Privacy Policy

pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”)

Last updated: 16 October 2026

This privacy policy explains how we process the personal data of visitors to the Rilvo websites, including rilvo.net (together with the other Rilvo websites, such as rilvo.it, rilvo.ro and rilvo.eu, the “Sites”), and of people who contact us for information about the Rilvo Coworker service before any contract is concluded.

1. Controller

The controller is S.C. Asperitas Solutions S.A., a joint-stock company incorporated under Romanian law (“Rilvo”, “we”, “us”).

Registered office: Aleea Cioplea nr. 14, parter, cam. 1, Brașov, Romania
Trade Register No.: J8/985/2017 – Tax/VAT ID (CUI): RO37465749
Telephone: +40 726 329 199
General contact: contact@rilvo.net

Privacy contact: for any question about this policy or to exercise your rights, write to privacy@rilvo.net.

We have not appointed a Data Protection Officer (DPO).

2. Scope of this policy

This policy covers processing relating to the Sites and to pre-contractual contacts (requests for information, browsing), as well as the management of payments and invoicing for customers of the service.

Data that customers process through the Rilvo Coworker service (for example, emails, documents, quotes and data about their own customers) is not governed by this policy: for that data, Rilvo normally acts as a processor on behalf of the customer, and the processing is governed by a separate contract and by a data processing agreement under Article 28 GDPR. If the customer chooses the “Rilvo Coworker with your own AI account” plan, the data sent to the artificial intelligence models is processed by the AI provider chosen by the customer (for example, OpenAI or Anthropic) under the contract between the customer and that provider.

3. What data we process

a) Browsing data. When you visit the Sites, our hosting provider’s servers automatically record certain technical data: IP address, date and time of the request, page requested, referring page, browser and operating system, and server response code.

b) Contact form data. First name, last name, email address, subject and the text of your message, together with any other data you choose to include in the message.

c) Data you send us by email or telephone. Contact details (email address, telephone number) and the content of your communications.

d) Statistical data. Only if you give your consent, Google Analytics 4 collects data on the use of the Sites (pages visited, visit duration, device, approximate geographic area) linked to online identifiers (cookies).

e) Security data. The contact form is protected by Google reCAPTCHA v3, loaded on the contact pages only, which analyses technical data about the device and behaviour on the page (for example, IP address, browser characteristics, movements and interactions) to distinguish humans from automated systems.

f) Payment and invoicing data (customers). If you buy one of our services: company name, contact person’s name, billing address, VAT number/tax code, email address, amounts, dates and status of payments, invoices. Card payments are handled by Stripe: Rilvo does not store full card details and receives only limited information from Stripe (for example, card type, last four digits, expiry date and payment outcome).

Please do not include special categories of data (for example, health data) or unnecessary third-party data in messages.

4. Purposes and legal bases

Purpose	Data	Legal basis
Responding to requests for information (form, email, telephone) and providing information about the service	Contact form data; data sent by email or telephone	Pre-contractual measures taken at the data subject’s request (Art. 6(1)(b) GDPR); where the request does not concern a possible contract, our legitimate interest in responding to people who contact us (Art. 6(1)(f))
Statistics on the use of the Sites (Google Analytics 4)	Statistical data	Consent (Art. 6(1)(a)), collected through the cookie banner and revocable at any time
Security of the Sites, prevention of spam and abuse (reCAPTCHA, server logs)	Browsing data; security data	Legitimate interest in protecting the Sites and forms (Art. 6(1)(f))
Management of payments for the monthly plans, the pilot, packages of extra hours and other services purchased, invoicing	Payment and invoicing data	Performance of the contract (Art. 6(1)(b)) and compliance with tax and accounting obligations (Art. 6(1)(c))
Compliance with legal obligations (for example, tax obligations or requests from authorities)	data as necessary	Legal obligation (Art. 6(1)(c))
Establishment, exercise or defence of legal claims, in or out of court	data as necessary	Legitimate interest (Art. 6(1)(f))

Where processing is based on legitimate interest, we have assessed that your interests or rights do not override it; you can ask us for more information about this assessment by writing to privacy@rilvo.net.

Newsletters and marketing communications. If you are one of our customers, we may send newsletters and communications about Rilvo services similar to those you have purchased to the email address you gave us at the time of purchase, on the basis of our legitimate interest (Art. 6(1)(f) GDPR and Art. 13(2) of Directive 2002/58/EC). You can object at any time and free of charge, using the unsubscribe link included in every email or by writing to privacy@rilvo.net. We send newsletters and marketing communications to people who are not our customers only with their consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time in the same ways. We keep the data used for these communications until you object or withdraw your consent and, for customers, for no longer than 24 months after the end of the relationship: after that period, we no longer send marketing communications to former customers. We use the Brevo platform to send newsletters and marketing communications (see section 6).

5. Whether providing data is mandatory

Contact form: the fields marked as mandatory (for example, name and email address) are necessary to respond. Without this data, we cannot act on the request.
Payment and invoicing: the data is necessary to conclude and perform the contract and to comply with tax obligations; without it, we cannot activate the service.
Statistics: consent is optional; if you refuse it, you can still use the Sites normally.
Browsing and security data: this is collected automatically and is necessary for the operation and protection of the Sites.

6. Recipients of the data

The data is processed by authorised Rilvo staff and may be disclosed to the following providers, which act as processors (Art. 28 GDPR) or, where indicated, as independent controllers:

Hostinger (Hostinger International Limited, 61 Lordou Vironos str., 6023 Larnaca, Cyprus) – hosting of the Sites, content delivery network (Hostinger CDN) and DNS.
Google (Google Ireland Limited, with processing also by Google LLC, USA) – Google Analytics 4 (only with consent), Google reCAPTCHA (on the contact pages only). Business email, including the delivery by email of messages sent through the contact form, is managed with Google Workspace, provided by Google Cloud EMEA Limited (Velasco, Clanwilliam Place, Dublin 2, Ireland).
Stripe (Stripe Payments Europe, Limited, Ireland) – processing of customers’ card payments. Rilvo does not store full card details. For certain processing (for example, fraud prevention and regulatory obligations), Stripe acts as an independent controller (in particular through Stripe Technology Company Limited, Ireland); Stripe’s privacy policy also applies.
Brevo (Sendinblue SAS, France) – platform for sending newsletters and marketing communications.
Facebook (Meta Platforms Ireland Limited) – only if you visit our Facebook page through the link on the Sites; in that case, Meta’s privacy policy applies.
Advisers and professionals (for example, legal or tax advisers) and public authorities, where necessary to comply with legal obligations or to protect our rights.

The up-to-date list of processors can be requested from privacy@rilvo.net. The data is not disseminated.

7. Transfers of data outside the European Economic Area

Some providers (in particular Google and Stripe) are established or process data in the United States or in other countries outside the EEA. In addition, Hostinger’s CDN may serve content from nodes located outside the EU.

Where data is transferred outside the EEA, the transfer is based on:

an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for certified US companies (such as Google LLC and Stripe, LLC); or
standard contractual clauses approved by the European Commission (Art. 46 GDPR), with supplementary measures where appropriate.

You can request information about the safeguards in place by writing to privacy@rilvo.net. The servers hosting the Sites are located in the Netherlands and their backups in Lithuania, and therefore within the EU; for any CDN nodes located outside the EU, the safeguards set out in Hostinger’s data processing agreement apply.

8. How long we keep the data

Data	Retention period
Requests for information and related correspondence (form, email) not followed by a contract	12 months from the last contact
Google Analytics 4 data	Event-level data: 2 months; user-level data: 14 months, a period that is reset with each new activity
Server logs	For the period set by the provider, normally no longer than 30 days
Payment data, invoices and accounting records	10 years, as required by Romanian accounting law (Law No. 82/1991)
Record of acceptance of the Terms and of the Data Processing Agreement (customers)	10 years from the end of the contract (copy kept by Rilvo); the record is also kept by Stripe together with the payment data
Data needed to comply with legal obligations or to defend legal claims	For the period required by law or until the dispute is resolved

If the request leads to a contract, the data will be kept in accordance with the privacy information and the contract relating to the service. When the retention periods expire, the data is deleted or anonymised.

9. Your rights

As a data subject, you have the right to:

access – find out whether we process your data and obtain a copy of it (Art. 15);
rectification – have inaccurate or incomplete data corrected (Art. 16);
erasure – have your data erased in the cases provided for by law (Art. 17);
restriction – ask us to restrict processing (Art. 18);
portability – receive the data you have provided to us in a structured, machine-readable format, or have it transmitted to another controller, where the processing is based on consent or on a contract and is carried out by automated means (Art. 20);
objection – object at any time, on grounds relating to your particular situation, to processing based on legitimate interest and, at any time and without giving reasons, to the sending of marketing communications (Art. 21);
withdrawal of consent – withdraw any consent you have given (for example, for statistics) at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can do this through the “Cookie preferences” link in the footer of every page of the Sites.

You can exercise your rights by writing to privacy@rilvo.net. We will reply without undue delay and in any event within one month of the request (extendable by two further months for complex requests, in which case we will inform you). We may ask you for information to verify your identity.

10. Right to lodge a complaint

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. In particular:

National Supervisory Authority for Personal Data Processing (ANSPDCP), Romania – lead supervisory authority, competent for the controller’s main establishment – www.dataprotection.ro
Garante per la protezione dei dati personali, Italy – www.garanteprivacy.it

We nevertheless invite you to contact us first at privacy@rilvo.net: we will try to resolve any issue quickly.

11. Automated decision-making

On the Sites, we do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The reCAPTCHA assessment is used only to filter spam sent through the contact form: if it indicates a likely automated submission, the form displays an error message and the message is not sent. In that case, you can write to us directly at contact@rilvo.net (or contact@rilvo.it or contact@rilvo.ro).

12. Minors

Rilvo Coworker is a service intended for businesses and professionals. The Sites are not directed at minors and we do not knowingly collect data from persons under 18. If you believe that a minor has provided us with personal data, write to us at privacy@rilvo.net and we will delete it.

13. Cookies

For information about the cookies and similar technologies used on the Sites, please see our Cookie Policy, available at https://rilvo.net/cookie-policy/.

14. Changes to this policy

We may update this policy, for example in the event of new services or changes in the law. The updated version is always published on this page, together with the date of the last update. In the event of significant changes, we will highlight them on the Sites.