1. Introduction

Thank you for your interest in our company‘s products, and/or services. The protection and confidentiality of personal data are very important to us. When you enter any kind of relationship with us, you entrust us with your information. The information presented in this document (hereinafter referred to as the "Privacy Policy" or "Document") is important. We recommend that you read it carefully. We also suggest reading this document together with the Terms and Conditions of Use (hereinafter referred to as "T&C"). In the event of a conflict or inconsistency between the terms of this Privacy Policy and any other clause of the T&C, the terms of this Document shall prevail. For more information on the use of cookies or other similar technologies, please consult our Cookie Use Policy.

This Document is valid starting from 2025-01-13 and may be revised from time to time, as indicated further, and it is your obligation to check the content of the Privacy Policy when accessing our Platform and/or using the Application.

The purpose of this Privacy Policy is to explain what data we process (collect, use, share), why we process it, how we process it, your rights under the GDPR, and how you can exercise these rights. In collecting this information, we act as a data controller, and are required by law to provide you with this information.

Fully aware that your personal information belongs to you, we do our utmost to store it securely and process it carefully. We do not provide information to third parties without informing you in accordance with legal provisions if such notification is required by law. We do not make exclusively automated decisions that have legal effects or a similarly significant impact on you.

By visiting our website, purchasing our products, or interacting with us through any means and/or any communication channels (email, telephone, social networks, etc.), you agree to this Privacy Policy. If you do not agree with the contents of this Privacy Policy, please do not use our services.

SOFTWAREUP SOLUTIONS S.R.L. is a member of an EU (European Union) state and is a data controller within the meaning of the GDPR. This Privacy Policy covers only the data processing for which SOFTWAREUP SOLUTIONS S.R.L. is the data controller.

2. Definitions

2.1. "GDPR" or "The Regulation" refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2.2. "Controller" or "We" refers to SOFTWAREUP SOLUTIONS S.R.L., with its registered office at Str. Paltinis 3, Buzau, Romania, registered in the Trade Register under order number J10/908/06.09.2018, having the tax registration code 39838011.

2.3. "Data Subject" refers to any identifiable natural person whose personal data is processed by us as a data controller, such as customers, potential customers, or visitors to the website.

2.4. "Processing" means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2.5. "Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, through a statement or by a clear affirmative action, agree to the processing of personal data relating to them.

2.6. "Personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

Other terms used in this document have the meanings assigned to them by the GDPR and other applicable legal provisions.

3. Who are we?

SOFTWAREUP SOLUTIONS S.R.L., with its registered office at Str. Paltinis 3, Buzau, Romania, registered in the Trade Register under order number J10/908/06.09.2018, having the tax registration code 39838011, and email contact@softwareup.io, is responsible for processing your personal data which we collect directly from you or from other sources.

In accordance with the law, our company is a personal data controller. To ensure that your data is processed securely, we have made every effort to implement reasonable and appropriate technical and organizational measures to protect your personal data.

4. What data do we collect and for what purpose?

During your visit/use of the application, we collect a range of data:

• Email address, for authentication, billing, contact, direct marketing (only if we have your prior consent);
• Username and password, for authentication;
• Phone number, for billing, contact;
• Language preference, to display the application content in your preferred language;
• The name of the institution, institution details, to enable the management of the service;
• Name, Billing address, legal form, tax identification number, to issue an invoice;
• IP address, for localization and legitimate interest, to ensure the system is secure and prevent fraud;
• Operating system type, browser version, browsing history, to ensure the system is functional and secure.

Although we have made every possible effort to identify all the personal data processed and their purposes, please note that the above list is not exhaustive.

We collect most information directly from you (for example, by filling out a form on our website).

In addition to the information mentioned above, we may also collect the following information, depending on the circumstances:

• The way in which you interact with our site/sites (for example, information about how and when you access our site or what device you use to access the site). For more information in this regard, we invite you to also read our Cookie Usage Policy.
• Information provided when filling out forms or questionnaires.
• The content of messages sent through messaging and email systems.

In the event that you make purchases, certain payment information (card details) will be collected, but it will be stored by our processing partners in a way that we cannot read and do not have access to that data.

In addition to the purposes listed in the table in the previous section, we process personal data for the following purposes:

• To respond to your inquiries and requests and to provide customer support services;
• For marketing purposes, but only when we have your prior consent or when there is a legal exception to obtaining consent;
• To offer and improve the services we provide;
• To diagnose or fix technical problems;
• To defend against cyber attacks;
• For creating and/or maintaining accounts;
• To comply with legislation, such as compliance with tax laws that require us to keep accounting records for a period of 10 years;
• In the unlikely event of a dispute, to ascertain or claim a right in court.

5. Google ReCaptcha

We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on this website. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to check whether the data entered on this website (e.g., in a contact form) is done by a human or by an automated program. To do this, reCAPTCHA analyzes the behavior of the website visitor based on various features. This analysis starts automatically as soon as the website visitor enters the site. For the analysis, reCAPTCHA evaluates various information (e.g., IP address, the amount of time spent on the website by the visitor, or mouse movements made by the user). The data collected during the analysis are transmitted to Google.

The reCAPTCHA analyses run entirely in the background. Visitors to the site are not informed that an analysis is taking place.

The storage and analysis of personal data are carried out based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its websites from abusive automated spying and spam. If corresponding consent has been requested, processing is carried out exclusively based on Art. 6(1)(a) GDPR, insofar as the consent includes the storage of cookies or access to information on the user's end device (e.g., device fingerprinting). The consent can be revoked at any time.

For more information about Google reCAPTCHA, please see the Google Privacy Policy and Google Terms and Conditions at the following links:

• https://policies.google.com/privacy
• https://policies.google.com/terms

6. How long do we store the data?

Data is stored for the entire duration of your account's existence, except for billing data, which we have a legal obligation to keep it for 10 years.

If you wish to delete these data, you have the following options:

• Data strictly necessary for accessing the account: username, email address, password, language preference - can only be deleted by closing the user account, an option available on the profile page;
• Data associated with the account - can be deleted at any time by accessing the respective sections of the application where the data are listed;
• The rest of the data for which we do not have a legal obligation to store, or which do not fall under our legitimate interest, can be deleted at your request, via contact@softwareup.io.

7. To whom and for what purpose do we transfer your data?

We may disclose your data, in compliance with applicable law, to business partners or other third parties. We continuously make reasonable efforts to ensure that these third parties have implemented adequate protection and security measures. With these third parties, we have contractual clauses so that your data is protected. In these situations, we will ensure that any transfer is legitimate according to applicable legislation.

For example, we might provide your data to other companies, such as IT service providers (cloud, hosting) or telecommunications, accounting, legal services, and other third parties with whom we have a contractual relationship. These third parties are carefully selected so that your data is processed only for the purposes we specify and according to security standards.

Billing data is forwarded to our payment processor strictly for billing/payment purposes.

We may also transfer your data to other parties with your consent or according to your instructions, such as when you make a data portability request.

We may also provide your personal information to the prosecutor's office, police, courts, and other authorized state bodies, within the limits of legal provisions and as a result of expressly formulated requests.

The transfer of personal data to a third country can only occur if the country to which the data is intended to be transferred ensures an adequate level of protection.

The transfer of data to a country whose legislation does not provide a level of protection at least equivalent to that offered by the General Data Protection Regulation is possible only if there are sufficient guarantees regarding the protection of the fundamental rights of the data subjects. These guarantees will be established by us through contracts concluded with the providers/service providers to whom your personal data will be transferred, and include, but are not limited to, Standard Contractual Clauses (SCC) approved by the European Commission, binding corporate rules, certification mechanisms, or approved codes of conduct.

8. User Rights

Your rights under the GDPR are as follows: a. The right to be informed about the processing of your data. b. The right of access to data. You have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and if so, access to the data and the information specified in Article 15(1) of the GDPR. c. The right to rectify inaccurate or incomplete data. You have the right to obtain from us the rectification of inaccurate personal data concerning you without undue delay. d. The right to erasure (“the right to be forgotten”). In the situations provided for in Article 17 of the GDPR, you have the right to request and obtain the deletion of personal data. e. The right to restrict processing. In the cases provided for in Article 18 of the GDPR, you have the right to request and obtain restriction of processing. f. The right to transmit the data we hold about you to another operator (“the right to data portability”). g. The right to object to data processing. In the cases provided for in Article 21 of the GDPR, you have the right to object to the processing of data. h. The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects concerning you. i. The right to seek legal recourse for the protection of your rights and interests. j. The right to lodge a complaint with a Supervisory Authority.

Name: The National Supervisory Authority for Personal Data Processing

Address: B-dul G-ral. Gheorghe Magheru No. 28-30, Sector 1, Bucharest, Romania

Phone: +40.318.059.211 or +40.318.059.212

9. Questions, Requests, and Exercising Rights

If you have questions or concerns about the processing of your information, wish to exercise your legal rights, or have any other concerns about privacy, you can contact us at the email address contact@softwareup.io.

10. Updates to the Privacy Policy

This Privacy Policy was published and last updated on the date mentioned above. We may update this Privacy Policy from time to time by updating this post. Changes to this Privacy Policy are effective when they are posted. You acknowledge and agree that it is your responsibility to periodically review this Site and this Privacy Policy and to be aware of any modifications. Use of the Site following such modifications will constitute your acknowledgment of the modified Privacy Policy and agreement to abide by and be bound by the modified Privacy Policy.