Privacy policy — Oifers.com

Oifers.com is operated by STNS Development SRL, a company registered in Romania, with its registered office at STR. CERNEI 7, CLUJ NAPOCA, CLUJ, CUI RO40021487, Trade Register (Reg. Com.) No. J2018004729120.

You may contact us at:

E-mail: oifers@oifers.com Phone: +40 758 539 919 Address: STR. CERNEI 7, CLUJ NAPOCA, CLUJ

This Policy explains how we collect, use, store and protect personal data when you use Oifers.com.

STNS Development SRL acts as data controller for the data of its own customers and users, and as processor (Art. 28 GDPR) for the data that client companies enter or collect through the Platform, as follows.

When we process data for our own purposes, for example:

• account management;
• invoicing;
• the contractual relationship with customers;
• platform security;
• support;
• our own marketing;
• website administration, including usage statistics (Google Analytics 4, only with consent).

When we process data entered or collected by our customers through the Platform, on behalf of and in accordance with the instructions of the Customer: the data of their end clients, the data of offer recipients, the offer access log, the data from the OTP acceptance flow and the data of their suppliers' contact persons.

The Customer who enters or collects this data is its controller. The processing takes place under the data processing agreement in the Terms and Conditions (§22bis).

In the electronically recorded acceptance flow of a public offer (identity form, e-mail address, confirmation by OTP code, ticking of consent for the texts displayed in the flow), the data of the offer recipient are processed by STNS in its capacity as processor in relation to the Customer's organization that created the offer and distributed the link; the Customer determines the commercial purpose and the content of the legal messages displayed to recipients in that flow. For the same technical purpose, operational data (e.g. IP address, public session identifiers), described in the section dedicated to public links, are also processed.

We may collect the following categories of data:

• last name;
• first name;
• e-mail address;
• telephone number;
• encrypted password;
• role within the organization;
• account status;
• associated organization.

• trade name;
• legal name;
• CUI / VAT code;
• address;
• e-mail;
• telephone;
• website;
• logo;
• cover image;
• bank details, such as IBAN and bank;
• brand settings and preferences.

• name;
• company;
• e-mail;
• telephone;
• address;
• tax code;
• other data voluntarily entered by the Customer.

This data is processed by STNS as processor, on behalf of the Customer (§2.2).

• offer title;
• project;
• associated client;
• products and services offered;
• prices;
• quantities;
• discounts;
• VAT;
• currency;
• notes;
• images;
• public links;
• offer status;
• dates of publication, expiry or revocation.

• IP address;
• browser;
• operating system;
• device type;
• approximate location (country, city), determined from the IP address;
• screen resolution;
• referrer;
• pages accessed;
• date and time of access;
• session identifier;
• session duration;
• security logs;
• actions performed in the Platform.

• company name;
• CUI;
• billing address;
• billing e-mail;
• pricing plan;
• payment history;
• subscription status.

Full card data, if online payments are used, are processed by the payment provider and are not stored directly by us.

• messages sent to support;
• requests;
• attached files;
• communication history.

To the extent that this function is available and enabled for the organization, the following may be processed by STNS, as processor, on behalf of the Customer, in respect of the person who accesses the link and completes the acceptance in the Platform:

• identification of the recipient in the flow: last name, first name, e-mail address (this may coincide with a client previously saved in the CRM by the organization, if users have pre-filling);
• technical evidence of address confirmation: the fact that an OTP code was requested/expired/regenerated and the raw results of the verification (without storing the entire content of the e-mail messages sent to the recipient outside the necessary technical log);
• recording of the ticked consent and of the text: versions of the fragments communicated to the recipient (including the ticked terms text, notifiable versions of policies) according to the Customer's configuration;
• summary capture ("snapshot"): a technical reproduction of the structure of the viewed offer or of the totals at the moment of recording, if this option exists for the Customer's audit;
• history records ("funnel events"): chronological markers (e.g. viewing, identity submission, code sending, verification results, recorded acceptance);
• together with the technical data already listed in §3.5 / §6 (IP, user-agent, referrer, session, duration where applicable).

The data resulting from the acceptance are visible to the Customer's team in the administrative area ("Acceptance" / audit) and are processed for the needs of this professional relationship between the recipient and the Customer.

We collect data:

• directly from users, upon account creation or use of the Platform;
• from the administrators of organizations who create accounts for other users;
• through the use of the Platform;
• through the accessing of public offer links;
• through the completion of the optional electronically recorded acceptance flow (OTP form on the offer page), where this function is active;
• through cookies and similar technologies;
• when you sign in with a Google account: the Google account identifier, name and e-mail address;
• through third-party providers, such as payment processors or e-mail services.

We process data for the following purposes:

• account creation;
• authentication;
• organization administration;
• creation and sending of offers;
• display of public offer pages;
• management of products, clients and users.

Legal basis: performance of the contract or pre-contractual steps.

• issuance of invoices;
• management of subscriptions;
• confirmation of payments;
• financial and accounting records.

Legal basis: performance of the contract and legal obligations.

• access logs;
• detection of suspicious activities;
• protection of accounts;
• prevention of fraud;
• investigation of incidents.

Legal basis: legitimate interest and legal obligations.

• recording of access to public links;
• generation of statistics for the Customer;
• display of the opening status;
• estimation of session duration.

Role: STNS processes this data as processor, on behalf of the Customer. The legal basis (as a rule, the Customer's legitimate interest, or consent where the law requires it) is determined by the Customer, as controller.

• responding to requests;
• technical notifications;
• account-related information;
• subscription-related messages.

Legal basis: performance of the contract and legitimate interest.

• usage analysis;
• error remediation;
• development of features;
• internal testing;
• aggregated reporting.

Legal basis: legitimate interest.

• information about new features;
• commercial offers;
• promotional communications.

Legal basis: consent or legitimate interest, depending on the situation and the applicable legislation.

• enabling recipients to technically complete the flow communicated by the Customer (e-mail confirmation by OTP, ticking of agreement to the displayed texts, technical recording of events);
• making the logs and audit data relating to the acceptance available to the Customer;
• security of the flow and limitation of abuse (rate limiting of OTP requests, protection against excessive automated attempts — Art. 32 GDPR, integrity).

Role of STNS: STNS processes the recipients' data in this flow as processor of the Customer (Art. 28 GDPR), only on the Customer's instructions, under the data processing agreement in the Terms and Conditions (§22bis). The security measures (including the limitation of OTP requests) are those required of the processor by Art. 32 GDPR.

Between the Customer and the offer recipient: the specific legal basis (performance of a contractual relationship, consent under Art. 6(1)(a), legitimate interest under Art. 6(1)(f), or others applicable), as well as the information under Art. 13 / 14 GDPR and the exercise by the recipient of the rights under Chapter III GDPR, are determined and assumed by the Customer, in accordance with the nature of its operations and the Romanian / EU law applicable in the relationship with the recipient. STNS provides the software tools defined in the Terms of Service.

The transactional e-mail containing the OTP code and the related messages is sent by STNS through the e-mail sub-processor (§9), on behalf of the Customer. The controller of this data is the Customer; STNS is the processor that provides the software tool.

When a person accesses an offer through a public link, we may collect technical data such as:

• IP;
• time of access;
• browser;
• operating system;
• device;
• screen resolution;
• approximate location (country, city), determined from the IP with a database stored on our servers, without sending the IP to third parties;
• referrer;
• approximate session duration;
• heartbeat events.

This information is made available to the Customer who created the offer, so that it can see when and how many times the offer was opened and from which device. STNS processes this data as processor, on behalf of the Customer, who is its controller.

The Customer is responsible for informing offer recipients, where the applicable legislation so requires.

Electronically recorded acceptance and OTP code. If the function is available for the organization, after accessing the public page the recipient may enter personal data and may request that a unique verification code be sent to the e-mail address indicated. The associated processing operations (including the log of attempts and the delays on resending the code) serve the purposes set out in §5.8 — with viewing in the administrative interface for the Customer to whom the offer belongs — and reasonable security measures (Art. 32 GDPR).

We use cookies and similar technologies for:

• authentication;
• security;
• operation of the Platform;
• preferences;
• usage analysis.

Strictly necessary cookies are used for the operation of the Platform.

Non-essential cookies, including Google Analytics 4, are loaded only after you have given your consent; consent can be withdrawn at any time.

For details, please consult the Cookie Policy.

We may disclose data to:

For storing and running the Platform (DigitalOcean, Frankfurt data centre).

For sending transactional or commercial messages (Brevo) and for correspondence with support (Zoho Mail).

Online payments relating to subscriptions are processed exclusively through Stripe Payments Europe Ltd. (registered office: 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland), a payment processor authorized and supervised in the European Union and certified PCI-DSS Level 1, on the basis of a data processing agreement concluded with STNS Development SRL.

For the global operation of the Stripe infrastructure, certain data may be transferred to Stripe, Inc., the parent company headquartered in the United States of America (354 Oyster Point Boulevard, South San Francisco, CA 94080, USA). See §10 for the safeguards applied to this transfer.

The data transmitted to Stripe in the course of the payment process include, as applicable:

• the last name and first name of the cardholder (from the Checkout field);
• the e-mail address;
• the billing address;
• the tax code (CUI / VAT ID), if entered by the Customer;
• the currency, amount and description of the subscription;
• the IP address and user-agent from which the payment was initiated, for fraud prevention.

Full card data (PAN, CVV/CVC, expiry date) are entered directly on the Stripe interface and never pass through the servers of STNS Development SRL. We receive from Stripe only opaque identifiers (e.g.: customer_id, subscription_id, payment_intent_id, the last 4 digits of the card, the card type) necessary for keeping subscription records and issuing the invoice.

For details regarding the processing carried out by Stripe in its capacity as a controller in its own right, please consult the Stripe Privacy Policy available at https://stripe.com/privacy.

For measuring website usage (Google Analytics 4), only after your consent to cookies.

For maintenance, security and development.

If we are legally obliged to do so or if it is necessary for the defence of our rights.

We do not sell personal data to third parties.

Below is the updated list of the main categories of third-party providers that we use to operate the Platform. The list may be amended; any significant change will be communicated reasonably in advance of its application.

• DigitalOcean, LLC — hosting and storage: servers, database, cache and file storage (DigitalOcean Spaces: images, logos, exports); location: Frankfurt, Germany (EU).
• Brevo — sending transactional e-mails (account verification, OTP codes, sending offers, notifications); location: EU.
• Stripe Payments Europe Ltd. and Stripe, Inc. — payments, subscriptions, invoicing and VAT calculation (Stripe Tax); location: Ireland (EU) and USA (§10).
• Google Ireland Limited (Google Analytics 4) — website usage statistics, only with your consent to cookies; location: EU, with possible transfers to the USA (§10).
• Zoho (Zoho Mail) — the e-mail used for support and correspondence (oifers@oifers.com).

Approximate location from the IP is determined with the GeoLite2 database (MaxMind), stored on our servers; no IP address is sent to MaxMind, which is not a sub-processor.

The detailed list (regions, services) may be requested at oifers@oifers.com.

To the extent possible, we use providers that store data in the European Union or in the European Economic Area (EEA).

Transfers to Stripe, Inc. (USA) are necessary for the global operation of Stripe's services (payment processing, fraud prevention, global reporting). Stripe, Inc. adheres to the EU–U.S. Data Privacy Framework (DPF) and is self-certified under the DPF framework established by European Commission Adequacy Decision C(2023) 4745 of 10 July 2023. In addition, Standard Contractual Clauses (SCC) approved by European Commission Implementing Decision (EU) 2021/914 are concluded between the parties, as a fallback safeguard mechanism in the event that the DPF is suspended or amended. Details: https://stripe.com/privacy-center/legal.

Some providers in §9 (for example DigitalOcean, LLC and Google) are companies headquartered in, or with affiliates in, the USA, even where the data is stored in the EU. For these and for any other transfers outside the EEA, we will use appropriate legal mechanisms (adequacy decision, standard contractual clauses, binding corporate rules, etc.) and will assess the impact risk (TIA) in accordance with the case law of the CJEU and the EDPB guidelines.

We retain data only for as long as necessary for the purposes described in this Policy.

As a guide:

• account data: for as long as the account exists;
• invoicing data: in accordance with tax and accounting obligations;
• technical logs: for a reasonable period necessary for security;
• offer data: for the duration of the account, until deletion or in accordance with the Customer's instructions;
• support data: for the period necessary to resolve the request and to defend rights;
• marketing data: until consent is withdrawn or an objection is raised;
• data from the electronically recorded acceptance (event log, OTP verification data, versioned terms texts, offer snapshot at the time of recording) and the offer access log: kept on behalf of the Customer, for the duration of the contractual relationship between STNS and the Customer or until deleted by the Customer; after termination, they are deleted in accordance with the Terms (§22bis, §31), unless the law requires them to be retained; the rights of the data subject are exercised against the Customer, as controller, in accordance with Chapter III GDPR.

We implement reasonable technical and organizational measures, such as:

• authentication;
• encrypted passwords;
• role-based access control;
• data isolation by organization;
• secure connections;
• logs;
• backup;
• limitation of internal access;
• infrastructure protection measures.

However, no system can guarantee absolute security.

Under the GDPR, data subjects may have the following rights:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to data portability;
• the right to object;
• the right to withdraw consent;
• the right not to be subject to an individual automated decision, where applicable;
• the right to lodge a complaint with the supervisory authority (in Romania: the National Supervisory Authority for Personal Data Processing, ANSPDCP).

To exercise your rights, you may contact us at oifers@oifers.com.

If the request concerns data entered by a Customer into the Platform, we may redirect the request to the respective Customer, as the latter is the controller of the data.

If you are a recipient of an offer accessed through a public link (including if you have used the online acceptance function), the Customer organization that issued the offer is the controller of your data, and requests concerning access, rectification, erasure or restriction of processing are addressed to it. If you write to us at oifers@oifers.com, we forward the request to the Customer and assist it, as processor, in responding to you.

We will respond to requests from data subjects within the time limit provided by the applicable legislation.

We may request additional information to confirm the identity of the requester.

The Platform is not intended for children and we do not knowingly collect data of minors.

If we discover that such data have been entered without a legal basis, we may take measures to delete them.

We do not use personal data for automated decisions that produce significant legal effects on data subjects.

We may update this Policy periodically.

The updated version will be published on the website and will indicate the date of the last amendment.

For questions regarding data protection:

STNS Development SRL (which operates the Oifers platform) E-mail: oifers@oifers.com Phone: +40 758 539 919 Address: STR. CERNEI 7, CLUJ NAPOCA, CLUJ