Create account · Cursuri

Beta programme — special terms

This is a beta version of the Platform. It is made available for testing and evaluation, before its commercial launch, so that we can validate its functioning and collect feedback. The special terms in this section apply to the beta version in addition to the Terms of Service below and prevail over them where they differ.

Free of charge, no real payments. Access to the beta version is free. Where the Platform shows prices, plans or checkout flows, they are simulated for testing: no real payment is made and no amount is charged, and any "purchase" made on the beta version creates no right to a paid service.
Unfinished software. The beta version may contain errors, incomplete or missing features, and may behave unexpectedly. Features may be added, changed or removed at any time without notice.
Data may be lost. The beta environment may be reset, restored from an earlier state or cleared at any time, with or without notice. Do not use the beta version for data you cannot afford to lose, and keep your own copies of anything important. Accounts and data of the beta version may be migrated to the production version of the Platform, in whole or in part, depending on technical feasibility and solely at the Operator's discretion; no migration is promised.
No service level, no support obligation. The beta version may be unavailable at any time, for any duration. We are not obliged to provide support, maintenance, updates or fixes, although we welcome your reports through the support tickets.
Feedback. Any suggestion, report or idea you send us about the beta version may be used freely by the Operator to improve the Platform, without any obligation towards you.
No reliance, no liability. The beta version is provided "as is", without any warranty of any kind, and you use it at your own risk. To the fullest extent permitted by law, the Operator accepts no liability whatsoever for any loss or damage arising from the use of, or the inability to use, the beta version, including loss of data; the liability limit of 1 (one) EUR stated in the Terms of Service applies to any liability that the law does not allow us to exclude.
Personal data. Personal data processed on the beta version is protected as described in the Privacy Policy and the Data Processing Notice. Please use test data wherever possible, and do not upload personal data of others that you have no right to process.
End of the beta. We may end the beta programme at any time. At its end, the beta environment may be closed and its data deleted, subject to the migration option above.

1. Who we are and what this document is

These Terms of Service (the "Terms") govern the use of the online platform Cursuri (the "Platform"), operated by Simplix QWERTY S.R.L., a company registered under no. J10/25/2017, tax identification no. 36902772, with its registered office at Str. Școlii 64A, Pleșești, com. Berca, jud. Buzău, România (the "Operator", "we", "us"). You can reach us at contact@simplix.ro or, once you have an account, through the support tickets inside the Platform.

The Terms are a binding agreement between you and the Operator. By creating an account, by accepting them where the Platform asks you to, or by using the Platform, you confirm that you have read and agree to them. If you do not agree, do not use the Platform.

Definitions used below: a User is any person who uses the Platform; an Account is the personal access created for a User; a Workspace is an organisation (a company, a school, a team or another group) created inside the Platform and administered by its owners, with its members; Content is any information, file, text or other material that Users upload or create on the Platform; a Consumer is a natural person acting for purposes outside their trade, business or profession.

2. Changes to the Terms

We may update the Terms when the Platform, the law or our services change. Each version is numbered and dated. When a change requires your renewed acceptance, the Platform asks for it at your next sign-in and you cannot continue before accepting; otherwise the new version applies from its publication and your continued use means acceptance. The version you accepted, with its date and content, is available at any time from your profile page.

3. Your Account

You must provide accurate information when registering and keep it current. An Account is personal: one person, one Account, and you may not share your credentials or let anyone else use it.
You are responsible for keeping your password secret and for everything done through your Account. Tell us at once, through a support ticket, if you suspect unauthorised access.
Workspaces are created and administered by their owners. An owner decides who is a member, what each member may do, and answers for the Workspace's use of the Platform. Invitations are sent to e-mail addresses; accepting one makes you a member of that Workspace under the owner's administration.
We may refuse, suspend or close an Account that breaches these Terms, that we reasonably believe is used fraudulently or abusively, or where the law requires it. Where feasible we notify you and give you the chance to remedy the breach first.

4. Eligibility and minors

The Platform does not set a minimum age for use: some services offered through it are addressed to pupils and students. However, paid services may be purchased only by adults (persons of at least 18 years) or, for a minor, by and with the consent of the minor's parent or legal guardian, who is then the party to the purchase. By making a payment you confirm that you are of age, or that you are the parent or legal guardian of the minor who will benefit from the service, or that you act with their consent.

Where a Workspace enrols minors (for instance a school enrolling its pupils), the Workspace owner is responsible for having the authority and the consents the law requires for doing so.

5. Acceptable use

You agree to use the Platform lawfully and in accordance with these Terms. In particular you will not:

upload, publish or transmit Content that is unlawful, infringes the rights of others, is defamatory, harassing, obscene or contains malicious code;
attempt to gain unauthorised access to the Platform, other Accounts, Workspaces or data, probe or circumvent its security, or interfere with its operation;
scrape, crawl or extract data from the Platform by automated means, reverse-engineer it, or use it to build a competing service;
send unsolicited messages, impersonate others, or misuse the Platform's communication features;
use the Platform in a way that places an unreasonable load on it or damages the experience of other Users.

We may remove Content and suspend access when we reasonably believe this section is breached, and we will cooperate with the authorities where the law requires it.

6. Your Content

You keep every right you hold in your Content. You grant the Operator a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, transmit, display and technically process your Content solely to provide, secure, maintain and improve the Platform for you and for the Workspaces you are a member of. This licence ends when the Content is deleted from the Platform, except for backup copies kept for a limited time and Content that other Users have lawfully received.

You are responsible for your Content: for having the right to upload it and to share it as you do, and for its accuracy and legality. We do not monitor Content systematically, but we may review and remove Content that breaches the Terms or the law.

7. Paid services

Plans and prices. Some services are paid, as plans, one-time purchases or prepaid periods. The price, currency, what is included and the billing period are shown before you pay. Prices for Consumers include VAT where applicable; prices for businesses are shown as stated on the checkout page.
Payment. Payments are processed by our payment provider (currently Stripe); the Operator never stores your full card details. By paying you authorise the charge for the plan you chose and, for recurring plans, the renewal charges described at purchase.
Subscriptions and renewals. A subscription renews at the end of each period as stated at purchase: either automatically charged, or extended by a further prepaid payment made by you. You can cancel at any time from the Platform; the cancellation takes effect at the end of the current paid period, which you keep in full. We do not refund the unused part of a period, except where the law grants you a right to it.
Changes of plan. Where the Platform offers it, you may change your plan; the terms of the change (immediate with the remaining value credited, or at the end of the period) are shown when you make it.
Non-payment. If a payment fails or is not made when due, we may restrict or suspend the paid features after notifying you, and end the subscription if the payment is not remedied.
Price changes. We may change prices for future periods with at least 30 days' notice given through the Platform or by e-mail; the new price applies from the next renewal after the notice. If you do not agree, cancel before the renewal.
Invoices and receipts are made available inside the Platform or sent by e-mail.

8. Right of withdrawal (Consumers)

If you are a Consumer, you have the legal right to withdraw from a distance contract within 14 days from its conclusion without giving any reason, by notifying us through a support ticket or at contact@simplix.ro. Please note that:

where the service starts, or the digital content is delivered, during the withdrawal period at your express request and with your acknowledgement that you thereby lose the right of withdrawal, the right is lost once the delivery has begun or is complete;
where the service has partly been provided before you withdraw, you owe the proportional part of the price;
subscription renewals are not new contracts for the purpose of the withdrawal right.

Businesses and Workspaces acting for professional purposes have no right of withdrawal.

9. Availability and changes to the Platform

We work to keep the Platform available and secure, but we do not guarantee that it will be uninterrupted or error-free. Maintenance, updates, outages of third-party providers and events outside our control may cause temporary interruptions. We may add, change or discontinue features; for a paid feature that is discontinued during a paid period, we will refund the proportional part of the price or offer an equivalent, at our choice.

10. Intellectual property

The Platform, its software, design, texts, trademarks and other materials belong to the Operator or its licensors and are protected by law. These Terms grant you only a limited, non-exclusive, non-transferable right to use the Platform for its intended purpose. Nothing here transfers any intellectual property right to you.

11. Third-party services

The Platform relies on third-party providers, among them Stripe (payments), Cloudflare (content delivery and file storage) and GetStream.io (real-time features). Their services are subject to their own terms; we choose providers that offer appropriate guarantees, but we are not responsible for their independent conduct. Links to third-party websites are provided for convenience only.

12. Termination

By you. You may stop using the Platform at any time and delete your Account from your profile page. Deletion is confirmed with a code, followed by a short grace period during which you may cancel it; after that your personal data is deleted or anonymised automatically, as described in the Privacy Policy. A Workspace with payment history is kept in anonymised form for as long as accounting law requires.
By us. We may terminate the agreement if you seriously or repeatedly breach the Terms, if the law requires it, or if we discontinue the Platform, in the latter case with at least 30 days' notice and a refund of any prepaid unused period.
Termination ends your right to use the Platform. Sections that by their nature survive (Content licence for lawfully received Content, liability, governing law) continue to apply.

13. Warranties

To the extent permitted by law, the Platform is provided "as is" and "as available". We do not warrant that it will meet your specific requirements or that Content created by Users is accurate or lawful. Consumers keep every warranty and remedy that mandatory law grants them; nothing in these Terms limits those rights.

14. Limitation of liability

To the fullest extent permitted by applicable law:

the Operator is not liable for indirect or consequential loss, loss of profit, loss of data caused by your own actions or by third parties, or damage resulting from the unavailability of the Platform, from Content created by Users, or from the acts of third-party providers;
the Operator's total aggregate liability towards you for all claims arising from or in connection with the Platform and these Terms is limited to 1 (one) EUR.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under the applicable law, in particular liability for intent or gross negligence, for death or personal injury, or the rights that mandatory consumer-protection law grants to Consumers.

15. Indemnity (business Users)

If you use the Platform for professional purposes, you will indemnify the Operator against claims by third parties arising from your Content, your breach of these Terms or your unlawful use of the Platform, including reasonable legal costs.

16. Governing law and disputes

These Terms are governed by the laws of Romania. Any dispute that cannot be settled amicably is submitted to the competent courts of Buzău, Romania. If you are a Consumer, you also keep the protection of the mandatory rules of the country where you reside, and you may address the competent consumer-protection authority; Consumers in the European Union may also use the online dispute resolution platform of the European Commission.

Before any legal action, please contact us through a support ticket: most issues can be solved quickly and directly.

17. Miscellaneous

If any provision of these Terms is found invalid, the remaining provisions stay in force and the invalid provision is replaced by a valid one closest to its purpose.
You may not assign your rights under these Terms without our consent; we may assign them to a successor of the Platform, informing you.
Our failure to enforce a provision is not a waiver of it.
These Terms, together with the Privacy Policy and the Data Processing Notice, are the entire agreement regarding the Platform.
The Terms are provided in several languages for convenience; in case of any conflict, the English version prevails.

18. Contact

Simplix QWERTY S.R.L., Str. Școlii 64A, Pleșești, com. Berca, jud. Buzău, România, registered under no. J10/25/2017, tax identification no. 36902772. E-mail: contact@simplix.ro. Signed-in Users: the support tickets inside the Platform are the fastest way to reach us.

Course-specific provisions (draft — to be reviewed by a lawyer)

This section is a draft written by the platform team, not legal advice. It records how the Platform actually works so that these points can be drafted properly; it is to be reviewed and rewritten by a lawyer.

Who issues the certificate. The certificate of completion is issued by the accredited firm that organises the class, under its own accreditation. The Platform records the class, the attendance and the result, stores the certificate and makes it available to the student — it does not issue it and does not certify the training itself.
Attendance and passing. Attendance is recorded per lesson and the result per class; the conditions under which a student is considered to have completed the course are set by the organising firm, which also decides whether a certificate is issued.
Lesson recordings and how long they are kept. Lessons may be recorded. Every class carries a mandatory end date and a retention rule of between 1 and 60 months (12 by default); the recordings of that class are deleted automatically once that period has passed, and the organising firm may delete them earlier.
A guardian's access. A student may have a guardian — a parent or legal representative — who is given access to that student's own lessons, results and recordings, and to nothing else: never another student's data, never a class-wide view. Access is granted by the organising firm and can be withdrawn by it at any time.

1. Who is responsible for your data

This Privacy Policy explains how Simplix QWERTY S.R.L. (registered no. J10/25/2017, tax identification no. 36902772, Str. Școlii 64A, Pleșești, com. Berca, jud. Buzău, România — the "Operator", "we") collects and uses personal data when you use the platform Cursuri (the "Platform"). For the personal data described here, the Operator is the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 (the "GDPR").

We have not appointed a data protection officer, as the law does not require one for our activity. For anything about your personal data, use the Privacy section of your profile page (most requests are handled there automatically — see section 8) or open a support ticket inside the Platform. Without an account, write to contact@simplix.ro.

Where a Workspace (an organisation created on the Platform) processes the personal data of its own members, pupils, customers or contacts through the Platform, that Workspace decides why and how the data is processed and is the controller of it; the Operator processes it on the Workspace's behalf. The Data Processing Notice describes that relationship.

2. What data we collect

Account data: name, e-mail address, password (stored only as a cryptographic hash), preferred language, profile settings, the roles and Workspaces you belong to.
Registration and security data: verification codes sent to your e-mail, sign-in dates, session identifiers, IP addresses and browser information used to secure your Account.
Workspace data: the details you enter about your organisation (name, identification numbers, address, contact), its members and their roles, the spaces it creates.
Content: the files, texts and other material you upload or create, including the people they may describe.
Payment data: the plans you purchase, amounts, dates, invoices, the identifiers our payment provider returns. Card details are entered directly with the payment provider (Stripe); we never receive or store your full card number.
Support and communication data: the support tickets you open, their messages and attachments, the notifications and e-mails we send you.
Consent records: which document versions you accepted, when and from which address, and your marketing choice — kept as proof of consent.
Technical logs: requests to the Platform (address, time, page or action, technical errors) that keep the Platform secure and working.

Most of this data comes from you. Some comes from Workspace owners who invite you or enter your details, or from our providers (for example the payment status from Stripe).

3. Why we use it and on what legal basis

To provide the Platform — creating and securing your Account, running the Workspaces, delivering the features you use, processing your purchases and sending the service messages this requires (verification codes, password resets, invitations, notifications about your Account or Workspace). Legal basis: the performance of our contract with you (art. 6(1)(b) GDPR).
To comply with the law — issuing and keeping invoices and accounting records, answering lawful requests of authorities, keeping proof of your consents. Legal basis: our legal obligations (art. 6(1)(c) GDPR).
To keep the Platform secure and improve it — technical logs, abuse and fraud prevention, error analysis, statistics about how the Platform is used. Legal basis: our legitimate interest in a secure, reliable Platform (art. 6(1)(f) GDPR), balanced against your rights.
To send you marketing messages — news, offers and information about the Platform, only if you agreed to it. Legal basis: your consent (art. 6(1)(a) GDPR), which you may withdraw at any time.

We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects.

4. Cookies

The Platform uses cookies that are strictly necessary for its operation: a session cookie that keeps you signed in, and functional cookies that store your preferences (for example your chosen language or the appearance of the interface). These cookies do not track you across other websites and require no consent. We do not use advertising cookies. Should a specific service built on the Platform use analytics or other cookies, its own terms and cookie notice describe them and ask for your consent where the law requires it.

5. Who receives your data

We share personal data only as needed to run the Platform, with:

Workspace owners and members — the members of a Workspace see the data relevant to that Workspace (for example your name and e-mail as a member, the Content shared there).
Our processors, who act on our instructions under written contracts: our hosting providers (servers located in the European Union); Stripe (payment processing); Cloudflare (content delivery, file storage and protection of the Platform); GetStream.io (real-time features such as chat or activity feeds, where a service uses them); our e-mail delivery provider.
Authorities and advisers, when the law requires it or to establish, exercise or defend legal claims.
A successor of the Platform, in case of a merger, acquisition or transfer of the business, who takes over these obligations.

We do not sell personal data.

6. Where your data is processed

The Platform is hosted in the European Union. Some providers (such as Stripe, Cloudflare or GetStream.io) may process data in other countries; where a transfer outside the European Economic Area takes place, it relies on an adequacy decision of the European Commission or on the standard contractual clauses approved by it, together with additional safeguards where needed. You may ask us for details through a support ticket.

7. How long we keep it

Account and Workspace data, Content: for as long as your Account exists. After you request deletion, a short grace period applies (during which you may cancel the deletion), then the data is deleted or anonymised automatically.
Accounting documents (invoices, payment records and the Workspace identification they belong to): 10 years, as Romanian accounting law requires. A Workspace with payment history is therefore kept in anonymised form for that period, detached from any person.
Consent records: for as long as we need to prove that a consent existed — the records survive the deletion of the Account in a form that no longer identifies you beyond what the proof requires.
Support tickets: for the life of your Account; after deletion, the messages are anonymised.
Technical logs: 90 days, unless a security incident requires keeping specific entries longer.
Verification codes and similar transient data: minutes to days.

8. Your rights, and what you can do yourself

Under the GDPR you have the right to access your data, to have it rectified or erased, to restrict or object to its processing, to receive it in a portable format, to withdraw a consent at any time (without affecting the lawfulness of processing before the withdrawal), and to lodge a complaint with a supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or the authority of the country where you live.

Most of these rights are exercised directly from the Privacy section of your profile page, automatically and without waiting for us:

Download your data — an export of everything the Platform holds about you, delivered as a protected download link sent to your e-mail.
Delete your account — confirmed with a code; after the grace period, your data is deleted or anonymised automatically, across the Platform.
Manage your consents — see the document versions you accepted, read exactly what you signed, and give or withdraw the marketing consent.
Correct your data — edit your name, e-mail, language and settings from the profile page; Workspace details are edited by their owners.

For anything the profile page does not cover, open a support ticket; we answer within one month, as the GDPR requires (extendable for complex requests, in which case we tell you).

9. Security

We protect personal data with technical and organisational measures appropriate to the risk: encrypted connections, hashed passwords, access limited to what each role needs, separation between Workspaces, logging of security-relevant actions, and regular updates. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the authority as the law requires.

10. Children

Services offered through the Platform may be used by minors, for instance pupils enrolled by a school. Where the law requires it, the consent of a parent or legal guardian is obtained by the Workspace that enrols the minor, which remains responsible for it. Paid services are purchased only by adults or by the minor's parent or legal guardian.

11. Changes to this Policy

We may update this Policy to reflect changes in the Platform or in the law. Each version is dated; the current version is always available on the Platform, and the version you accepted is shown on your profile page. Where a change materially affects you, we ask for your renewed acceptance.

12. Contact

Simplix QWERTY S.R.L., Str. Școlii 64A, Pleșești, com. Berca, jud. Buzău, România. Signed-in Users: the Privacy section of your profile page and the support tickets. Without an account: contact@simplix.ro.

1. Purpose of this notice

This Data Processing Notice is the information that Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (the "GDPR") require us to give you, set out in a formal way, and — in its second part — the terms under which the Operator processes personal data on behalf of the organisations that use the platform Cursuri (the "Platform"). It complements the Privacy Policy, which describes the same processing in everyday language; where the two differ, this notice prevails.

2. Controller and contact

Controller: Simplix QWERTY S.R.L., registered under no. J10/25/2017, tax identification no. 36902772, registered office at Str. Școlii 64A, Pleșești, com. Berca, jud. Buzău, România (the "Operator").

Contact for data protection matters: the support tickets inside the Platform (signed-in users) or contact@simplix.ro. No data protection officer has been designated, the conditions of Article 37 GDPR not being met.

3. Categories of data, purposes and legal bases

Data	Purpose	Legal basis
Identification and contact data (name, e-mail), credentials (hashed password), language and settings, roles and memberships	Creating and administering the account; authentication; delivering the Platform's features; service communications	Art. 6(1)(b) — performance of the contract
Security data (IP address, browser data, session identifiers, sign-in events, verification codes)	Securing accounts and the Platform; preventing abuse and fraud; diagnosing errors	Art. 6(1)(f) — legitimate interest in security and reliability; art. 6(1)(b) for authentication
Organisation (Workspace) data: identification, address, contact, members and roles	Administering the organisation's use of the Platform; invoicing	Art. 6(1)(b); art. 6(1)(c) for invoicing
Content uploaded or created by users	Hosting, displaying and processing it as the user and their organisation direct	Art. 6(1)(b); for third-party data in Content, the basis established by the organisation as controller
Payment data (plans, amounts, dates, invoices, provider identifiers — never full card numbers)	Processing purchases and subscriptions; accounting; tax obligations	Art. 6(1)(b); art. 6(1)(c) — accounting and tax law
Support data (tickets, messages, attachments)	Answering requests; keeping a record of the assistance given	Art. 6(1)(b); art. 6(1)(f) — record keeping
Consent records (document, version, date, address)	Demonstrating the consents and acceptances given (art. 7(1) GDPR)	Art. 6(1)(c)
Marketing preference and the data needed to send marketing e-mails (name, e-mail, language)	Sending information, news and offers about the Platform	Art. 6(1)(a) — consent, withdrawable at any time
Technical logs of requests	Operation, security and troubleshooting of the Platform	Art. 6(1)(f)

Providing identification and contact data is necessary to create an account; without it the Platform cannot be used. Providing payment data is necessary for paid services. Marketing consent is optional and its absence has no effect on the service.

We do not process special categories of data (Article 9 GDPR) for our own purposes. Organisations that process such data through the Platform (for example health information of their members) do so as controllers and must have a lawful basis under Article 9.

No decision producing legal or similarly significant effects on you is taken solely by automated means (Article 22 GDPR).

4. Sources of the data

The data comes from you (registration, use of the Platform, purchases, tickets), from the organisation that invites you or registers you as its member, pupil or contact (which must inform you of it), and from our providers (for example the outcome of a payment from the payment processor).

5. Recipients

The members and owners of the Workspaces you belong to, within that Workspace.
Processors under Article 28 GDPR, bound by written contracts: hosting providers in the European Union; Stripe (payment processing); Cloudflare (content delivery network, file storage, protection of the Platform); GetStream.io (real-time features, where a service uses them); the e-mail delivery provider used for service and marketing messages.
Public authorities, courts, legal and accounting advisers, where the law requires it or for the establishment, exercise or defence of legal claims.
A legal successor of the Operator in respect of the Platform.

6. International transfers

The Platform is hosted in the European Union. Where a processor transfers personal data to a country outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission (Article 45 GDPR) or on the standard contractual clauses adopted by the Commission (Article 46(2)(c) GDPR), supplemented where necessary; a copy of the applicable safeguards can be requested through a support ticket.

7. Retention periods

Account, organisation data and Content: the life of the account, plus the grace period following a deletion request; then automatic deletion or anonymisation.
Accounting and tax documents and the organisation identification they require: 10 years from the end of the financial year, under Romanian accounting law; organisations with payment history are kept anonymised for that period.
Consent records: for as long as needed to demonstrate the consent; after the deletion of the account, in a form reduced to the proof itself.
Support tickets: the life of the account; anonymised afterwards.
Technical logs: 90 days, except entries needed to investigate a security incident.
Verification codes, download links, pending requests: from minutes to a few days.

8. Your rights and how to exercise them

You have the rights of access (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20) and objection (art. 21), the right to withdraw a consent at any time without affecting the lawfulness of the processing carried out before the withdrawal (art. 7(3)), and the right to lodge a complaint with a supervisory authority (art. 77) — in Romania, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro — or with the authority of the Member State of your residence.

The Platform automates the exercise of most of these rights. From the Privacy section of your profile page you can, without any request to us:

obtain a complete export of your data (access and portability) — generated automatically and delivered as a password-protected link sent to your e-mail;
request the deletion of your account (erasure) — confirmed with a code sent to your e-mail, then executed automatically after a grace period during which you may cancel; personal data is deleted, and where a record must be kept by law (accounting) or for another person's rights, it is anonymised so that it no longer identifies you;
see and manage your consents: the documents and versions you accepted, their exact text, and the marketing consent, which you can withdraw with one click;
rectify your identification data and settings directly.

Rights that the profile page does not cover (restriction, objection, questions about a specific processing) are exercised through a support ticket or at contact@simplix.ro. We answer within one month of receipt; where a request is complex or numerous, the period may be extended by two further months, of which we inform you. Requests are free of charge, unless manifestly unfounded or excessive.

9. Security measures

Pursuant to Article 32 GDPR, the Operator applies measures appropriate to the risk, including: encryption of data in transit; storage of passwords only as salted cryptographic hashes; role-based access control and separation between organisations; access to private files controlled by ownership rules; logging of security-relevant and administrative actions; protected download links with a limited lifetime for data exports; regular updates and backups; contractual obligations on processors. Personal data breaches are handled under Articles 33 and 34 GDPR.

10. Processing on behalf of organisations (processor terms)

When an organisation (a "Workspace", the "Customer") uses the Platform to process personal data of its own members, pupils, customers or contacts, the Customer is the controller of that data and the Operator acts as its processor. The following terms, which the Customer accepts by using the Platform for such processing, constitute the contract required by Article 28(3) GDPR:

Subject matter and duration: the hosting and processing of the personal data the Customer enters into the Platform, for as long as the Customer's Workspace exists.
Nature and purpose: storage, organisation, display, transmission and deletion of the data as needed to provide the Platform's features the Customer uses.
Types of data and data subjects: those the Customer chooses to process — typically identification and contact data of its members, pupils, customers or contacts, and the Content relating to them.
Instructions: the Operator processes the data only on the Customer's documented instructions, which are the Customer's configuration and use of the Platform and these terms; the Operator informs the Customer if an instruction appears to infringe the GDPR.
Confidentiality: persons authorised by the Operator to process the data are bound by confidentiality.
Security: the Operator implements the measures described in section 9.
Sub-processors: the Customer gives general authorisation for the sub-processors listed in section 5 and for their replacement; the Operator informs the Customer of intended changes through the Platform, giving it the opportunity to object within 30 days.
Assistance: the Operator assists the Customer, by the Platform's features and where needed through support, in responding to data subjects' requests and in meeting the Customer's obligations under Articles 32 to 36 GDPR.
Breaches: the Operator notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data.
Deletion: at the end of the service, the Customer's data is deleted or anonymised by the Platform's deletion mechanisms, except where the law requires its retention.
Audit: the Operator makes available the information necessary to demonstrate compliance and allows for audits, conducted reasonably, on prior notice and at the Customer's cost, no more than once a year unless a breach occurred.
The Customer's duties: the Customer warrants that it has a lawful basis for the processing, that it has informed the data subjects (including, where minors are involved, obtained the consent of parents or legal guardians where the law requires it), and that its instructions comply with the law.

11. Changes

This notice is versioned; the current version is published on the Platform and the version you accepted is available on your profile page. Material changes are notified and, where required, submitted for renewed acceptance.

Create your account