1. Who we are
1.1 Data controller
The controller of your personal data is AppCold, which you can contact at [email protected].
1.2 How to contact us about privacy
For any question about this policy or to exercise your rights, write to [email protected].
1.3 When we act as processor
When we build, host or maintain software for our clients, we may process personal data on their behalf — for example, data of their customers or employees stored in systems we work on. In that case, our client is the controller and we act as processor under a Data Processing Agreement. This policy does not cover that processing; please refer to the privacy policy of the relevant client.
2. Personal data we collect
2.1 Data you give us
Depending on how you interact with us, we may collect:
- identification and contact data — name, work email, phone number, company, job title;
- request details — the service you are interested in, a description of your project, stack, systems, timeline, budget and preferred way of contact;
- contract and billing data — company details, billing address, fiscal code, bank details, invoices and payment history;
- project data — communications, meeting notes, tickets, requests, feedback and approvals;
- Client Portal data — account details, user roles, login history and activity in the portal;
- recruitment data — CV, experience, portfolio and other information you send us when applying.
2.2 Data collected automatically
When you visit our website, our hosting infrastructure automatically records technical data such as IP address, browser type, device, pages requested, date and time, and referring page, in server logs. These logs are used for security, troubleshooting and to keep the website working.
2.3 Data from other sources
We may receive data about you from your employer or colleagues (for example, when they add you as a project contact or portal user), from public sources such as company registers and professional networks, and from partners who recommend us.
2.4 Special categories of data
We do not ask for, and ask you not to send us, special categories of personal data (such as health, political opinions or religious beliefs) or data about criminal convictions, except where strictly required by law.
3. Why we use your data and on what legal basis
3.1 Answering requests, audits and quotations
We use the data you send through our contact and quotation forms to reply to you, prepare an audit or a quotation and schedule calls. Legal basis: steps taken at your request before entering into a contract (article 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (article 6(1)(f) GDPR).
3.2 Providing our services
We use client and contact data to perform our contracts: managing projects, delivering software, providing maintenance and support, operating the Client Portal and communicating with your team. Legal basis: performance of a contract (article 6(1)(b) GDPR) or, for contact persons of our clients, our legitimate interest in performing the contract with their employer (article 6(1)(f) GDPR).
3.3 Invoicing, accounting and legal obligations
We process billing and transaction data to issue invoices, keep accounting records and comply with tax and other legal obligations. Legal basis: compliance with a legal obligation (article 6(1)(c) GDPR).
3.4 Security and protection of our rights
We use server logs and account activity to protect our website, systems and Client Portal against abuse, fraud and attacks, and we may use data to establish, exercise or defend legal claims. Legal basis: our legitimate interests (article 6(1)(f) GDPR).
3.5 Business communications
We may send our clients and business contacts occasional information about similar services, articles or events. You can opt out at any time by using the link in each message or by writing to us. Where required by law, we ask for your consent first. Legal basis: legitimate interest (article 6(1)(f) GDPR) or consent (article 6(1)(a) GDPR).
3.6 Recruitment
We use the data you send us when applying to evaluate your application. With your consent, we may keep your application for future opportunities. Legal basis: steps prior to a contract (article 6(1)(b) GDPR) and consent (article 6(1)(a) GDPR).
3.7 No automated decision-making
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
6. International transfers
6.1 Transfers outside the EEA
We prefer providers that store data in the European Economic Area. If a provider processes data outside the EEA, we make sure the transfer is protected by an adequacy decision of the European Commission (including the EU–U.S. Data Privacy Framework, where the provider is certified) or by the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
7. How long we keep your data
7.1 Retention periods
We keep personal data only for as long as necessary for the purposes described above:
- enquiries that do not lead to a contract — up to 2 years from our last interaction;
- client and project data — for the duration of the contract and up to 5 years after it ends, for the defence of legal claims;
- accounting and tax documents — for the period required by law (currently up to 10 years);
- Client Portal accounts — until the account is closed, and logs for up to 12 months;
- server logs — up to 90 days, unless needed to investigate an incident;
- job applications — up to 6 months after the recruitment process, or up to 2 years with your consent.
At the end of these periods, data is deleted or anonymized.
8. How we protect your data
8.1 Security measures
We apply technical and organizational measures appropriate to the risk, including encryption in transit, access control based on the least-privilege principle, multi-factor authentication for internal systems, secure credential storage, regular updates, backups and confidentiality obligations for everyone who works with us.
8.2 Data breaches
If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours where required, and inform affected persons without undue delay when the breach is likely to result in a high risk to their rights and freedoms.
9. Your rights
9.1 Rights under the GDPR
Under the conditions set by the GDPR, you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased, when there is no longer a reason to keep it;
- restrict the processing of your data in certain circumstances;
- receive your data in a structured, machine-readable format and transmit it to another controller (data portability);
- object at any time to processing based on our legitimate interests, and to direct marketing;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
9.2 How to exercise your rights
Send your request to [email protected]. We will reply within one month of receipt; this period may be extended by two further months for complex requests, in which case we will tell you why. We may ask for information to confirm your identity. Requests are free of charge, unless they are manifestly unfounded or excessive.
9.3 Right to lodge a complaint
If you believe we process your data unlawfully, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or with the supervisory authority in the EU country where you live or work. We would appreciate the chance to address your concerns first.
10. Providing your data
10.1 Is providing data mandatory?
Fields marked as required in our forms are needed to answer your request. Data needed for contracts and invoicing is required to enter into and perform a contract with us. If you do not provide it, we may not be able to answer or work with you. All other information is optional.
11. Children
11.1 Our services are for businesses
Our website and services are aimed at businesses and professionals and are not intended for children under 16. We do not knowingly collect personal data from children.
12. Third-party websites
12.1 Links and integrations
Our website may link to third-party websites and mention third-party platforms. Their privacy practices are governed by their own policies, which we encourage you to read.
13. Changes to this policy
13.1 Updates
We may update this Privacy Policy to reflect changes in our services or in the law. The current version is always available on this page, with its “Last updated” date. If changes are significant, we will inform our clients and portal users by email or through the Client Portal.