PRIVACY POLICY

1. DATA CONTROLLER

LAVALI ONLINE SHOP SRL (AI Soft), Strada Oituz nr. 80, Popești-Leordeni, Ilfov County, Romania, tax identification number 48870445, Trade Register no. J2023006383236.

For any question about personal data: contact@ai-soft.ro, phone +40 762 777 111.

2. WHAT DATA WE PROCESS AND WHY

• a) Client account: name, email, phone, password (stored encrypted; we cannot read it), company details (name, tax identification number, address, legal representative). Purpose: creating the account, concluding and performing agreements. Legal basis: performance of a contract.
• b) Data from ANAF and VIES: the company's public details, retrieved automatically based on the tax identification number or VAT number. Purpose: correct billing details. Legal basis: performance of a contract.
• c) Sign-in with Google: the name, email and identifier of the Google account, only if you choose this option. Purpose: authentication. Legal basis: your consent.
• d) Password reset: a single-use code, valid for 60 minutes, of which we keep only a cryptographic fingerprint. Purpose: changing the password. Legal basis: performance of a contract.
• e) Orders, requests and quotes: order details, answers to project questions, files you send us, messages in the request, quotes and their acceptance. Files are kept outside the public area of the server. Purpose: preparing the quote and carrying out the project. Legal basis: steps prior to entering into a contract and performance of a contract.
• f) Agreements and acceptances: the text of the accepted agreement or annex, the date, time, IP address and technical details of the browser. Purpose: proof of conclusion of the agreement. Legal basis: legal obligation and legitimate interest.
• g) Invoicing and payments: billing details, pro forma invoices, invoices, payments. Purpose: invoicing and accounting records. Legal basis: legal obligation. Card details never reach us; payment is made on the secure NETOPIA Payments page.
• h) Projects and AI Soft Points: hours worked on your projects, progress and points awarded. Purpose: project tracking and the loyalty programme. Legal basis: performance of a contract.
• i) Communications: messages sent through the contact form, support tickets, comments on articles, emails. Purpose: answering requests and technical support. Legal basis: legitimate interest and performance of a contract.
• j) Newsletter: email and language, with the date, time and version of the consent. The subscription becomes active only after confirmation from the email received. You can unsubscribe at any time, with one click, from the link in each email; unsubscribed addresses are added to a suppression list so they no longer receive marketing messages. Legal basis: your consent.
• k) Technical data: country estimated from the IP address (to choose the website language, using a local database), pages visited, browser type, server technical logs. The full IP address is not kept long term. Purpose: operation and security of the website, protection against abuse. Legal basis: legitimate interest.

3. WHO WE SHARE DATA WITH

Data is shared only with providers needed to run the services, who process it on our behalf:

• Romarg — hosting of the website and data, the email server, domain registration;
• Oblio — issuing pro forma invoices and invoices;
• NETOPIA Payments — card payment processing;
• Google — sign-in with a Google account (only if you choose it);
• ANAF — querying public company details based on the tax identification number;
• European Commission (VIES) — VAT number verification, for clients from other EU states;
• domain registries (for .ro domains, ROTLD) — registrant details, when a domain is registered;
• public authorities, only when required by law.

We do not sell or rent personal data.

4. HOW LONG WE KEEP DATA

• account data: for as long as the account is active and afterwards for the period needed for any contractual obligations;
• agreements, invoices and accounting documents: for the period required by financial and accounting law;
• requests, quotes and related files: for as long as they are needed for the project and afterwards for records, for a reasonable period;
• password reset codes: cancelled after use or after 60 minutes;
• unconfirmed newsletter subscriptions: deleted automatically after 7 days;
• newsletter data: until you unsubscribe; the address remains on the suppression list so that the unsubscription is respected;
• messages and tickets: for as long as needed to resolve them and afterwards for records, for a reasonable period.

5. YOUR RIGHTS

Under Regulation (EU) 2016/679 (GDPR), you have the right of access, rectification, erasure, restriction, portability, objection and the right to withdraw your consent at any time. To exercise them, write to us at contact@ai-soft.ro. You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

6. OUR CLIENTS' WEBSITES

For the data of visitors to the websites we build and host for our clients, the client is the controller and we are the processor, according to the agreement concluded with the client.

If a client uses the AI Soft connector on their website, the messages visitors send through that website’s forms (name, email, phone, subject and message) reach the client’s AI Soft account. We process them only as the client’s processor, in order to show them in the client’s account.

7. COOKIES

We use only cookies necessary for the website to work: the sign-in session, form protection, the chosen language and the display preference. We do not use advertising cookies. If we add traffic measurement or advertising tools, we will update this policy and ask for your consent where the law requires it.

8. SECURITY

We use a secure connection (HTTPS), encrypted passwords, restricted access to data, emails sent through an authenticated server, and we keep sensitive documents and files outside the public area of the server.

9. ATTRIBUTION

Country detection uses the "IP Geolocation by DB-IP" database (db-ip.com), under the Creative Commons Attribution 4.0 licence.

10. CHANGES

We may update this policy. The version in force is the one published on this page, with the date of the last update.

This policy is made available in Romanian and English. In case of any inconsistency, the Romanian version prevails.