Data Processing Notice

Data Processing Notice

This notice is given under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) by Simplix QWERTY S.R.L., registered under no. J10/25/2017, tax identification no. 36902772, Str. Școlii 64A, Pleșești, com. Berca, jud. Buzău, România, the controller of the personal data processed by BIMUtils ID. Contact for data protection matters: contact@simplix.ro. It summarises each processing activity; the Privacy Policy explains them in full.

1. Account and sign-in

• Data: e-mail address and its verification, name, language, password hash, account status.
• Purpose: creating and keeping your account; signing you in to the Service and to the BIMUtils products.
• Legal basis: performance of the contract (Art. 6(1)(b)).
• Retention: while the account exists; unconfirmed registrations 30 days.

2. Account security

• Data: two-step verification settings and encrypted authenticator secret, passkey public keys, trusted browsers, verification codes (hashed), sessions with IP address and browser information, failed sign-in attempts, security audit entries.
• Purpose: preventing unauthorised access to your account and to the products.
• Legal basis: legitimate interest (Art. 6(1)(f)) — the protection of your account, which you share.
• Retention: sessions at most 14 days idle or 90 days in total; the rest while the account exists, audit entries minimised after deletion as the law requires.

3. Disclosure to the products you use

• Data: a random identifier, e-mail address and its verification, name, language; later changes, suspension, deletion and sign-out notices.
• Recipients: only the BIMUtils products you sign in to, each an independent controller under its own privacy policy.
• Legal basis: performance of the contract (Art. 6(1)(b)) — signing in to a product is the service you ask for.
• Retention at the Service: the list of products you used and the first and last use, while the account exists.

4. Consent records

• Data: the document versions you accepted, the date, IP address and browser.
• Purpose: proving which terms you accepted.
• Legal basis: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)).
• Retention: while the account exists, then in minimised form for as long as the law requires.

5. Service e-mails

• Data: e-mail address, name, language, the message and its delivery status.
• Purpose: verification codes and security notices. We send no marketing.
• Legal basis: performance of the contract (Art. 6(1)(b)) and legitimate interest in security (Art. 6(1)(f)).
• Processor: ZeptoMail by Zoho (EU data centre).

6. Processors and transfers

We use processors bound by a data processing agreement: the e-mail delivery provider and the providers of the servers hosting the Service in the European Union. Your data is not transferred outside the European Economic Area.

7. Your rights

Access, rectification, erasure, restriction, objection and portability (Articles 15–21 GDPR), exercised from your profile (download your data, change your details, delete your account) or by writing to contact@simplix.ro. You may lodge a complaint with ANSPDCP (www.dataprotection.ro) or with the supervisory authority of your EU country. Providing your e-mail address and a password is necessary to have an account; without them we cannot provide the Service. No decision about you is based solely on automated processing.