Skip to content
SISSOFT

Privacy Policy

The binding legal text is the Romanian version. This English translation is provided for convenience. Read the Romanian version

Last updated:

This policy explains what data SISSOFT processes through sissoft.ro and in its outreach to businesses, why, on which legal basis and for how long — in line with Regulation (EU) 2016/679 (GDPR). It is organised by purpose, so you can quickly find the part that concerns you.

Data controller

SISSOFT GLOBAL SRL, CUI RO35158861, Trade Register no. J2015000386212, with its registered office at Str. Mihail Eminescu nr. 10, bl. MB11, sc. E, et. 1, ap. 8, Slobozia, Ialomița, Romania, is the controller of the data described below. You can reach us at contact@sissoft.ro or by phone at +40 742 955 415. We are not required to appoint a data protection officer; data requests go directly to the company’s administrator.

In short

  • We never sell or rent data to anyone.
  • The site sets no cookies of its own. We measure audience without cookies (Matomo, on our own server); Google Analytics runs only if you accept it.
  • We process contact data only when you write to us, when you use the speed test, or when we write to businesses based on public sources (see B2B outreach).
  • You can object to outreach at any time with a simple STOP.

Forms on the site

The contact form, the audit request forms (accessibility, speed, migration) and the GPSR check form collect: name, email, phone (optional), your store’s address (where relevant), the store platform, your message and, for the GPSR check, the approximate number of listings. Together with the form we record your IP address and browser (abuse protection) and, if you came from a campaign, its parameters, the landing page and the referring site.

Purpose: to answer your request and send you a quote. Legal basis: steps taken at your request prior to a contract (Art. 6(1)(b) GDPR); for the technical anti-abuse data, our legitimate interest in keeping the forms working and spam-free (Art. 6(1)(f)). The checkbox in the form confirms that you have read this policy.

The data reaches us by email, on our own mail server, and in the site’s database. We keep it for as long as the conversation lasts and, if no contract follows, for as long as is reasonable to resume the conversation you started; if we sign a contract, for as long as accounting and tax law requires. IP address and browser are kept for as long as the anti-abuse purpose requires, then anonymised.

The speed test

When you run the free test at /test-viteza, we send the address of the tested store to Google PageSpeed Insights (Google’s public service) and receive the measurements back. We store: the tested store address, the score and detected platform, your IP address and browser (abuse protection and test rate limiting), plus campaign parameters, landing page and referring site.

Your email (and phone, optionally) is stored only if you leave it to receive the full report; we then send the report and may contact you with a quote (Art. 6(1)(b)). For the rest, the basis is our legitimate interest in offering a free tool and protecting it from abuse (Art. 6(1)(f)). A store address is usually not personal data, but we do not publish it and share it with no one but Google, for measurement. IP address and browser are kept for as long as the anti-abuse purpose requires, then anonymised.

B2B outreach — where we get your company’s data

On our own initiative, we write to companies that run online stores and that we believe we can help (accessibility under Romanian Law 232/2022, speed, migration). We did not receive the data from you, so this section is the notice required by Art. 14 GDPR. Every outreach email carries our company details and a link to this section.

Sources. We use public information only:

  • the company’s public website (mainly the contact page and footer);
  • public data from the Romanian tax authority (ANAF: name, tax ID, status, fiscal address, activity code) and the financial statements published on data.gov.ro (turnover, headcount, total assets);
  • web search results, to find the company’s website from its name;
  • public site performance data: Google Chrome UX Report and PageSpeed Insights.

What data. Company name, tax ID and website domain; the generic or role-based email address published for the public (for example office@ or contact@) and the published phone number; public financial indicators (turnover, headcount, total assets), used to determine whether Law 232/2022 applies to the company; technical measurements of the site (platform, speed, automatically detectable accessibility issues). We write to the contact addresses the company itself published for the public and avoid personal addresses; we build no profiles of individuals — we are interested in the company and its site.

Legal basis. Our legitimate interest (Art. 6(1)(f) GDPR): B2B outreach for services intended exclusively for professionals, addressed to companies through the contact channels they published themselves. We balanced this interest against your rights: the data is public and strictly professional, we do not combine it with anything else, we send a single message and at most one follow-up, and objecting is one reply away.

Right to object (Art. 21 GDPR). You can object at any time by replying STOP to the email you received or by writing to contact@sissoft.ro; we stop contacting you and delete your contact details.

Retention. If you do not reply, we delete the contact details 12 months after the last message sent. On STOP, we delete the contact details (email, phone) immediately; we keep only the company name and domain on an exclusion list, so we never write to you again by mistake. If you reply and a conversation starts, the rules under “Forms on the site” apply.

Technical data and audience measurement

Our server keeps technical logs — IP address, requested page, time, browser — for security and debugging (legitimate interest, Art. 6(1)(f)); they rotate automatically and we do not use them to identify visitors. We measure audience with Matomo, installed on our own server and configured without cookies and without individual profiles: it needs no consent and sends nothing to third parties. Google Analytics 4 runs only if you accept it in the banner; details and how to withdraw consent are in the Cookie policy.

Processors and recipients

  • Hetzner Online GmbH (Germany) — hosting of the site, database, email and our Matomo instance.
  • Cloudflare, Inc. — Turnstile, the anti-spam check on forms; receives your IP address and technical browser data. Transfer to the US under the EU-US Data Privacy Framework.
  • Google LLC — PageSpeed Insights and Chrome UX Report (receive the address of the tested or assessed store); Google Analytics only with your consent. Transfer to the US under the EU-US Data Privacy Framework.
  • Serper.dev — the web search service used in outreach; receives only the name of the company searched for.
  • Matomo — self-hosted on our own server in the EU; not a third party, nothing leaves our infrastructure.
  • Meta Platforms (WhatsApp) — only if you choose to write to us on WhatsApp; messages go through WhatsApp under its own privacy policy.
  • Public authorities, only where the law requires it.

We do not sell data and do not pass it to any other third party.

How long we keep data

  • Form requests: for as long as the conversation lasts; if there is a contract, for as long as accounting and tax law requires.
  • Speed test: an email left for the report, as above; results without an email, for internal statistics.
  • Outreach: 12 months after the last unanswered message; immediately on STOP.
  • IP address and browser (forms, speed test, logs): for as long as the security and anti-abuse purpose requires, then anonymised.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (including, at any time, to outreach), as well as the right to withdraw your consent for Google Analytics without affecting earlier processing. We make no automated decisions with legal effects on you.

How to exercise them: write to us at contact@sissoft.ro or reply to any email you received from us. We answer within one month at most. We do not ask for copies of ID documents; if we have reasonable doubts about your identity, we ask for a simple confirmation.

If you are not satisfied with our answer, you can lodge a complaint with the Romanian supervisory authority (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest — dataprotection.ro.

Changes

We update this policy whenever we change the way we process data; the date of the latest version is shown at the top of the page.