Privacy Policy

1. Who we are (Controller)

AFI OPS Technologies SRL ("AFI OPS", "we", "us") is the data controller for the processing of your personal data through this Site.

2. What personal data we collect

Depending on how you interact with the Site, we may collect:

• Contact data: name, email address, phone number (if provided), company name, and any message content you submit through our contact form.
• Technical data: IP address, device type, browser type and version, operating system, referral URL, and server logs.
• Usage data: pages visited, time spent, click patterns — collected only if analytics are enabled.
• reCAPTCHA data: when you submit a form, Google reCAPTCHA Enterprise processes behavioural signals (mouse movements, interaction timing) and your IP address to verify you are human. This data is processed by Google LLC under Google's Privacy Policy.
• Cookies and similar technologies: see Section 6.

3. Why we process personal data and legal bases (GDPR Art. 6)

We process personal data for the following purposes:

• (a) Responding to inquiries and communicating with potential clients.
  Legal basis: legitimate interests (Art. 6(1)(f)) and/or steps taken at your request prior to entering into a contract (Art. 6(1)(b)).
• (b) Operating, securing, and improving the Site (e.g., server logging, error tracking, security monitoring).
  Legal basis: legitimate interests (Art. 6(1)(f)).
• (c) Analytics and advertising measurement (optional — only where you have provided consent). This includes measuring which pages are used, and whether an advertising campaign on Google or LinkedIn led to an enquiry.
  Legal basis: consent (Art. 6(1)(a)).
• (d) Fraud prevention and bot detection via Google reCAPTCHA.
  Legal basis: legitimate interests (Art. 6(1)(f)).
• (e) Compliance with legal obligations (e.g., responding to lawful requests from authorities).
  Legal basis: legal obligation (Art. 6(1)(c)).

4. Who we share data with (Recipients and Processors)

We use the following third-party service providers (processors) who may handle personal data on our behalf:

• Cybot A/S (Cookiebot): our consent management platform. It records your cookie choices and signals them to the services below. Strictly necessary — it operates before and regardless of consent, because it is what asks for it.
• Google LLC — reCAPTCHA Enterprise: bot detection on our contact form. Processes behavioural signals and your IP address to verify you are human. Strictly necessary for fraud prevention; loaded only on pages containing a form.
• Google LLC — Google Tag Manager: loads and governs the measurement and advertising tags listed below, and enforces your consent choices against them.
• Google LLC — Google Analytics 4: website analytics — which pages are visited, how visitors arrive, and which of them contact us. Statistics consent.
• Google LLC — Google Ads: measures whether an advertising campaign led to an enquiry, and supports remarketing audiences. Marketing consent.
• LinkedIn Ireland Unlimited Company — LinkedIn Insight Tag: measures whether a LinkedIn advertising campaign led to an enquiry, and supports remarketing audiences. Marketing consent.
• Amazon Web Services (AWS) — S3: file storage for uploads submitted through our contact form. Servers may be located in the EU or US. Safeguards: AWS Data Processing Agreement and Standard Contractual Clauses.
• Hosting / infrastructure provider: to operate the Site and its servers.

All processors are required to process data only under our instructions and to implement appropriate technical and organizational security measures.

We do not sell personal data to third parties.

5. International transfers

Some of our processors (including Google, LinkedIn, and AWS) are located in or transfer data to countries outside the European Economic Area (EEA), including the United States. Where this occurs, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses (SCCs) approved by the European Commission — to protect your data in accordance with GDPR requirements.

6. Cookies

We use the following categories of cookies:

• Strictly necessary cookies: required for the Site to function (e.g., session management). No consent required.
• Google reCAPTCHA cookies: set by Google to distinguish humans from bots when submitting forms. These are loaded on pages containing a contact form.
• Consent cookies (Cookiebot): store the choices you make in the cookie banner so we do not ask again on every page. No consent required — they exist to record your decision.
• Statistics cookies (Google Analytics 4): used to understand how visitors find and use the Site. Only set after you provide consent. Until you consent, Google receives only anonymous, cookieless signals.
• Marketing cookies (Google Ads, LinkedIn Insight Tag): used to measure whether an advertising campaign led to an enquiry and to build remarketing audiences. Only set after you provide consent.

You can manage your cookie preferences at any time through our cookie banner or by adjusting your browser settings.

7. Data retention

We retain personal data only for as long as necessary for the purposes described above:

• Contact inquiries: up to 36 months after the last interaction with a prospect or client.
• Server and security logs: up to 90 days.
• Analytics data (Google Analytics 4): event-level data and user-level identifiers are both retained for 14 months, with the period resetting on each new visit by the same user. Aggregated reporting is retained by Google independently of these settings.
• Advertising audiences (Google Ads, LinkedIn): membership expires according to the retention period configured for each audience in the respective platform.

When data is no longer needed, it is securely deleted or anonymized.

8. Your rights (GDPR — EEA and UK)

If you are located in the EEA or the United Kingdom, you have the following rights under GDPR:

• Right of access: to obtain a copy of your personal data and information about how it is processed.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your data ("right to be forgotten"), subject to legal exceptions.
• Right to restriction: to limit how we process your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at contact@afiops.com. We will respond within 30 days.

9. Automated decision-making and profiling

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you, as defined in GDPR Article 22.

10. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, or disclosure. These include encrypted data transmission (HTTPS), access controls, and regular security reviews. However, no method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

11. Complaints

You have the right to lodge a complaint with your local data protection supervisory authority. In Romania, the competent authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP — www.dataprotection.ro). If you are located in another EEA member state or the UK, you may contact your national authority.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page indicates when the most recent changes were made. We encourage you to review this Policy and our Terms of Service periodically.

13. Contact

For questions, requests, or concerns about this Privacy Policy or our data practices, please contact us: