Privacy Policy

This policy explains what personal data Navitech Systems S.R.L. processes when you visit navitech.systems or contact us, why we process it, how long we keep it and what rights you have. It follows Regulation (EU) 2016/679 (the "GDPR"), Romanian Law no. 190/2018 and Romanian Law no. 506/2004.

1. Who the controller is

Navitech Systems S.R.L.

• Registered office: Str. Zimbrului nr. 3, Suceava, Suceava County, postal code 720217, Romania
• Office and correspondence address: Str. Universității nr. 15A, attic (2nd floor), Suceava, Romania
• VAT / tax ID: RO44938033
• Trade Register no.: J2021001800334
• Email: contact@navitech.systems
• Phone: +40 728 309 209

For any question about your data, write to contact@navitech.systems with the subject "Personal data". We have not appointed a Data Protection Officer (DPO), as our activities do not require one under Article 37 GDPR.

2. What data we process and where it comes from

2.1. Data you give us

Contact form (Contact page): name, email address, company (optional), estimated budget (optional), phone number (optional) and your message. Please do not include sensitive data (for example, health data) or other people's data in your message.

Correspondence by email or phone: your contact details and the content of the conversation.

Clients and partners: if we start working together, we process the details of contact persons (name, role, email, phone) and the data needed for the contract and invoicing. These are described in the contract.

2.2. Data collected automatically

Necessary technical data: IP address, browser type and operating system, date and time of access, requested pages. Our servers use them to deliver pages and for security. The IP address is also used to determine the country you are visiting from (through our own geolocation service), so we know whether to show you the cookie consent banner. We do not keep the IP address for this purpose; we only use the result (the country code).

Visit statistics, only with your consent (the "Analytics" category in the cookie banner):

• Our own analytics: a random visitor identifier, the pages you visit and their titles, visit duration, the referring page and campaign parameters (UTM), browser type and version, device type, country (derived from the IP address without storing the IP) and interaction events (for example, switching tabs or closing the page).
• Google Analytics 4 (Google Ireland Limited): website usage data, online identifiers and device and browser information.
• LiveVisitor (a service developed and operated by Navitech): recording of the browsing session, i.e. your interactions with the page (clicks, scrolling, mouse movement, displayed content), so we understand how the website is used and can improve it. Password fields are not recorded.

Details about cookies and similar technologies are in the Cookie Policy.

Fonts: the website loads fonts from Google Fonts (Google). To do this, your browser sends your IP address to Google's servers.

2.3. Administration accounts

The administration area is used only by the Navitech team. For administrator accounts we process the username, the password (stored only as a hash) and the login session.

3. Purposes and legal bases

Purpose	Data	Legal basis (GDPR)
Answering requests sent through the form, by email or by phone and preparing a quote	contact details, message	Art. 6(1)(b) – steps taken at your request before entering into a contract; Art. 6(1)(f) – our legitimate interest in answering enquiries
Concluding and performing contracts with clients	contact details, contract data	Art. 6(1)(b) – performance of a contract
Invoicing, accounting, archiving	billing data	Art. 6(1)(c) – legal obligation (Romanian Accounting Law no. 82/1991, Fiscal Code)
Operating and securing the website, preventing abuse	technical data, IP address	Art. 6(1)(f) – legitimate interest in a secure, working website
Showing the consent banner depending on country	IP address (only to determine the country)	Art. 6(1)(c) and (f) – compliance with Law 506/2004 and legitimate interest
Visit statistics and improving the website (own analytics, Google Analytics, LiveVisitor)	browsing data, online identifiers	Art. 6(1)(a) – consent, as required by Art. 4(5) of Law 506/2004
Displaying fonts	IP address	Art. 6(1)(f) – legitimate interest in displaying the website correctly
Establishing, exercising or defending legal claims	relevant data	Art. 6(1)(f) – legitimate interest

Where processing is based on consent, you can withdraw it at any time from the Cookie Policy using the "Change preferences" button, without affecting the lawfulness of processing before withdrawal.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you.

4. Who we share data with

We do not sell your data. We only share it as far as necessary with:

• hosting and infrastructure providers (servers, databases, storage) that provide services to us;
• our email provider, through which we receive the notification of messages sent via the contact form and through which we reply;
• Google Ireland Limited / Google LLC, for Google Analytics (only with your consent) and Google Fonts;
• our accountant, legal advisers and auditors, under a duty of confidentiality;
• public authorities, when the law requires it.

Providers that process data on our behalf (processors) are bound by contractual confidentiality and security obligations under Article 28 GDPR.

5. Transfers outside the European Economic Area

Google may transfer data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision (10 July 2023); in addition, Google uses the Commission-approved standard contractual clauses. We do not make any other transfers outside the EEA without appropriate safeguards under Chapter V GDPR.

6. How long we keep data

Data	Maximum retention
Messages received through the form or by email with no subsequent collaboration	up to 2 years from the last communication
Client and contract data	for the duration of the contract and 3 years after it ends (general limitation period)
Financial and accounting documents	5 years, or 10 years for registers and documents where the law requires it
Own visit statistics (analytics)	up to 26 months
Google Analytics	14 months (Google Analytics data retention setting)
LiveVisitor recordings	up to 90 days
Administrator session	30 days from last use

These are maximum periods. We periodically review the data we hold and delete or anonymise data that has exceeded its period, unless the law requires us to keep it longer or we need it to defend legal claims.

7. Your rights

Under the GDPR (Articles 15–22) you have the right:

• of access: to find out whether we process your data and to receive a copy;
• to rectification: to correct inaccurate data or complete it;
• to erasure ("right to be forgotten"), under the conditions of Article 17;
• to restriction of processing, under the conditions of Article 18;
• to data portability for the data you provided, in a structured, commonly used format;
• to object to processing based on legitimate interest, on grounds relating to your particular situation;
• to withdraw your consent at any time, without affecting the lawfulness of earlier processing;
• not to be subject to a decision based solely on automated processing.

To exercise your rights, write to contact@navitech.systems. We reply within one month of receiving the request; for complex requests this may be extended by two further months, in which case we will let you know. We may ask for additional information to confirm your identity.

Complaints to the supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

• address: B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, postal code 010336, Bucharest, Romania
• email: anspdcp@dataprotection.ro
• website: www.dataprotection.ro

You may also contact the supervisory authority in the EU member state where you live or work. We would appreciate the chance to resolve the issue first, so please contact us beforehand.

8. Data security

We use appropriate technical and organisational measures: encrypted connections (HTTPS), access to the administration area only for authorised people, hashed passwords, restricted database access and backups. No system is completely secure; if a personal data breach occurs, we act in accordance with Articles 33–34 GDPR.

9. Children

Our website and services are aimed at companies and adults. We do not knowingly collect data from children under 16. If you learn that a minor has sent us data, write to us and we will delete it.

10. Links to other websites

The website may contain links to third-party websites (for example, social networks or projects built for clients). We are not responsible for their privacy practices; please read their policies.

11. Changes to this policy

We may update this policy when the law or the way we process data changes. The current version is published on this page with the date of the last update. If changes are significant, we will let you know through a visible notice on the website.