1. Data controller & scope of application
This privacy policy describes how ProComm Systems SRL ("ProComm Systems", "we", "us", or "our") collects, uses, stores, protects, and discloses personal data obtained through our website (procomm.ro), contact forms, customer portals, and all software applications, web/desktop/mobile tools, and API integrations developed and operated by our company.
2. Data we process
Depending on your interaction with our website, services, or applications developed by us, we may process the following categories of personal data:
- Identification and contact data: full name, company, role, email address, phone number, city, and messages submitted via contact forms or direct communication.
- Commercial, account, and billing data: information required for quoting, contract conclusion and performance, invoicing, payment verification, technical support, and ongoing maintenance.
- Technical and logging data: IP address, access timestamp, browser and device identifiers, visited pages, referral source, system diagnostics, and security logs.
- Authentication and third-party integration data (including Google): when you choose to authenticate or connect a ProComm Systems application with third-party services (such as Google OAuth / Google APIs), we may access basic profile information (name, email address, profile picture, unique Google ID), secure OAuth tokens, and operational parameters strictly necessary for the requested feature.
- Communications and support data: content of technical support inquiries, correspondence history, customer feedback, and service requests.
We do not collect special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data, health data) under Article 9 GDPR. Please do not submit such data.
3. Purposes and legal grounds for processing
| Processing Purpose | Data Categories | GDPR Legal Basis |
|---|
| Delivering services and application functionality (including authentication and user-authorized integrations) | Account data, email, name, technical identifiers, OAuth tokens | Art. 6(1)(b) GDPR |
| Responding to inquiries, contact messages and quote requests | Name, email, phone, company, message content | Art. 6(1)(b) / Art. 6(1)(f) GDPR |
| Conclusion, execution and billing of IT services and software contracts | Identification, billing, contractual, financial data | Art. 6(1)(b) / Art. 6(1)(c) GDPR |
| Compliance with legal obligations (tax, accounting, statutory archiving) | Accounting records, contracts, payment and invoice records | Art. 6(1)(c) GDPR |
| Infrastructure security, fraud prevention, and cyber defense | IP addresses, system logs, security events, diagnostics | Art. 6(1)(f) GDPR |
| Website performance measurement and user experience optimization | Aggregated statistics, anonymized online identifiers | Art. 6(1)(a) or Art. 6(1)(f) GDPR |
In all circumstances where processing is based on legitimate interest (Art. 6(1)(f) GDPR), we conduct a balancing assessment to ensure your fundamental rights and freedoms are preserved.
4. Recipients, processors and international transfers
We may disclose your personal data strictly to the extent necessary to fulfill legitimate purposes to the following categories of recipients:
- Hosting and cloud infrastructure providers, secure data centers, email service providers, and IT maintenance partners;
- Security, uptime monitoring, and web analytics service providers (including Google Analytics with IP anonymization);
- External professional advisors (accountants, auditors, legal counsel) bound by strict professional confidentiality;
- Public authorities, courts, or law enforcement bodies, solely where strictly required by applicable law or to defend our legal rights.
ProComm Systems SRL does NOT sell, rent, or trade your personal data or Google user data to third parties, data brokers, or advertising networks.
Data is primarily stored on secure servers located within the European Economic Area (EEA). If a provider involves international data transfers outside the EEA, we ensure adequate safeguards pursuant to GDPR (such as European Commission Standard Contractual Clauses and supplementary security measures).
5. Retention periods and data deletion
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to satisfy statutory obligations:
- Contact inquiries and quote requests: up to 24 months from the date of the last interaction, if no commercial contract is executed.
- Contract, billing, and accounting data: for the duration of the contract and subsequently for up to 10 years in compliance with Romanian accounting and tax legislation.
- Technical and security logs: up to 12 months, based on cybersecurity monitoring and incident prevention requirements.
- Data associated with Google OAuth sessions and integrations: for the active duration of the user session or until the user disconnects the integration or requests data deletion.
Deletion Procedure: Upon expiration of the applicable retention period or upon receipt of a valid data deletion request from the user, personal data is permanently and irreversibly purged from active databases or securely anonymized within a maximum of 30 days.
6. Data subject rights and permission revocation
Under Regulation (EU) 2016/679 (GDPR), you are entitled to the following fundamental rights:
- Right of access: the right to confirm whether we process your data and obtain a copy of that data.
- Right to rectification: the right to obtain the correction of inaccurate personal data without undue delay.
- Right to erasure ("right to be forgotten"): the right to request data erasure when it is no longer needed for its initial purpose or upon consent withdrawal.
- Right to restriction of processing: the right to restrict processing in circumstances specified under Article 18 GDPR.
- Right to data portability: the right to receive provided data in a structured, commonly used, and machine-readable format.
- Right to object: the right to object at any time to data processing based on our legitimate interest.
- Right to withdraw consent: the right to withdraw consent at any time without affecting prior lawful processing.
- Right to lodge a complaint: the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP - www.dataprotection.ro) or competent courts.
To exercise any of these rights or to submit a data deletion request, please send a written request to [email protected]. We will respond to your request within a maximum of 30 calendar days.
Revoking Permissions in your Google Account: If you have connected a ProComm Systems application or service with your Google Account, you can revoke access at any time directly through your Google Account Security dashboard at: https://myaccount.google.com/permissions.
7. Google Services, Google User Data & Limited Use Requirements
This section specifically describes how software applications, web platforms, desktop/mobile utilities, and integrations operated by ProComm Systems SRL access, use, store, protect, and share Google user data obtained through Google APIs or Google OAuth 2.0 (including YouTube Live API, Google Drive API, or other Google Workspace services).
A. What Google User Data is Accessed
Our applications strictly access only the specific categories of data explicitly authorized by the user via the Google OAuth consent screen:
- Identity and basic profile data: name, primary email address, profile picture URL, and unique Google user ID, used exclusively for authentication, user profile setup, and communication.
- Authorization tokens (OAuth Tokens): temporary access tokens and refresh tokens required solely to maintain an authorized connection between the application and the requested Google service.
- Operational data specific to the chosen feature: metadata strictly required to execute the user-requested action (such as stream titles, descriptions, and scheduling parameters for YouTube Live API streaming integration, or file/folder paths explicitly designated by the user for backup/archiving via Google Drive API).
B. How We Use Google User Data
We use data received from Google APIs EXCLUSIVELY to provide, operate, and enhance user-facing features within our applications. We do not use Google user data for secondary, undisclosed, or unauthorized purposes.
C. Sharing, Transfer, and Disclosure of Google User Data
Our policy regarding Google user data sharing is unequivocal:
- No Sale of Data: We do not sell, rent, trade, or transfer Google user data to third parties, data brokers, or information resellers.
- No External Disclosure: We do not transfer or disclose Google user data to third parties for purposes other than providing the core functionalities requested by the user.
- Technical Infrastructure Sub-processors: Data is processed technically only by trusted cloud infrastructure and secure server providers hosting our applications, bound by strict data processing agreements and GDPR security standards.
D. Strict Prohibitions: Advertising & AI/ML Models
In full compliance with Google Developer Policies:
- Prohibition of Targeted Advertising: We do not use or transfer Google user data for targeted advertising, personalized ads, retargeting, interest-based advertising, or advertising profiling.
- Prohibition of Credit Scoring: We do not use Google user data to determine creditworthiness, underwriting, or for lending purposes.
- Prohibition of AI/ML Model Training: Google user data and data obtained via Google Workspace APIs are NOT used to develop, improve, or train generalized machine learning (ML) or artificial intelligence (AI) models, nor non-personalized AI/ML models.
E. Security Mechanisms & Protection of Sensitive Data
We apply advanced technical and organizational security measures to safeguard the confidentiality and integrity of Google user data:
- Encryption in transit using modern HTTPS / TLS 1.3 cryptographic protocols;
- Encryption at rest using industry-standard AES-256 encryption for sensitive data and authorization credentials;
- Strict role-based access control (RBAC) policies enforcing least-privilege principles;
- Continuous vulnerability monitoring and comprehensive security audit trails;
- Automatic and immediate invalidation of access tokens upon session termination or account disconnect.
F. Retention, Deletion, and Revocation
Google user data is retained only for the duration necessary to deliver the requested service or until the user requests data deletion or disconnects their Google account. Upon receipt of a deletion request, all associated data is permanently erased within 30 days.
To request data deletion, you can email us at [email protected]. Additionally, you can revoke application access at any time from your Google Account settings at: https://myaccount.google.com/permissions.
Google Limited Use Compliance Statement:
ProComm Systems SRL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8. Cookies and analytics tools
The procomm.ro website may use cookies and similar technologies for technical operation, security maintenance, performance measurement, and optimizing user browsing experience.
- Strictly necessary cookies: essential for core platform functionality, security defense, Cross-Site Request Forgery (CSRF) protection, and session preference persistence.
- Analytics and performance cookies: used to understand how visitors interact with our pages (for instance, via Google Analytics with anonymized IP addresses). These are loaded only based on your consent.
You can manage or disable cookies at any time through your web browser configuration settings.
9. Security, confidentiality and contact details
General Security Measures
We maintain stringent technical and organizational measures to safeguard personal data against unauthorized access, destruction, loss, alteration, or unlawful disclosure. These measures include firewall protection, encryption, continuous log inspection, and strict internal access controls.
Protection of Minors
Our website, services, and applications are intended exclusively for individuals with full legal capacity and corporate entities, and are not directed to minors under 16 years of age. We do not knowingly collect personal data from minors.
Policy Updates & Notification
We may update this privacy policy periodically to reflect statutory changes, technological advancements, or modifications in our applications. In the event of material changes regarding how we use your data or Google user data, we will notify users through our website or application interface prior to the changes taking effect.
Contact & Inquiries
For any question, request to exercise GDPR rights, or personal data deletion inquiry, please contact us at: