PRIVACY
POLICY

1. The data controller

FLEXINVEST S.R.L., with its registered office at 5 Valea Viilor St., 547525 Sâncraiu de Mureș, Sâncraiu de Mureș commune, Mureș County, Romania, registered with the Trade Register under no. J2021001540267, unique registration code 44926098, VAT registration code RO44926098, is the controller of the personal data collected through this website.

For anything related to data protection, write to us at office@flexinvest.ro.

2. What data we collect and why

We only collect the data needed for the stated purpose. We do not sell data and we do not use it for marketing without your explicit consent.

Category of data · When we collect it · Purpose · Legal basis (art. 6 GDPR)

Name, email, phone, company, project details — When you fill in the contact form — To answer your enquiry and assess a possible collaboration — art. 6(1)(b) — pre-contractual steps; art. 6(1)(f) — legitimate interest in answering enquiries

Name, email, phone, CV, portfolio links, position applied for — When you apply for a position through the Careers page — To run the recruitment process and assess the application — art. 6(1)(b) — pre-contractual steps at your request; art. 6(1)(a) — consent for keeping you in the candidate pool

IP address, browser and device type, pages visited, date and time of access — Automatically, in the web server logs — For infrastructure security, abuse prevention and technical diagnostics — art. 6(1)(f) — legitimate interest in the security and proper functioning of our systems

Cookie preference — When you respond to the cookie banner — To remember your choice so we do not ask again — art. 6(1)(c) — legal obligation to demonstrate consent; art. 6(1)(f)

Providing the data marked as mandatory in the forms is necessary for us to be able to reply. Without it we cannot process the enquiry. The other fields are optional.

3. How long we keep the data

• Contact form enquiries — 24 months from the last communication, so we can pick the conversation back up and evidence the correspondence;
• Applications — 6 months after the recruitment process for that position ends; with your consent, up to 24 months, so we can contact you when a suitable role opens;
• Server logs — 12 months at most;
• Cookie preference — 12 months, or until you change it;
• Accounting and contractual documents, if we start working together — for the legal archiving periods (usually 10 years).

Once these periods expire, the data is deleted or irreversibly anonymised.

4. Who we share the data with

We do not sell or rent personal data. We may disclose it only:

• to suppliers who support our operations — web hosting and infrastructure, email services, communication tools — acting as processors, under contracts imposing the same confidentiality and security obligations;
• to companies within the Flexinvest group, when your enquiry concerns the services of a specific brand and needs to reach the right team;
• to public authorities, solely where there is a legal obligation or a request grounded in law.

5. Transfers outside the European Economic Area

The infrastructure this website runs on is hosted in the European Union. We do not intend to transfer data outside the EEA.

Should such a transfer become necessary (for example by using an email provider with global infrastructure), it will only be made to countries covered by a European Commission adequacy decision, or on the basis of the standard contractual clauses approved by it, with additional safeguards where appropriate.

6. Your rights

As a data subject, you have the following rights under the GDPR:

• right of access (art. 15) — to find out whether we process data about you and to receive a copy of it;
• right to rectification (art. 16) — to have inaccurate data corrected or incomplete data completed;
• right to erasure (art. 17) — the “right to be forgotten”, under the conditions provided by law;
• right to restriction of processing (art. 18);
• right to data portability (art. 20) — to receive your data in a structured, commonly used and machine-readable format;
• right to object (art. 21) — to object to processing based on our legitimate interest;
• right to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• right not to be subject to automated decision-making (art. 22).

You can exercise these rights by sending a request to office@flexinvest.ro. We reply within one month of receiving the request; in complex cases the deadline may be extended by two months, in which case we will inform you.

To prevent disclosure to unauthorised persons, we may ask for additional information needed to confirm your identity.

7. Right to lodge a complaint

If you believe we have infringed your rights, please contact us first — most situations can be resolved quickly.

You always have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., district 1, Bucharest, dataprotection.ro, as well as to bring the matter before the courts.

8. Data security

We apply appropriate technical and organisational measures to protect the data: encrypted traffic (HTTPS/TLS), role-based access restrictions, regular updates of infrastructure components, backups and separation of test and production environments.

No IT system is entirely invulnerable, however. In the event of a security breach presenting a high risk to your rights, we will inform you without undue delay, in accordance with art. 34 GDPR, and notify the supervisory authority under art. 33.

9. Automated decisions and profiling

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

10. Minors

This website is addressed to persons over 16 years of age. We do not knowingly collect data from minors below that age. If you are a parent or guardian and believe we have received such data, please contact us so we can delete it.

11. Changes to this policy

We may update this policy to reflect legislative changes or changes in how we process data. The version in force is the one published here, with the date of the last update shown below.