Privacy Policy

1. Who we are (Controller)

AFI OPS TECHNOLOGIES S.R.L. ("AfiOps", "we", "us") is the data controller for the processing of your personal data through this Site.

2. What personal data we collect

Depending on how you interact with the Site, we may collect:

• Contact data: your name, work email address, company and phone number (if provided), and any message you write; the answers you choose in the contact form (the areas you need help with, your main challenge, where your systems run, and how soon you want to start); and, if you ask for a meeting, the date, time, and time zone you propose.
• Readiness check answers: if you complete one of the readiness checks on our homepage or service pages, your multiple-choice answers (six or eight, depending on the check), which check it was, and the resulting score, stored with a random reference number. On their own they do not identify you. If you then submit the contact form from the same browser tab, the reference is sent with your message and your answers become linked to your contact data.
• Technical data: IP address, device type, browser type and version, operating system, referral URL, and server logs.
• Usage data: pages visited, time spent, click patterns — collected only after you consent to statistics cookies; before that, Google receives only anonymous, cookieless signals (see Section 6).
• reCAPTCHA data: when you visit our contact page, Google reCAPTCHA Enterprise loads and processes behavioral signals (mouse movements, interaction timing) and your IP address to verify you are human. Google Cloud EMEA Limited processes this data on our behalf (see Section 4).
• Cookies and similar technologies: see Section 6.

3. Why we process personal data and legal bases (GDPR Art. 6)

We process personal data for the following purposes:

• (a) Responding to inquiries and communicating with potential clients.
  Legal basis: legitimate interests (Art. 6(1)(f)) and/or steps taken at your request prior to entering into a contract (Art. 6(1)(b)).
• (b) Operating, securing, and improving the Site (e.g., server logging, security monitoring, and per-IP rate limiting of the contact form and the readiness checks, which holds IP addresses in memory for 10 minutes).
  Legal basis: legitimate interests (Art. 6(1)(f)).
• (c) Analytics and advertising measurement (optional — only where you have provided consent). This includes measuring which pages are used, and whether an advertising campaign on Google or LinkedIn led to an inquiry.
  Legal basis: consent (Art. 6(1)(a)).
• (d) Fraud prevention and bot detection via Google reCAPTCHA.
  Legal basis: legitimate interests (Art. 6(1)(f)).
• (e) Compliance with legal obligations (e.g., responding to lawful requests from authorities).
  Legal basis: legal obligation (Art. 6(1)(c)).
• (f) Improving the readiness checks, and preparing our reply when you link your result to an inquiry.
  Legal basis: legitimate interests (Art. 6(1)(f)).

4. Who we share data with (Recipients and Processors)

The following third parties handle personal data through the Site. Most are processors, acting only on our instructions; where one acts as a controller in its own right, the entry says so:

• Usercentrics A/S (Cookiebot, formerly Cybot A/S): our consent management platform. It records your cookie choices and signals them to the services below. Strictly necessary — it operates before and regardless of consent, because it is what asks for it.
• Google Cloud EMEA Limited — reCAPTCHA Enterprise: bot detection on our contact form. Processes behavioral signals and your IP address to verify you are human. Strictly necessary for fraud prevention; loaded only on our contact page.
• Google Ireland Limited — Google Tag Manager: loads and governs the measurement and advertising tags listed below, and enforces your consent choices against them.
• Google Ireland Limited — Google Analytics 4: website analytics — which pages are visited, how visitors arrive, and which of them contact us. Statistics consent.
• Google Ireland Limited — Google Ads: measures whether an advertising campaign led to an inquiry, and supports remarketing audiences. Marketing consent. For this data Google is an independent controller, under its controller-controller data protection terms.
• LinkedIn Ireland Unlimited Company — LinkedIn Insight Tag: measures whether a LinkedIn advertising campaign led to an inquiry, and supports remarketing audiences. Marketing consent. LinkedIn and we are joint controllers of this data, under LinkedIn's joint controller addendum.
• Email delivery provider: carries the notification email our contact form sends to our team, which contains the details you submitted.
• Hosting / infrastructure provider (currently Amazon Web Services): operates the Site, its servers and the database in which contact inquiries and readiness check answers are stored. The servers are in AWS's Frankfurt region (eu-central-1), in Germany. Safeguards: AWS Data Processing Agreement and Standard Contractual Clauses.

Every processor is bound to process data only on our instructions and to implement appropriate technical and organizational security measures.

We do not sell personal data to third parties.

5. International transfers

Some of our processors (including Google, LinkedIn, and AWS) are located in or transfer data to countries outside the European Economic Area (EEA), including the United States. Where this occurs, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses (SCCs) approved by the European Commission — to protect your data in accordance with GDPR requirements.

6. Cookies

We use the following categories of cookies:

• Strictly necessary: the Site sets no cookies of its own and has no sessions. What it uses is Cookiebot's consent cookie and your browser's sessionStorage, both described below. No consent required.
• Google reCAPTCHA cookies: set by Google to distinguish humans from bots. They are loaded when you visit our contact page.
• Consent cookies (Cookiebot): store the choices you make in the cookie banner so we do not ask again on every page. No consent required — they exist to record your decision.
• Statistics cookies (Google Analytics 4): used to understand how visitors find and use the Site. Only set after you provide consent. Until you consent, Google receives only anonymous, cookieless signals.
• Marketing cookies (Google Ads, LinkedIn Insight Tag): used to measure whether an advertising campaign led to an inquiry and to build remarketing audiences. Only set after you provide consent.
• Session storage (not cookies): your browser's sessionStorage, for that tab only, holds the scroll position of the pages you visit, so that Back returns you to where you were, and — when you finish a readiness check — a random reference that can be attached to a message you choose to send. Neither is used for anything else, and both are deleted when you close the tab.

You can change or withdraw your cookie consent at any time with the "Cookie settings" link in the footer of every page, or by adjusting your browser settings.

7. Data retention

We retain personal data only for as long as necessary for the purposes described above:

• Contact inquiries: up to 36 months after the last interaction with a prospect or client.
• Readiness check answers: up to 12 months; if linked to an inquiry, kept together with that inquiry.
• Server and security logs: up to 90 days.
• Analytics data (Google Analytics 4): event-level data and user-level identifiers are both retained for up to 14 months, with the period resetting on each new visit by the same user. Aggregated reporting is retained by Google independently of these settings.
• Advertising audiences (Google Ads, LinkedIn): membership expires according to the retention period configured for each audience in the respective platform.

When data is no longer needed, it is securely deleted or anonymized.

8. Your rights (GDPR)

Wherever you are, you have the following rights under the GDPR:

• Right of access: to obtain a copy of your personal data and information about how it is processed.
• Right to rectification: to correct inaccurate or incomplete data.
• Right to erasure: to request deletion of your data ("right to be forgotten"), subject to legal exceptions.
• Right to restriction: to limit how we process your data in certain circumstances.
• Right to data portability: to receive your data in a structured, machine-readable format.
• Right to object: to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at contact@afiops.com. We will respond within one month of receiving your request. For complex or numerous requests we may extend this by two further months, and if so we will tell you within the first month (GDPR Art. 12(3)).

9. Automated decision-making and profiling

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you, as defined in GDPR Article 22.

10. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, or disclosure. These include encrypted data transmission (HTTPS), access controls, and regular security reviews. However, no method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

11. Complaints

You have the right to lodge a complaint with your local data protection supervisory authority. In Romania, the competent authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP — www.dataprotection.ro). If you are located in another EEA member state or the UK, you may contact your national authority.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The "Last updated" date at the top of this page indicates when the most recent changes were made. We encourage you to review this Policy and our Terms of Service periodically.

13. Contact

For questions, requests, or concerns about this Privacy Policy or our data practices, please contact us: