Legal information
Information on the processing of personal data
This GDPR Information Notice is intended to inform you of the personal data processing operations carried out by CREASOFT TIME MANAGEMENT SRL, a company registered with the Trade Register under no. J2021007098407, unique registration code RO 44137701, with its registered office in Bucharest, 7 Iuliu Maniu Boulevard, Sector 6, Building A, Staircase 3, 4th Floor, Room 13A, Postal Code 061072, in its capacity as personal data controller in its relationships with the contracting Beneficiaries of the services and products offered by Creasoft, as detailed in the General Terms and Conditions (TCG).
PRELIMINARY INFORMATION
Thank you for your interest in our company. When you enter into a business relationship with us, you entrust us with your information. The information presented in this document (hereinafter the „Information Notice”) is important. We recommend that you read it carefully, as it explains how we, as Controller under Regulation (EU) no. 679/2016 (hereinafter the „Regulation” or „GDPR”), process and protect personal data. This information notice also sets out the categories of personal data we process, the purposes of processing („why do we process personal data?”), the storage period, your rights, how you can exercise your rights and other information required under the GDPR.
By visiting the website, purchasing our services/products or interacting with us by any means and/or through any communication channel (email, telephone, social networks, etc.), you agree to this Information Notice. If you do not agree with what is described in this Information Notice, please do not use our services.
DEFINITIONS
„GDPR”, „RGPD” or „the Regulation” means Regulation (EU) no. 679/2016 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
„Data subject” means any identified or identifiable natural person whose personal data is processed by us as controller, such as clients, prospective clients and website visitors.
„Processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
„Consent” means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
„Personal data” or „personal information” means any information relating to an identified or identifiable natural person („data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Other terms used in this document have the meaning given to them by the GDPR and the other applicable legal provisions.
OUR COMMITMENT
Protecting personal data is very important to us. That is why we are committed to complying with European and national legislation on the protection of personal data, in particular the GDPR, and with the following principles:
Lawfulness, fairness and transparency
We process personal data lawfully, fairly and transparently. We are always transparent about how we use personal data, and you are informed appropriately.
Purpose limitation
Personal data is collected for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes.
Data minimisation
We collect and use only the personal data strictly necessary to fulfil the purposes.
Accuracy
We take the necessary steps to ensure that the personal data we process is accurate and up to date.
Storage limitation
We store data only for the minimum period necessary to fulfil the purposes.
Security and confidentiality
We have implemented reasonable security and encryption measures to protect your personal data as well as possible. However, please note that no website, application or internet connection is completely secure.
CHANGES
We may change this Information Notice at any time. All updates and changes to this Information Notice take effect immediately after notification, which we will make by posting on the website/at the company’s premises and/or by other means permitted by law.
QUESTIONS AND REQUESTS
If you have questions or concerns about the processing of your data, if you wish to exercise your legal rights or if you have concerns about how we handle any privacy matter, you can write to us at dpo@creasoft.ro.
THE PERSONAL DATA WE PROCESS
Creasoft processes the following categories of personal data.
Identification and contact information
☒ First and last name ☒ Telephone
☒ Age ☐ Nickname
☒ Date of birth ☒ Identity document
☒ Sex ☒ Nationality
☒ Domicile ☒ Residence
☒ Email ☐ Birth certificate
☒ Signature
☐ other personal data: identity document series and number, passport series and number, copy of identity document, copy of passport, personal numeric code (CNP).
Monitoring/Tracking
☐ CCTV images (photo and video) ☐ GPS location
☒ IP address
☒ Essential cookies (Authentication and session, Language, Anti-forgery – CSRF protection – Interface settings)
Special categories of data – NO
☐ Racial or ethnic origin ☐ Political opinions
☐ Religious beliefs ☐ Philosophical beliefs
☐ Trade union membership ☐ Genetic data
☐ Biometric data ☐ Health data
☐ Sex life ☐ Sexual orientation
☐ Criminal convictions and offences, including criminal records.
Creasoft is a manufacturer and developer of electronic systems and custom control and monitoring software, including time tracking and payroll.
For the personal data of its clients’ employees, Creasoft acts as a processor, under the data processing agreement (DPA) concluded with each client. The data is hosted in Microsoft Azure, in the European Union. Each database has an administrator appointed by the client, who creates the users and sets their rights. Creasoft staff have no access rights to client data. This processing is described in the DPA and is not covered by this Information Notice.
From clients we may also collect and process data about the name of the company they represent, their position in the company and areas of interest in their field of activity, including HR.
In addition, for the control and monitoring services offered, authorised personnel are identified by presenting an RF card previously registered in the Creasoft Acces application. Based on the code (serial number) read from the card presented, the person holding the card is identified, and a name or staff number is associated with it in the database; this data may be processed by Creasoft.
PURPOSES
We process personal data for the following purposes:
To conclude or perform a contract between you and us;
For business and administrative purposes;
To provide various information about our products and services;
To answer your questions and requests and to provide customer support;
To provide and improve the services we offer;
To diagnose or fix technical problems;
For software demonstrations and demonstrations of how the services work;
To defend ourselves against cyberattacks;
To comply with legislation, for example tax legislation
To establish or exercise a legal claim in court;
LEGAL BASES
To process personal data lawfully, we use one or more of the following legal bases:
Processing of personal data is necessary to conclude or perform a contract between you and us
Processing of personal data is necessary to comply with a legal obligation
In certain situations, processing is necessary to comply with a legal obligation, for example keeping invoices and accounting records for a certain period.
Processing is necessary for the purposes of our legitimate interests
We may use this legal basis only where our interest overrides your rights and interests. Where we rely on legitimate interest, we carry out a legitimate interest assessment (balancing test) in which we weigh our interest against your interests. Where our interests prevail, we will rely on legitimate interest. Where your interests prevail, we will not rely on legitimate interest and, to the extent we cannot identify another legal basis, we will not carry out the processing activity in question.
STORAGE PERIOD
We store personal data only for the period necessary to fulfil the purposes, but no longer than 5 years after the end of the contract or your last interaction with us. After this period, personal data will be destroyed or deleted from IT systems, or turned into anonymous data for use for scientific, historical or statistical research purposes. Please note that in certain situations expressly regulated by law, we store data for the period required by law.
SECURITY OF PERSONAL DATA
We understand how important the security of personal data is and we take the necessary measures to protect our clients and other people whose data we process against unauthorised access to personal data, and against unauthorised alteration, disclosure or destruction of the data we process in the course of our business.
We have implemented the following technical and organisational measures for the security of personal data:
a) Dedicated policies. We adopt and constantly review our internal practices and policies for processing personal data (including physical and electronic security measures) to protect our systems from possible unauthorised access or other potential security threats. These policies are reviewed regularly to make sure we comply with legal requirements and that our systems work properly.
b) Data minimisation. We make sure that the personal data we process is limited to what is necessary, adequate and relevant for the purposes stated in this Policy.
c) Restricting access to data. We try to restrict access to the personal data we process to the minimum necessary: employees, contractors and other people who need to access this data to process it and deliver a service. Our partners and contractors are subject to strict confidentiality obligations (either contractual or legal).
d) Specific technical measures. We use technologies that ensure the security of personal data, always trying to implement the best solutions for data protection. We also make regular data backups so that we can recover data in the event of an incident, and we have regular audit procedures for the security of the equipment we use. However, no website, application or internet connection is completely secure and impenetrable.
e) Ensuring the accuracy of personal data. We may occasionally ask you to confirm the accuracy of your personal data to make sure it reflects reality.
f) Staff training. We constantly train and test our employees and contractors on legislation and best practices in personal data processing.
g) Data anonymisation. Where we can, we try as far as possible to anonymise/pseudonymise the personal data we process, so that we can no longer identify the people it relates to.
Nevertheless, although we make constant efforts to ensure the security of the data you entrust to us, unfortunate events and security incidents/breaches may occur. In such cases, we will strictly follow the procedure for reporting and notifying security incidents and take all necessary measures to restore normality as quickly as possible.
PROFILING AND AUTOMATED DECISIONS
We do not make automated decisions with legal effect or significant impact on you.
YOUR RIGHTS
Your rights under the GDPR are as follows:
(a) The right to be informed about the processing of your data.
(b) The right of access to data. You have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed and, where that is the case, access to that data and to the information set out in Article 15(1) of the GDPR.
(c) The right to rectify inaccurate or incomplete data. You have the right to obtain from us, without undue delay, the rectification of inaccurate personal data concerning you.
(d) The right to erasure („right to be forgotten”). In the situations set out in Article 17 of the GDPR, you have the right to request and obtain the erasure of personal data.
e) The right to restriction of processing. In the cases set out in Article 18 of the GDPR, you have the right to request and obtain restriction of processing.
f) The right to transmit the data we hold about you to another controller („right to data portability”). The right to transmit the data we hold about you to another controller („right to data portability”)
g) The right to object to the processing of data. In the cases set out in Article 21 of the GDPR, you have the right to object to the processing of data.
h) The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significant effects on you.
i) The right to go to court to defend your rights and interests.
j) The right to lodge a complaint with a Supervisory Authority.
| Name | National Supervisory Authority for Personal Data Processing (ANSPDCP) |
| Address | 28-30 G-ral. Gheorghe Magheru Boulevard, Sector 1, postal code 010336, Bucharest, Romania |
| Telephone: | +40.318.059.211 or +40.318.059.212 |
| anspdcp@dataprotection.ro |
Please note that:
(1) If you wish to exercise your rights, you can do so by sending a written, signed and dated request to the email address: dpo@creasoft.ro and/or gdpr@creasoft.ro.
(2) The rights listed above are not absolute. There are exceptions, so each request received will be assessed to decide whether it is justified. If the request is justified, we will help you exercise your rights. If the request is unjustified, we will reject it, but we will inform you of the reasons for the refusal and of your rights to lodge a complaint with the Supervisory Authority and to go to court.
(3) We will try to respond to the request within one month. However, this period may be extended depending on various factors, such as the complexity of the request, the large number of requests received or the impossibility of identifying you in good time.
(4) If, despite all our efforts, we are unable to identify you and you do not provide us with additional information to identify you, we are not obliged to act on the request.
ABOUT THE COOKIE POLICY
To make sure the Creasoft website works properly, we sometimes place small files called „cookies” on your computer or mobile device.
Their purpose is to let the website remember your preferences (such as user name, language, etc.) for a period of time, so you do not need to enter this data again while browsing the site during the same visit.
Creasoft usually uses 2 types of cookies, to:
store visitors’ preferences (filters/sorting) and language
handle authentication and the session
Visitor preferences
These cookies are set by Creasoft and remember:
whether you have accepted (or refused) this website’s cookie policy
whether you have already answered various pop-up surveys, so they are not shown to you again
Operational cookies
Some cookies must be included for certain web pages to work. For this reason they do not require your consent. These are:
authentication cookies
technical cookies required by certain IT systems
Authentication cookies
These are stored when you sign in to a website administered by Creasoft.
Deleting cookies from your device
You can delete all cookies already on your device by clearing your browser history. This deletes the cookies of every website you have visited.
However, this means you may lose some saved information (for example saved sign-in details or site preferences).
Updated on 01.09.2025
Adrian-Constantin Dinu