GDPR policy — keeping personal data safe

How TECH INGRAINED SRL applies Regulation (EU) 2016/679 and protects the data processed through the Tech Ingrained platform.

Version of 2026-10-06

1. Principles

We process personal data lawfully, fairly and transparently, only for stated purposes, no more than needed, keeping it accurate, for no longer than necessary, and with appropriate security (Article 5 GDPR).

2. Our roles

• Controller: for account, billing, waiting-list and site visitor data.
• Processor: for call data and the documents clients upload. We process it only on the client's instructions, keep it confidential, use only the sub-processors listed in the Privacy policy, help the client with data subjects' requests and impact assessments, tell the client without delay about incidents, and delete the data when the contract ends.

3. Technical and organisational measures

• Encrypted connections (HTTPS/TLS) between the browser, the platform and our providers.
• Passwords are stored only as Argon2id hashes; API keys, SIP account passwords and integration keys are encrypted in the database with AES-256-GCM, under a key kept apart from the database.
• Each client's data is kept apart; access is by role (owner, administrator, member, viewer), and actions are recorded in an audit log.
• Audio recordings are kept in a private store in the European Union, with no public access; they are played only through signed links valid for 15 minutes, and every playback is recorded.
• Limits on sign-in and sign-up attempts; sessions can be ended remotely.
• Integrations created by clients can reach only public HTTPS addresses; access to the platform's internal networks is blocked on every connection.
• Database backups before every update of the platform.
• Access to the infrastructure only for authorised staff bound by confidentiality.

4. Security incidents

If an incident affects personal data, we notify the supervisory authority within 72 hours of becoming aware of it where the law requires, inform the affected clients without delay and, where the risk is high, the people concerned. Every incident and the measures taken are documented.

5. Exercising your rights

Requests for access, rectification, erasure, restriction, portability, objection or withdrawal of consent go to office@techingrained.com. We may ask for information to confirm your identity. We answer within one month of receiving the request, free of charge, except for requests that are manifestly unfounded or excessive.

For call data, requests go to the business that was called, which is the controller; we help it answer in time.

6. Sub-processors and transfers

The providers that process data for us, and the rules for transfers outside the European Economic Area, are listed in the Privacy policy. We tell clients before adding a new sub-processor.

7. Contact

We are not required to appoint a data protection officer. Write to office@techingrained.com, or to Bd. Pipera Nr. 1 V/B, Bl.11, Parter, Ap.13, Voluntari, Jud. Ilfov, with any question. You have the right to complain to the Romanian data protection authority, ANSPDCP, www.dataprotection.ro.

This is a translation; the Romanian version prevails.