Data protection is a high priority for ENGINYRING. This Privacy policy informs you of the nature, scope, and purpose of the personal data we collect, use, and process in line with the General Data Protection Regulation (GDPR). This policy protects visitors, enquirers, sole traders, representatives, staff and other people whose personal data we process, regardless of our B2B-only service policy. A professional-use declaration is not consent to unrelated processing and does not waive data-protection rights.
1. Data controller
The controller for the purposes of the GDPR is:
ENGINYRING Europe SRL
VAT ID: RO47589108 | ONRC ID: J16/306/2023
Romania
Email: contact [at] serverspan [dot] com
Websites: www.enginyring.com | www.serverspan.com | www.serverspan.ro
2. Definitions
Our data protection declaration is based on the terms used in the GDPR. Key terms include "personal data," "data subject," "processing," "controller," and "processor."
3. Collection of general data and information (log files)
Our website and services collect a series of general data and information when a data subject or automated system accesses them (e.g., browser type, operating system, IP address, date, and time). This information is stored in server log files. This data is processed based on our legitimate interest to deliver the content of our website correctly, ensure the long-term viability and security of our systems, and to provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack.
4. Cookies
Our website uses cookies to provide users with more user-friendly services and to optimize the information and offers on our website. You may, at any time, prevent the setting of cookies through our website by means of a corresponding setting of the Internet browser used and may thus permanently deny the setting of cookies.
5. Registration and client data
5.1 ServerSpan accepts new orders only from registered businesses and registered or lawfully authorised professionals. For enquiries, accounts and orders, we process relevant business and contact details: legal business or professional name, registration country and address, registration or professional-authorisation identifier, tax details where applicable, and the representative’s name, role, email and telephone number. We also process professional-purpose declarations and proportionate evidence of eligibility or authority where needed. Personal data remains protected by the GDPR in a business relationship.
5.2 We use these details to answer enquiries, assess business eligibility and authority, prepare proposals, administer contracts, issue invoices, meet legal obligations and prevent fraud. Depending on the purpose and person concerned, the basis is Article 6(1)(b) GDPR for requested pre-contractual steps or a contract with an individual professional, Article 6(1)(c) for legal obligations, or Article 6(1)(f) for proportionate business-contact administration, eligibility checks and fraud prevention. Registration IP addresses and timestamps are processed for security and fraud prevention under legitimate interests, rather than deemed consent. We request only information reasonably needed for the purpose. If an additional identity check is necessary, we explain its purpose, provider, data requirements and legal basis before requesting documents.
6. Contact via website/email
If you contact us via email or a contact form, the personal data you transmit is automatically stored for the purpose of processing your request or contacting you. This data is not transferred to third parties without your consent, unless required for the resolution of your request.
7. Data disclosure to third parties
To deliver our ordered services or to render the pages on our website, we must share certain personal data with third-party service providers (processors). We only work with third parties that provide sufficient guarantees to implement appropriate technical and organizational measures in a manner that meets the requirements of the GDPR. Our responsibilities as controller remain applicable. Providers may act as processors under appropriate data-processing terms or as independent controllers, depending on their role.
Categories of data shared include:
- Payment processors (Stripe, PayPal, Banca Transilvania): To process transactions, we share your full contact and billing information, including name, address, email, and payment details.
- Domain registrars: To register a domain name on your behalf, we are required to share your name, address, email, and phone number with the relevant domain registry (e.g., EURid, RoTLD).
- Identity verification (Stripe identity): For KYC validation, we share the necessary identification documents and images you provide.
- Infrastructure & content delivery (including Cloudflare, Google and Fastly): To deliver website content efficiently and securely, your IP address and cookie data may be shared with our CDN and analytics partners.
- Backup storage: For services that include backups, backup copies are stored at a third geographical site, separate from the site hosting your data. Depending on the location of your service, this backup site may be outside the European Economic Area; in particular, backups of services hosted in the EU may be stored outside the EU/EEA.
Where personal data is transferred outside the European Economic Area ("EEA"), the transfer must comply with Chapter V GDPR, using an applicable adequacy decision, appropriate safeguards such as standard contractual clauses, or another lawful transfer mechanism where its conditions are met. An enquiry or professional-use declaration is not blanket consent to international transfers. Contact us using Section 1 for information about relevant destinations and safeguards.
8. Your rights as a data subject
Under the GDPR, you have the following rights:
- Right of access: The right to obtain information about your personal data we process.
- Right to rectification: The right to obtain the correction of inaccurate personal data.
- Right to erasure ('right to be forgotten'): The right to have your personal data erased, subject to legal retention obligations.
- Right to restriction of processing: The right to restrict the processing of your data under certain conditions.
- Right to data portability: The right to receive your data in a structured, commonly used, and machine-readable format.
- Right to object: The right to object to the processing of your personal data for direct marketing or on grounds relating to your particular situation.
- Right to withdraw consent: The right to withdraw your consent to processing at any time.
- Right to lodge a complaint: The right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).
To exercise these rights, you may contact us at any time at the address provided in Section 1.
9. Legal basis for processing
We process personal data based on the following legal grounds:
- Art. 6(1)(a) GDPR: Consent, for specific purposes like newsletters.
- Art. 6(1)(b) GDPR: Necessity for the performance of a contract to which you are a party.
- Art. 6(1)(c) GDPR: Necessity for compliance with a legal obligation (e.g., tax laws).
- Art. 6(1)(f) GDPR: Necessity for the purposes of our legitimate interests, such as ensuring network security, preventing fraud, administrative purposes, and improving our services, except where such interests are overridden by your fundamental rights and freedoms.
10. Data retention period
We store personal data only for the period necessary to achieve the purpose of storage or as required by law (e.g., statutory retention periods for commercial or tax purposes). After this period, the data is routinely deleted. Data may be retained for longer periods if it is necessary for the establishment, exercise, or defense of legal claims.
11. Provision of personal data
The provision of personal data is necessary to enter into a contract with us. Failure to provide the necessary data would result in the contract not being concluded.
12. Automated decision-making
As a responsible company, we do not use automated decision-making or profiling.