Privacy Policy

1. Introduction

This privacy policy describes how POINT OF BUSINESS SOFTWARE S.R.L. (the data controller of the Conexa platform) collects, uses and protects the personal data of its users and customers.

We are committed to protecting your privacy and we comply with all applicable regulations, including Regulation (EU) 2016/679 (GDPR). By using the Conexa platform or the www.conexa.software website, you accept the practices described in this policy.

2. Data we collect

We collect only the data necessary to deliver the service and meet our legal obligations:

Category	Specific data	Main purpose
Identification data	Company name, contact person name, email address, phone number, VAT/Tax ID	Account management, billing
Authentication data	Password (stored encrypted), session tokens	Access security
Usage data	Activity inside the application, support tickets, knowledge base articles	Service delivery, improvement
Technical data	IP address, browser type, device information	Security, technical operation

3. Purposes of processing

We use the data collected only for the declared purposes:

Delivering and operating the Conexa platform
Managing user accounts, invitations and access rights
Billing and subscription management
Technical support and service-related communications (confirmations, notifications, updates)
Improving the application and user experience based on anonymized data
Meeting legal obligations (accounting, reporting)

We do not use your data for marketing purposes without your explicit consent.

4. Legal basis

We process data on one of the following legal bases, depending on the operation:

Performance of a contract — to deliver the Conexa service under the active subscription
Consent — for marketing communications or optional uses, where applicable
Legitimate interest — for platform security, fraud prevention and service improvement
Legal obligations — for billing, tax reporting and other legal requirements

5. Storage and retention

Data is stored in a secure environment, on servers located in the European Union. We keep it for as long as necessary for the declared purposes or as required by law (e.g. billing data — at least 10 years under Romanian tax law).

After the contractual relationship ends, or at your request, data that is no longer needed is deleted or anonymized in line with our internal policy and GDPR requirements. The standard deletion period after subscription cancellation is 90 days, during which the data can be exported on request.

6. Cookies and similar technologies

We use cookies and similar technologies only for the platform to function:

Essential cookies — required for sign-in, session continuity and basic operation of the application. They cannot be disabled without affecting access to the service.
Functional cookies — remember user preferences (language, interface settings).

We do not use advertising or tracking cookies for marketing purposes without your explicit consent. The www.conexa.software website may use technical cookies so that forms work correctly and to enable anonymous traffic analysis.

7. Your rights (GDPR)

As a data subject, you have the following rights, which you can exercise at any time:

Right of access

You can request a copy of the personal data we process about you.

Right to rectification

You can ask us to correct inaccurate data or complete incomplete data.

Right to erasure

You can request that data be deleted in the cases set out by the GDPR (the "right to be forgotten").

Right to restriction

You can ask us to limit how we process your data in certain situations.

Right to portability

You can receive the data you have provided in a structured, commonly used, machine-readable format.

Right to object

You can object to processing based on legitimate interest.

Withdrawal of consent

You can withdraw your consent at any time, without affecting the lawfulness of earlier processing.

Right to lodge a complaint

You can lodge a complaint with ANSPDCP, the Romanian data protection authority (dataprotection.ro).

To exercise your rights, contact us at office@conexa.software. We respond within 30 days of receiving the request.

8. Data sharing

We do not sell or trade your personal data. We may share data with third-party service providers that help us operate the platform (cloud hosting, payment processors, email services), only to the extent necessary and under contracts that require them to comply with GDPR standards.

All third-party providers with access to personal data are carefully selected and have bound by strict contractual obligations regarding confidentiality and data security. We do not transfer data outside the European Economic Area without the safeguards required by the GDPR.

9. Security

We apply appropriate technical and organizational measures to protect personal data:

Encryption in transit (HTTPS/TLS) and at rest for sensitive data
Role-based access control (principle of least privilege)
Continuous audit and monitoring of system access
Automatic daily backups with redundant storage
Security incident response procedures

In the event of a security incident affecting your data, you will be notified in line with GDPR requirements, within a maximum of 72 hours from when we become aware of it.

10. Changes to this policy

We may update this policy periodically to reflect legal or operational changes. Material changes will be communicated by email to active customers at least 15 days before they take effect. The date of the last update is shown at the top of the document.

11. Contact

For any questions about data privacy or to exercise your GDPR rights, you can reach us:

Email: office@conexa.software
Phone: +40 371 234 686 (Mon–Fri, 09:00–17:00 Romania time)
Address: POINT OF BUSINESS SOFTWARE S.R.L., Str. Carol I, nr. 19F, ap. 2, Slatina, Olt county, Romania