Privacy policy

Last updated: 20 October 2026

In short

DataFlows builds applications for companies and public institutions, not for individuals. Through this website we process very little personal data: what you send us through the contact form, statistics about visits and the server’s technical logs. We do not sell data and we do not use it for advertising.

Who we are

The data controller is Sly Data Intelligence SRL (DataFlows brand), tax code 47884809, registered office at Șos. Colentina 16, Bl. A5, Ap. B44, Bucharest, 021177, Romania. You can write to us at contact@dataflows.ro or call +40 712 344 092.

What data we process through the website

• Contact form: your name, company, e-mail address, phone number and message. We use them to reply to you and to prepare a demo or an offer. The legal basis is our legitimate interest in answering requests and, where applicable, steps taken before a contract (Art. 6(1)(f) and (b) GDPR).
• Traffic statistics: we use Google Analytics to see which pages are read and how visitors reach the site. The data is aggregated and we do not use it to identify you. Details about cookies are on the Cookie policy page.
• Spam protection: the form uses Cloudflare Turnstile, which automatically checks that the message does not come from a bot.
• Technical logs: the server records the IP address, date and requested page, for security and troubleshooting. We keep them for a limited period.
• Browser preferences: some settings (for example, those of the accessibility widget) are stored only in your browser and never reach us.

Data in DataFlows applications

Our applications are used by companies and institutions. The data entered in them (for example, user accounts or working documents) belongs to the client, who is the controller of that data. DataFlows processes it only as a processor, under the contract signed with the client and following the client’s instructions. For questions about that data, please contact the organisation that uses the application. Our systems are ISO 9001 and ISO 27001 certified.

To run the applications we also use specialised providers, again on the client’s behalf: sending sign-in codes and notifications by e-mail and SMS, file storage and, in applications that offer AI-generated suggestions (for example, proposing the CPV code of a purchase request), an AI service provider, to which we send only the text needed for the requested suggestion. AI suggestions are indicative and are checked by the user. The list of providers used for a given application is available to the client on request.

Sign-in with Google

Some DataFlows applications (for example, DataFlows ALOP) let you sign in with a Google account. In that case we receive from Google only your e-mail address, the confirmation that it is verified and a technical identifier of your Google account. We use them solely to sign you in to an account already created by your organisation’s administrator; Sign-in with Google does not create new accounts. We never receive your Google password and we have no access to your e-mails, files or other data in your Google account. The use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke the application’s access at any time from your Google account settings.

Who we share data with

We do not sell or rent data. We use providers that help us operate: hosting, the e-mail service, Google (Analytics and Sign-in with Google) and Cloudflare (Turnstile). They process data only on our behalf. Some providers may transfer data outside the European Economic Area; in those cases the transfer relies on the standard contractual clauses approved by the European Commission or on other safeguards provided by the GDPR. We disclose data to authorities only when the law requires it.

How long we keep data

We keep messages sent through the form for as long as needed to answer you and for any collaboration that follows, but no longer than two years after the last contact if no contract is signed. Contract and invoicing data is kept for the period required by accounting law.

Your rights

Under the GDPR you have the right to request access to your data, its rectification or erasure, restriction of processing and data portability, and to object to processing based on legitimate interest. For any of these, write to contact@dataflows.ro. We reply within one month. If you are not satisfied, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro) or with the authority in your country.

Security

We use encrypted connections (HTTPS), role-based access, backups and monitoring, and our processes are ISO 27001 certified. No system is completely secure, however; if we learn of an incident that may affect your data, we will inform you as required by law.

Changes

We may update this page when our services or the law change. The date of the last update is shown at the top.