Textul documentului este în engleză. O traducere va urma.
1. Who we are and what this policy covers
[Details pending confirmation] (tax ID [Details pending confirmation], trade register [Details pending confirmation], registered office [Details pending confirmation], Romania) runs the Azimea
service for email marketing and automation. Privacy contact: privacy@azimea.com. We have assessed whether we must appoint a data
protection officer (Article 37 GDPR) and [we have appointed [name, external] / we will review this assessment every year].
(under verification)
This policy explains how we use personal data as the controller, that is, when we decide why and how:
- of the people who use Azimea (our customers’ team members) and of business contacts at our customers and prospective customers;
- of visitors to azimea.com, docs.azimea.com and people who write to us;
- of people who contact support or fill in our forms.
This policy does not cover the personal data of our customers’ own contacts or shoppers (the people our customers email). For that data, the customer is the controller and Azimea is the processor, under our Data Processing Agreement. If you received an email sent through Azimea and want to exercise your rights, contact the company that sent it; if you write to us, we will pass your request to them (section 9).
2. What we collect, why, on what basis, for how long
| Data | Why (our interest, where it is a legitimate interest) | Legal basis (GDPR art. 6) | How long |
|---|---|---|---|
| Account: name, email, phone (optional), language, password (stored as a hash), two-factor secret and recovery codes, role, last sign-in, weekly-email setting | create and secure the account, provide the Service, contact you about it | contract (with you or with your employer) and legitimate interest | while the account exists, then deleted or anonymised when you ask or [Details pending confirmation] after the contract ends |
| Company details: company name, address, website, brand, logo, billing contact | provide the Service, invoice you | contract; legal obligation (invoicing) | while the account exists; mandatory accounting registers and supporting accounting documents: 5 years calculated from 1 July of the year following the financial year in which they were prepared (Law 82/1991, art. 25, amended by Law 36/2023). A different period applies where a specific legal obligation requires it; documented legal holds are limited to the relevant records. |
| Payments: handled by Stripe (card, billing address, tax ID, invoices); we keep only the plan, status, period dates and Stripe’s customer and subscription identifiers | take payment, issue invoices, tax compliance | contract; legal obligation | accounting records as required by law |
| Security and activity logs: actions in your account, with the time, your IP address and browser, and your user identifier | keeping accounts and customer data secure and being able to show who did what | legitimate interest | 24 months from the event [Details pending confirmation] |
| Service emails to you: reset links, confirmations, invitations, notifications, a weekly summary | run the Service | contract; legitimate interest (the weekly summary can be turned off) | the message body is removed within 2 hours; a record of the send remains |
| Support: your name, email, messages, attachments, and technical context you send (page, browser, language, time zone, recent error codes) | answer you (contract or legitimate interest); improve the Service (legitimate interest, using anonymised text) | contract; legitimate interest | closed tickets are anonymised after 24 months; spam is deleted after 30 days; unconfirmed public requests after 90 days |
| Forms on azimea.com (migration, founding customers, waiting list, contact): name, email, website, platform, size, message, language, page | answer your request | steps at your request before a contract (art. 6(1)(b)) or legitimate interest; consent only for any newsletter or marketing about Azimea, collected with a separate unticked box | 24 months, then deleted by a daily job, or sooner if you ask |
| AI usage record: your company, the feature, credits, time (no content) | credits, cost control, abuse prevention | contract; legitimate interest | while the account exists |
| Platform sending statistics: aggregate delivery, bounce and complaint rates; no personal data | protect the shared sending reputation, which is a condition of the Service for all customers | not personal data | as long as useful |
| Protective suppression list: a one-way hash of an email address, the reason (hard bounce or complaint; an unsubscribe is one company’s and is not on it) and the date | stop repeated mail to people who complained or whose address is invalid, and protect the shared sending reputation. A hash of an address is still personal data | legitimate interest | [Details pending confirmation] from the last event; we cannot turn the hash back into the address, and we take an address off when its owner asks (write to privacy@azimea.com) |
| Reports of abuse sent to abuse@azimea.com | enforce the Acceptable use policy | legitimate interest | as long as needed to handle it |
| Technical server logs | operate and secure the Service | legitimate interest | up to 90 days |
| Public site traffic totals: published page, minute or day, broad traffic-source category and bot flag; no IP address, cookie, full URL or raw referrer in this report | understand demand for public pages and capacity | legitimate interest, subject to our balancing assessment | reduced access log up to 48 hours; minute totals 2 days; daily totals 90 days |
| Azimea Analytics (only after statistics consent): public page path or fixed app conversion path, time, random session ID, random consent-cookie ID, broad source and medium, optional campaign slug and page-view or conversion event | count consenting browsers, sessions and conversions | consent (art. 6(1)(a)); withdraw in Cookie settings | 90 days |
Where your company came from: the campaign, link or site that brought you before you signed up (the utm_* tags, the page you landed on, the referring site, Google’s click id) and, from our own records, whether the company confirmed its address, sent its first email and paid |
measure which of our marketing brings customers, and report it to ourselves | legitimate interest (measuring our own marketing); kept in a cookie only with your consent, see the Cookie statement | while the company exists; Google’s click id 90 days |
| Statistics and advertising measurement (only if you accept them in Cookie settings): pages visited on azimea.com, where the visit came from (source, campaign, the Google ad clicked), browser and device type, approximate location, and the fact that an account was created or a plan bought, with its value | understand which pages and campaigns work, count the results of our Google ads, show our ads to past visitors | consent (art. 6(1)(a)), which you can withdraw at any time in Cookie settings | Google Analytics: 14 months; Google Ads: as set by Google (under verification); your choice itself: 6 months in your browser, and its record (a random id, the answers and the time, no IP address) 12 months |
We need your account details to create and secure your account and to bill you; without them we cannot provide the Service. Giving us your phone number is optional. We need your name, email and message to answer a support or contact request.
We do not sell personal data. We use data for advertising only as the row on statistics and advertising measurement describes, with your consent, and never the data you keep in the Service. Our Service applies automatic reputation controls: if the bounce or complaint rate of a company’s sending passes the thresholds in the Terms (section 8), the system slows or stops that company’s sending. This is part of the contract. It can affect a person who is a sole trader. You can ask us for a review by a person at privacy@azimea.com, give your point of view and contest the decision.
You can object at any time to processing based on our legitimate interests (section 9). [Details pending confirmation]
3. Where the data comes from
From you; from your colleagues who invite you; from our customers’ use of the Service; from Stripe (payment status); from mail providers (bounce and complaint signals).
4. Who receives the data
- Our sub-processors, listed at azimea.com/security, bound by contract: OVHcloud (hosting, France), Stripe Payments Europe (payments, Ireland; it also determines how it processes data for its own regulated payment activities [Details pending confirmation]), OpenAI and Anthropic (AI features, see section 5), [Details pending confirmation].
- Google (Google Ireland Limited), only if you accept statistics or advertising cookies: Google Analytics as our processor, and Google Ads, for which Google also acts on its own behalf (under verification).
- Our advisers (lawyer, accountant), under confidentiality.
- Authorities, when the law requires it.
- If our business is sold or merged, the data may pass to the successor under this policy.
5. Transfers outside the European Economic Area
Account, company, support and form data are stored in the EU, but see below for the AI features and Google. If you accept statistics or advertising cookies, Google may transfer the data to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Where we send text to OpenAI or Anthropic, we contract with their EU companies ([Details pending confirmation]), which transfer it onward to the United States. There is no European Commission adequacy decision that we rely on for these providers [Details pending confirmation]; the safeguard is the European Commission’s standard contractual clauses, together with our own assessment of the transfer. You can ask for a copy of the safeguards at privacy@azimea.com. AI requests can include user-submitted text and the context needed for the selected feature. Our support tools can send conversation text, including relevant internal notes and staff names, for AI-assisted classification, summaries, translation or draft replies. Free text may contain personal data; automated secret filtering does not guarantee anonymisation. Users should not include unnecessary contact data or the restricted information described in Terms section 5.8. (under verification)
6. Cookies and similar technologies
The app and azimea.com use the cookies and browser storage they need to work. With your consent, azimea.com also uses Google Analytics (statistics) and Google Ads (advertising measurement and remarketing); in the app, Google’s tags load only when you create an account or pay for a plan. You choose when you first visit and can change your choice at any time in Cookie settings. Names, purposes and durations are in the Cookie statement. How Google uses the data it receives from sites that use its services is explained at policies.google.com/technologies/partner-sites.
7. Security
We protect personal data with technical and organisational measures that match the risk: encryption in transit and for sensitive fields, separated secrets, access limited by role, two-factor authentication, an activity log that cannot be edited, rate limits, monitoring and backups. The measures are described in annex 2 of our Data Processing Agreement. If a breach is likely to put your rights at risk, we tell you and the authority as the law requires.
8. Children
Azimea is for business use and not for people under 18. We do not knowingly collect their data. Tell us if you think we did, and we will delete it.
9. Your rights
You can ask us for access, correction, deletion, restriction of processing and a copy of the data you gave us in a common format,
and you can object at any time to processing based on our legitimate interests. Where we rely on consent you can withdraw it at any
time, without affecting what we did before. We answer within one month; we may extend this by up to two further months for complex
or numerous requests and we will tell you within the first month. Write to privacy@azimea.com, from the email address on the
account so that we can check it is you.
If your request is about the data of a company’s contacts that we process for a customer, we will pass it to that company without delay and tell you.
You can complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), Romania (www.dataprotection.ro), or to the authority in the country where you live or work.
10. Changes
When we change this policy in a way that matters, we tell you by email or in the app, and we change the date above.