DomavexDomavex

Privacy and GDPR

How personal data is handled, and how to exercise your rights.

Operator-published notice. Effective date: Oct 27, 2026. The operator is responsible for keeping this notice accurate.

1. Who is responsible

The operator is the controller for its own account, support and service operations. An organization may be the controller for data it supplies, with the operator acting as processor under a data processing agreement.

Name
EDURITO ED SRL
CUI
50699860
Trade Reg. No.
J2024030794005
EUID
ROONRC.J2024030794005

Send privacy questions and rights requests to contact@domavex.com.

2. Data processed

  • Account information, including email, profile details, organization memberships and roles.
  • Password hashes, verification and recovery records, and session information.
  • Content submitted to the service and messages sent to support.
  • Technical and security records, such as request times, network information and error logs.
  • Terms acceptance and marketing or cookie choices.
  • Billing references if a separately offered paid service is used.

Passwords are stored as hashes, not readable passwords. Optional provider sign-in stores the provider's stable account identifier and shared email, plus encrypted short-lived sign-in and consent attempts. Provider access and identity tokens are not retained. Never send passwords, provider tokens, callback URLs, verification codes or unnecessary sensitive information to support.

3. Purposes and legal bases

Personal data is processed on appropriate legal bases for the service provided, including contract performance for requested features, legal duties for required records, legitimate interests in proportionate security measures, and consent for optional marketing or nonessential tracking.

Accepting terms or acknowledging this notice is not blanket consent. Optional marketing and cookie consent can be refused without preventing account creation.

4. Your optional choices

Marketing consent starts unchecked. A new provider account has its own terms acceptance and marketing choice; these are not copied from another account with the same email. You can change marketing consent in Account and preferences or contact the operator. Necessary verification, password recovery and security messages are not marketing. Cookie choices are separate and available on the cookie preferences page.

An operator may enable optional Google Ads campaign and completed-signup measurement. This requires separate optional-cookie permission and sends Google technical browser/network information, consented ad-click identifiers and, for a new signup, a random single-use transaction ID. Account details and authentication credentials are not measurement inputs. Analytics, advertising personalization, enhanced conversions and retroactive signup measurement are disabled. Refuse or withdraw on the cookie page without losing account access. See the Google Ads disclosure for locations, cookies, retention and withdrawal limitations.

The advertising disclosure was updated on 2026-09-06. Unversioned or older optional-cookie allowances do not grant permission for this disclosure; a fresh explicit allowance of the current notice is required. Essential-only refusals remain effective. Reading preferences or signing in never upgrades a previous choice.

5. Recipients and processors

Information may be available to authorized organization members, personnel and providers that need it to operate the service, or where disclosure is required by law. Choosing an available Apple, Google or Facebook sign-in redirects to that provider, which processes the login under its own policies. Request the applicable data processing agreement before supplying organizational personal data.

Cloudflare provides edge network and DNS services.

6. International transfers

Where GDPR applies, transfers outside the European Economic Area use an applicable legal mechanism and safeguards.

Standard contractual clauses and applicable European Union transfer safeguards apply where data is processed outside the European Economic Area.

7. Retention and deletion

Closing an account, leaving an organization and requesting erasure are different actions. Retention reflects actual purposes, contractual requirements, legal duties, security records and backup lifecycles. Deletion from the live service does not immediately remove a retained backup.

Enquiry and operational records are retained only as long as necessary to respond to enquiries and meet legal and tax obligations.

8. Your rights

Where applicable, you may have rights of access, correction, erasure, restriction, portability and objection, subject to legal conditions and exceptions. You may withdraw consent without affecting prior lawful processing. Contact the privacy address and identify the account or organization concerned. Proportionate identity checks may be needed.

GDPR requests are normally answered within one month; any permitted extension must be explained. You may complain to a competent supervisory authority.

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

9. Security and automated decisions

Authentication, role controls and password hashing help protect accounts. No internet service can guarantee absolute security. This service does not implement automated decisions with legal or similarly significant effects.

10. Updates

Read the terms and cookie policy for related information.