Privacy Policy

1. Personal data controller

The controller of personal data collected through the website vplustech.ro, hereinafter the “Website”, is:

SC Vplus SRL, with its registered office in Cluj-Napoca, 5 Băișoara Street, Apartment 21, registered with the Trade Register under no. J2001000652123, unique registration code 13863364, hereinafter “Vplus” or the “Controller”.

The Controller’s contact details are:

2. Purpose of this Privacy Policy

Vplus respects the right to privacy and processes personal data in accordance with Regulation (EU) 2016/679 on the protection of personal data (GDPR) and applicable Romanian law.

This policy explains:

• the categories of personal data that may be collected;
• the purposes for which data is used;
• the legal bases for processing;
• the recipients to whom data may be disclosed;
• how long data is retained;
• the general measures used to protect it;
• the rights of data subjects.

This policy applies to data processed through the Website, the contact form, email and other professional communications with Vplus.

3. Categories of data processed

Depending on how you use the Website or communicate with Vplus, the following categories of data may be processed:

3.1. Data provided through the contact form

The contact form may collect:

• first and last name;
• email address;
• telephone number, if requested or provided;
• the organisation, company or institution represented;
• professional role;
• area of interest;
• message content;
• documents or information submitted voluntarily.

3.2. Data provided through direct communications

If you contact us by email, telephone or other means, we may process:

• your identification data;
• contact details;
• the organisation represented;
• the content of communications;
• information needed to understand and handle the enquiry.

3.3. Professional and contractual data

When assessing a collaboration opportunity, preparing a proposal or carrying out a project, we may process:

• the names and roles of contact persons;
• professional contact details;
• the company, institution or organisation represented;
• information about the enquiry, project or collaboration;
• data needed for proposals, contracting, invoicing and professional communication;
• information required to meet contractual and legal obligations.

3.4. Technical data

When the Website is accessed, certain technical data may be collected automatically:

• IP address;
• device type;
• browser type and version;
• operating system;
• date and time of access;
• pages and resources accessed;
• the referring page address;
• technical errors and security events;
• identifiers associated with cookies, where their use has been accepted.

3.5. Special categories of data

Vplus does not seek to collect through the Website special categories of data such as information concerning health, racial or ethnic origin, religious beliefs, political opinions, trade-union membership, sex life, sexual orientation, genetic data or biometric data.

Please do not send such information through the contact form or by email unless transmission is strictly necessary, justified and carried out within an appropriate legal and contractual framework.

4. Sources of data

Personal data is obtained mainly:

• directly from people who complete the contact form;
• through email messages;
• during telephone conversations or professional meetings;
• from representatives of clients, partners, suppliers or collaborators;
• automatically through the technical operation of the Website;
• from public sources where necessary to initiate or conduct a professional relationship and permitted by law.

5. Purposes and legal bases for processing

Vplus may process personal data for the following purposes:

5.1. Handling enquiries

Data is used to receive, assess and handle enquiries submitted through the contact form, by email or by telephone. The legal bases are taking steps at the data subject’s request before entering into a contract and Vplus’s legitimate interest in responding to enquiries.

5.2. Assessing collaboration opportunities

Data may be processed to:

• understand the enquirer’s needs;
• carry out a preliminary project assessment;
• arrange a meeting;
• prepare and send a proposal;
• prepare a technical or commercial offer.

The legal basis is taking the pre-contractual steps requested by the interested person.

5.3. Entering into and performing contracts

Data may be processed to negotiate, enter into, administer and perform contracts, orders, agreements or collaboration arrangements. The legal basis is performance of a contract or taking necessary steps before entering into it.

5.4. Managing professional relationships

Data concerning representatives and contact persons of clients, suppliers, partners and collaborators may be used for communication, activity coordination and relationship management. The legal basis is Vplus’s legitimate interest in organising and conducting its professional and contractual relationships.

5.5. Compliance with legal obligations

Data may be processed to comply with applicable tax, accounting, administrative, archiving and reporting obligations. The legal basis is compliance with the Controller’s legal obligations.

5.6. Security of the Website and IT infrastructure

Technical data may be used to:

• ensure the Website operates correctly;
• identify and remedy errors;
• prevent unauthorised access;
• detect attempted fraud or cyberattacks;
• investigate security incidents;
• protect Vplus infrastructure and information.

The legal basis is Vplus’s legitimate interest in system security and business continuity.

5.7. Protecting rights and legitimate interests

Data may be used to establish, exercise or defend rights, including in complaints, administrative proceedings, investigations or litigation. The legal basis is the Controller’s legitimate interest in protecting its rights, assets and activities.

5.8. Analytics cookies and similar technologies

If the Website uses analytics, preference or marketing cookies, they will be activated only under the conditions prescribed by law and, where required, only after obtaining the user’s consent. Consent may be withdrawn at any time through the cookie-preference management tool.

6. Provision of data

Providing data through the contact form is voluntary. However, certain information, such as your name, email address and the content of the enquiry, is required to identify the message, assess the request and provide a response.

Refusing to provide necessary data may make it impossible to:

• handle the enquiry;
• prepare an offer;
• initiate a collaboration;
• enter into or perform a contract.

You must not provide personal data about other people unless you have the necessary right or authorisation to do so.

7. Recipients of data

Data may be accessed, to the extent necessary, by authorised Vplus personnel and collaborators.

Data may also be disclosed to the following categories of recipients:

• Website hosting providers;
• email service providers;
• IT, maintenance and security service providers;
• document storage and administration providers;
• accounting, tax, legal or consultancy service providers;
• traffic analytics providers, where used and supported by an appropriate legal basis;
• partners involved in a project, where disclosure is necessary to prepare or perform the collaboration;
• public authorities, institutions, courts or other competent bodies where disclosure is required by law;
• other recipients where the data subject has consented or disclosure is justified by another legal basis.

Providers processing data on behalf of Vplus must comply with applicable confidentiality, security and data-protection obligations. Vplus does not sell or rent users’ personal data.

8. International data transfers

Vplus seeks to use providers that store and process data in Romania or the European Economic Area.

Where the use of a provider involves transferring data outside the European Economic Area, the transfer will take place only in compliance with the GDPR and on the basis of a recognised legal mechanism, such as:

• an adequacy decision adopted by the European Commission;
• standard contractual clauses approved by the European Commission;
• binding corporate rules;
• other safeguards or derogations permitted by applicable law.

Further information about transfers and the safeguards used may be requested at dialog@vplustech.ro.

9. Retention period

Data is retained only for as long as necessary to fulfil the purposes for which it was collected.

As a general rule:

• enquiries that do not lead to a collaboration are retained for no more than 24 months after the last relevant communication;
• data associated with an offer is retained for the validity period of the offer and, where justified, for no more than 24 months after discussions end;
• contractual data is retained for the duration of the collaboration and afterwards for the periods required under tax, accounting and civil law;
• documents needed to establish, exercise or defend rights may be retained until the applicable statutory limitation periods expire;
• technical and security logs are generally retained for no more than 6 months, except where required to investigate an incident;
• data processed on the basis of consent is retained until consent is withdrawn or until the retention period communicated at collection expires;
• cookie duration is specified in the Cookie Policy.

When the relevant periods expire, data is erased, anonymised or archived where retention is required by law.

10. Data security

Vplus applies reasonable technical and organisational measures to protect personal data against:

• unauthorised access;
• accidental loss or destruction;
• unauthorised alteration;
• unlawful disclosure;
• misuse;
• security incidents.

Access to data is granted only to people who require it for their professional duties. Providers processing data on behalf of Vplus are selected with regard to their ability to ensure an appropriate level of security and confidentiality.

The transmission of information over the internet cannot be guaranteed to be entirely risk-free. Therefore, please do not submit passwords, banking data, trade secrets, classified information or strictly confidential documents through the public form.

A separate non-disclosure agreement may be concluded for projects involving exchanges of confidential information.

11. Rights of data subjects

Subject to the conditions laid down by the GDPR, you have the following rights:

Right of access

You may obtain confirmation as to whether Vplus processes your data and, where it does, receive information about the processing and a copy of the data.

Right to rectification

You may request correction of inaccurate data and completion of incomplete data.

Right to erasure

You may request erasure where the conditions prescribed by law are met, including where the data is no longer required for the purpose for which it was collected. This right is not absolute: certain data may be retained where required by law, justified by a legitimate interest, or necessary to establish, exercise or defend a right.

Right to restriction of processing

You may request restriction of processing in the circumstances provided by the GDPR.

Right to data portability

Where processing is based on consent or performance of a contract and is carried out by automated means, you may receive your data in a structured, commonly used and machine-readable format.

Right to object

You may object, on grounds relating to your particular situation, to processing based on Vplus’s legitimate interest.

Right to withdraw consent

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Rights relating to automated decisions

You have the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal effects concerning you or similarly significantly affects you, except in cases permitted by law.

Right to lodge a complaint

You may lodge a complaint with the competent data-protection authority without prejudice to other administrative or judicial remedies.

12. Exercising your rights

To exercise your data-protection rights, send a request to:

The request must allow the person and subject matter of the request to be identified. If there are reasonable doubts about the requester’s identity, Vplus may request further information strictly necessary to verify identity and protect data against unauthorised disclosure.

Requests are handled without undue delay and generally within one month of receipt. In justified circumstances, taking account of the complexity and number of requests, the period may be extended as provided by the GDPR.

Exercising these rights is generally free of charge. For manifestly unfounded or excessive requests, particularly because of their repetitive character, Vplus may take the measures permitted by applicable law.

13. Automated decision-making and profiling

Vplus does not use data collected through the Website to make decisions based solely on automated processing that produce legal effects concerning data subjects or similarly significantly affect them.

If this changes, data subjects will be appropriately informed before such processing begins.

14. Children’s data

The Website and Vplus services are intended primarily for professionals, companies, organisations and institutions. Vplus does not seek intentionally to collect personal data concerning children.

If we learn that a child’s data has been submitted without an appropriate legal basis, we will take reasonable steps to erase it.

15. Use of cookies

The Website may use cookies that are strictly necessary for its operation, security and proper display.

Analytics, preference or marketing cookies will be used only in accordance with the law and, where required, only after obtaining the user’s consent.

Information on cookie types, providers, purposes and duration is presented separately in the Cookie Policy. Users may change their choices through the consent-management tool available on the Website and through their browser settings.

16. Right to lodge a complaint

If you believe that your data has been processed in breach of the law, we recommend contacting Vplus first so that we can try to resolve the matter.

You also have the right to lodge a complaint with:

The right to lodge a complaint does not affect your right to bring proceedings before the competent courts.

17. Links to external websites

The Website may contain links to pages operated by other people or organisations. Vplus does not control how the operators of those websites process personal data. Access to external pages is subject to the privacy policies established by their respective operators.

We recommend reviewing the privacy policy of each external website you visit.

18. Change of processing purpose

If Vplus intends to use data for a purpose other than the one for which it was collected, data subjects will receive the relevant information about the new purpose and applicable legal basis before the new processing begins.

19. Updates to this policy

This policy may be updated as a result of:

• changes to the Website or Vplus services;
• the introduction of new functionality;
• changes to service providers;
• changes in processing activities;
• changes in applicable law;
• recommendations or decisions of competent authorities.

The updated version will be published on the Website and the date of the latest change will be stated at the beginning of the document.

20. Contact

For questions, requests or the exercise of data-protection rights: