Privacy Policy

We collect the following categories of personal data: • Contact & account data: name, email address, company name, phone number (when provided via contact forms, demo requests, or account registration). • Usage data: pages visited, features used, session duration — collected via Google Analytics 4 and Plausible Analytics. • Newsletter: email address if you subscribe voluntarily. • Platform data: project files, documents, and BIM-related data uploaded by users of the CDE 19650 Cloud platform (processed on behalf of the account holder under a data processing agreement).

We process your personal data on the following legal bases under GDPR (Regulation EU 2016/679): • Contract performance: to provide the CDE 19650 Cloud service and respond to support requests. • Legitimate interest: to improve our services, prevent fraud, and send relevant product updates to existing customers. • Consent: for newsletter subscriptions and analytics cookies (you may withdraw consent at any time). • Legal obligation: where required by Romanian or EU law.

All data is stored on Microsoft Azure Cloud infrastructure located in the West Europe region (Netherlands/Romania). We implement technical and organizational measures including: • Encryption in transit (TLS 1.2+) and at rest. • Role-based access control (RBAC). • Regular security audits. • Data backup with point-in-time recovery. We do not sell, rent, or share your personal data with third parties for marketing purposes.

We use the following third-party services that may process data on our behalf: • Microsoft Azure — cloud infrastructure and data storage (EU region). • Google Analytics 4 — website usage analytics (data anonymized, IP masking enabled). • Plausible Analytics — privacy-first website analytics (no cookies, no cross-site tracking). • Brevo (formerly Sendinblue) — transactional email delivery. Each processor has signed a Data Processing Agreement (DPA) as required by GDPR Article 28.

We retain personal data only as long as necessary: • Account data: for the duration of the contractual relationship, plus 3 years after termination for legal compliance purposes. • Contact form submissions: 2 years. • Analytics data: 14 months (Google Analytics 4 default), indefinitely for Plausible aggregate statistics (no personal data stored by Plausible). • Newsletter: until you unsubscribe.

As a data subject under GDPR, you have the following rights: • Right of access (Art. 15): request a copy of your personal data. • Right to rectification (Art. 16): request correction of inaccurate data. • Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"). • Right to restriction of processing (Art. 18). • Right to data portability (Art. 20): receive your data in a machine-readable format. • Right to object (Art. 21): object to processing based on legitimate interest. • Right to withdraw consent: at any time for consent-based processing (e.g. newsletter). To exercise any of these rights, contact us at: contact@hexcloud.ro You also have the right to lodge a complaint with the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Website: www.dataprotection.ro

This website uses: • Essential cookies: required for the platform to function (session management, CSRF protection). These cannot be disabled. • Analytics cookies: Google Analytics 4 (can be disabled via your browser settings or by opting out at tools.google.com/dlpage/gaoptout). • No advertising or tracking cookies are used. Plausible Analytics does not use cookies at all.

We may update this Privacy Policy periodically. When we make material changes, we will notify registered users by email. The "Last updated" date at the top of this page will always reflect the current version.

For any privacy-related questions or to exercise your data subject rights: HEXCLOUD CONSULTING SRL Email: contact@hexcloud.ro Romania