification

You have the right to request the correction of any inaccurate or incomplete personal data, such as updating contact information or amending other personal details.

Right to Erasure

Under certain circumstances, you have the right to request the deletion of personal data, such as:

When the data is no longer necessary for the purpose for which it was collected;
When you withdraw your consent for processing.

It is important to note that there may be exceptions to this right, such as legal obligations to retain certain data.

Right to Restrict Processing

You may request the restriction of your personal data processing in the following situations:

You contest the accuracy of the data, allowing us time to verify its correctness;
You object to deletion but prefer restricted use instead;
We no longer need your data for processing, but you require it for establishing, exercising, or defending legal claims.

Right to Data Portability

You have the right to request the transfer of your personal data to another controller in a structured, commonly used, and machine-readable format, where technically feasible.

Right to Object

You can object to the processing of your personal data based on our legitimate interests or for direct marketing purposes. If you object to processing for marketing purposes, your data will no longer be used for that purpose.

Right to Lodge a Complaint

If you believe your personal data is being processed in violation of applicable laws, you have the right to lodge a complaint with the National Authority for the Supervision of Personal Data Processing or a competent court.

Right Not to Be Subject to Automated Decisions

You have the right not to be subject to automated processing that significantly affects you or has legal consequences. If such processing occurs, you are entitled to request human intervention in the decision-making process.

Data Retention Period

We will retain collected information only for the period necessary to fulfill the purposes for which it was collected, in accordance with the principle of data minimization. Once these purposes are no longer relevant, we will delete or anonymize your data in compliance with our data retention policy.

We may send cookies to your computer to uniquely identify your browser and enhance the quality of our services. The term „cookies” refers to small pieces of data that a website sends to your device’s hard drive while you browse the Site.

We use both:

Session cookies – which expire once you close your browser.
Persistent cookies – which remain on your device until manually deleted.

You have the option to accept or decline cookies through your browser settings. However, disabling cookies may cause certain areas of the Site to function improperly or not at all.

For more details, please refer to our Cookie Policy: https://graalsoft.ro/politica-de-cookies/

We are committed to maintaining the highest security standards to protect your personal information from unauthorized access, misuse, or disclosure. To achieve this, we have implemented various technical and organizational measures in compliance with ISO 27001 and GDPR, ensuring a secure and resilient environment for data protection.

Technical Measures

Personal data is encrypted both in transit and at rest, protecting it from unauthorized access or interception. Access to this data is strictly limited to authorized personnel who require it for specific tasks, with security enforced through Identity and Access Management (IAM) and Multi-Factor Authentication (MFA).

We utilize advanced monitoring and auditing systems to detect suspicious activities and respond to security threats in real time. Regular penetration testing and vulnerability assessments allow us to identify and address potential risks proactively. Additionally, we have implemented firewalls and DDoS protection mechanisms to prevent cyberattacks and unauthorized access attempts.

Organizational Measures

All employees of GRAAL SOFT SRL undergo regular training on data protection and internal security policies. They are instructed on proper data handling, incident reporting, and best practices for safeguarding personal information.

We maintain strict internal policies governing data management and security, including clearly defined incident response procedures and Data Protection Impact Assessments (DPIAs) to evaluate potential risks and ensure compliance with legal requirements.

Security Assessments and Incident Response

We conduct periodic security evaluations to identify vulnerabilities and continuously improve our protection measures. If a security breach affecting personal data occurs, we will take immediate action to minimize its impact and notify affected individuals and the National Data Protection Authority within 72 hours, in accordance with GDPR regulations.

Security Limitations and User Responsibilities

While we apply industry-leading security measures, no system is entirely infallible. Users are encouraged to:

Use strong, unique passwords and enable MFA wherever possible.
Avoid sharing login credentials or sensitive data with untrusted sources.
Monitor account activity and report any suspicious behavior immediately.

If you suspect that your information has been compromised or notice any unusual activity on your account, please contact us immediately so that we can take the necessary steps to protect your data.

By using our site, you acknowledge that while we take all necessary precautions to safeguard your personal data, certain risks are inherent in online interactions. We encourage all users to remain vigilant and adopt additional security measures as needed.

To access or use the Site, you must be at least 18 years old and have the legal capacity to accept this Privacy Policy. The use of the Site by individuals under the age of 18 is strictly prohibited. If we become aware that we have collected personal data from a minor under 18 without verified parental consent, we will take steps to delete such information as soon as possible.

8: Links to Third-Party Websites

Our Site may contain links to third-party websites. These links are provided solely for your convenience to facilitate access to additional information or useful resources. However, it is important to consider the following:

Each third-party website has its own privacy policy and data management practices. We do not assume any responsibility for the content or practices of these websites, and the inclusion of a link does not imply our endorsement of their content.

When you access a third-party site through our links, these external platforms may collect personal information about you. We strongly encourage you to review their privacy policies to understand how your data will be used and protected.

Accessing third-party websites may pose security risks. While we strive to provide links to trusted websites, we cannot guarantee the security or accuracy of the information found on these platforms. It is your responsibility to assess the risks associated with visiting these sites.

We acknowledge that the information on third-party websites may frequently change. Therefore, we cannot be held responsible for updated, modified, or inaccessible content on these sites. We encourage you to check these websites periodically for the latest information.

If you choose to visit a third-party website, you do so at your own risk. We disclaim any liability for damages or losses that may result from accessing or using these external sites.

By using our Site, you acknowledge and accept that we are not responsible for the content or privacy policies of third parties, and that caution is essential when browsing the internet.

International Data Transfers

As part of our operations, we may transfer your personal information outside the European Union (EU) or the European Economic Area (EEA). This may be necessary to provide our services or comply with legal obligations. In accordance with the General Data Protection Regulation (GDPR), we are committed to protecting your personal data during these transfers by implementing measures to ensure an adequate level of security.

If we transfer personal data to countries that do not provide an adequate level of data protection under EU law, we will rely on Standard Contractual Clauses (SCCs) approved by the European Commission. These clauses impose legal obligations on the recipients of the data to ensure appropriate safeguards.

In certain cases, we may use alternative compliance mechanisms, such as codes of conduct or certification frameworks, to maintain a high level of data protection.

Your personal information may be transferred to third countries, including but not limited to the United States, Canada, or other jurisdictions based on our business relationships and partnerships. Each transfer will be assessed to ensure that the recipients comply with our data security standards and have adequate protective measures in place.

You may request additional information about the security measures we implement for international data transfers by contacting us via the email provided in this policy. We will respond promptly to your inquiries and provide detailed information on data protection in these transfers.

If your personal information is transferred outside the EU or EEA, you have the right to request details about the applicable safeguards. These rights include, but are not limited to: access to your data, rectification, deletion, restriction of processing, and objection to processing, as outlined in the GDPR.

By using our Site, you acknowledge that your personal information may be transferred outside the EU or EEA, and we are committed to complying with applicable regulations to protect your data during such transfers.

GRAAL SOFT SRL will retain personal data only for the period necessary to fulfill the purposes specified in this policy, in compliance with legal archiving requirements and any other applicable legal obligations.

Once the retention period expires, personal data will be deleted or anonymized in accordance with data minimization principles and relevant legal regulations.

You have the right to access and update your personal information, as well as manage your privacy preferences. To request corrections or modifications, please contact us via email at office@graalsoft.ro.

GRAAL SOFT SRL reserves the right to update this policy periodically. Any changes will be published on this page, and users will be appropriately notified.

We encourage you to review this policy regularly to stay informed about any updates.

By continuing to use the Site after any changes have been published, you acknowledge and agree to the updated terms of this policy.

If you have any questions or wish to exercise any of your rights, please contact us at the following email address: contact@graalsoft.ro