Privacy policy

At Clickware we respect your privacy. This policy explains what personal data we process through this website, for what purpose and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR).

Data controller

Clickware SRL — Aleea Slt. Adrian Cârstea, Nr. 13, Bl. 37, Scara 2, Etaj 8, Ap. 141, Sector 3, Bucharest, Romania. Contact email: info@clickwaresys.com.

What data we process and why

On the public site

• Contact form. When you write to us we process the data you provide: name, email address, company (optional), project type and the content of your message. The purpose is to handle and respond to your enquiry.
• Security and abuse prevention. When you submit the form, your IP address is processed transiently to prevent automated submissions and spam.

We do not collect data through analytics or tracking (see the cookie policy).

In the private area

The private area is a restricted space where we make technical documentation and the use of proprietary tools available to specific people at the companies we work with. It is not an open sign-up: we create the accounts ourselves, and they only exist where there is a professional relationship behind them.

• Access account. Name, email address, phone number (optional) and the sets of documentation you are given access to. The purpose is to identify you and show you what is yours to see.
• Password. Only certain accounts have one. It is stored using an irreversible derivation function (argon2id); we do not keep the password in clear text and cannot recover it, only reset it.
• Entry code. To sign in we email you a single-use code that expires after five minutes. We store a cryptographic digest of it, not the code itself.
• Session. While you are signed in we keep a record of the open session: when it started, when it last showed activity, when it expires, and a (non-reversible) digest of the browser you signed in with, so that we can detect a session being used from somewhere else. In your browser this is held by a technical cookie, described in the cookie policy.
• Activity log. We record sign-ins, failed attempts and administrative operations (creating, disabling or changing an account). Some of these entries include the IP address the request came from.
• Abuse control. We count requests per account and per IP address over time windows, to stop password guessing and bulk downloading of the documentation. When an account crosses a threshold, an email alert is sent to the administration accounts stating who, how much and when.

Legal basis

• Contact form: our legitimate interest in handling and managing the enquiries you send us (Art. 6(1)(f) GDPR) and, where your request is directed at possibly engaging our services, the taking of pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Private area: our legitimate interest, and that of the company or organisation you belong to or represent, in managing the existing professional relationship, allowing the people it authorises to access the documentation that concerns them, and keeping that access protected (Art. 6(1)(f) GDPR). Where you are personally a party to the contract, the processing necessary to perform it is based on Art. 6(1)(b) GDPR.
• Spam filtering, activity logging, abuse prevention and security: our legitimate interest in ensuring the security and integrity of the service, preventing and detecting misuse, investigating incidents, and protecting the documentation and systems against unauthorised access (Art. 6(1)(f) GDPR).

Where the basis is legitimate interest, you have the right to object to the processing; we explain this under your rights.

Recipients

Your data is processed by Clickware. To operate, the site, the private area and the sending of email rely on hosting and email providers acting as processors on Clickware’s behalf. We do not sell or share your data with third parties for their own purposes.

The private area security alerts are sent solely to Clickware’s administration accounts.

International transfers

We do not transfer your data outside the European Economic Area. Should a provider ever involve a transfer, it would be covered by the safeguards required by the GDPR.

Retention

• Contact form messages: for as long as necessary to handle your request and manage the resulting relationship; afterwards they are deleted or blocked for the applicable legal period.
• Private area account: for the duration of the professional relationship. When it ends, the account is disabled; one month later we email you to say it is about to be removed, and it is then deleted, with a second email confirming this. We reserve the right to cancel an account immediately and without that prior notice where the terms of use of the area are breached, in particular through the misuse described above.
• Entry codes and expired sessions: 30 days.
• Security alerts already sent: 90 days.
• Activity log: 12 months.

The last three periods do not depend on anyone remembering them: an automated weekly process deletes whatever has expired.

Your rights

You may exercise your rights of access, rectification, erasure, restriction, objection and portability by writing to info@clickwaresys.com.

Since the processing described here rests mainly on our legitimate interest, the right most worth knowing about is the right to object: you may ask us to stop processing your data on grounds relating to your particular situation, and we will stop unless there are compelling legitimate grounds which override your interests, rights and freedoms.

If you believe we have not handled your request properly, you may lodge a complaint with the competent supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro. You may also contact the supervisory authority in your EU country of residence.

Automated decisions and minors

We do not carry out profiling or automated decision-making producing legal effects concerning you. The abuse control described above is automatic and may temporarily block an account or an IP address for a few minutes, but it is a technical security measure, reversible and limited in time.

Cancelling an account, by contrast, is always decided by a person. The automated alerts inform our team; they do not act on their own. And you can always write to us.

Neither this site nor the private area is directed at minors.