Privacy Policy

HELION is the controller of the personal data described in this policy. Our identification and contact details are:

• Legal name: INFRAWEB MANAGED SERVICES PROVIDER S.R.L.
• Fiscal identification code: RO38965327
• Registered office: Bd. Dimitrie Pompeiu nr. 5-7, etaj 3, Corp C, Hermes Business Campus, Sector 2, București, România
• Email: [email protected]
• Privacy enquiries: [email protected]
• Phone: +40 31 229 7003

For any question about this policy or about how we handle your personal data, write to us at the privacy address above.

This policy covers the personal data we process as a controller — that is, where we decide why and how the data is used. It applies to our website at https://infraweb.ro, to our contact and recruitment channels, and to the administration of our client relationships.

It does not cover the personal data we process on behalf of our clients while delivering call center, BPO or managed IT services. In those cases we act as a processor and the client remains the controller; see the section on our role as a processor below.

Depending on how you interact with us, we may process the following categories of data:

• Identification and contact data — name, company, job title, email address, phone number.
• Message content — the content of the forms you submit, and of the emails or calls we exchange with you.
• Recruitment data — the CV, cover letter, work history and any other information you send when applying for a role.
• Client relationship data — the contact details of the people who represent our clients and suppliers, and the correspondence relating to a contract.
• Technical and usage data — IP address, browser and device type, pages visited, referring page, timestamps, and similar information collected automatically.
• Account data — if you create an account on our site, your credentials and the settings associated with it.

We do not deliberately collect special categories of data (such as health or biometric data) through this website. Please do not include such information in the forms you submit.

We only process personal data where we have a legal basis under Article 6 GDPR:

• To answer your enquiries and provide the information you request — based on our legitimate interest in responding to those who contact us, or on steps taken at your request before entering into a contract.
• To negotiate, conclude and perform contracts — based on the performance of a contract, or on our legitimate interest where you act on behalf of a company.
• To evaluate job applications — based on steps taken at your request prior to employment, and on your consent where we keep your application for future openings.
• To operate, secure and improve the website — based on our legitimate interest in a functional, safe and reliable service.
• To send commercial communications — based on your consent, or on our legitimate interest in direct marketing to existing clients for similar services. You can withdraw at any time.
• To comply with legal obligations — accounting, tax, archiving and responding to lawful requests from public authorities.
• To establish, exercise or defend legal claims — based on our legitimate interest.

Our website uses cookies and similar technologies. Strictly necessary cookies keep the site working — they handle things such as session state, security and language preference — and do not require your consent.

Any analytics, performance or marketing cookies are only set after you agree to them. You can change or withdraw your choice at any time from your browser settings, and most browsers let you block or delete cookies entirely; note that blocking strictly necessary cookies may break parts of the site.

We do not sell personal data. We disclose it only to:

• Service providers acting on our instructions — hosting, email delivery, CRM, analytics, IT support and similar suppliers, bound by a data processing agreement.
• Our clients, where the data relates to a service we deliver to them.
• Professional advisers — lawyers, accountants and auditors — where necessary and under a duty of confidentiality.
• Public authorities, where we are legally required to disclose the data.
• A buyer or successor, in the event of a merger, acquisition or reorganisation, subject to the protections in this policy.

We aim to keep personal data within the European Economic Area. Where a supplier processes data outside the EEA, we only transfer it if the destination benefits from an adequacy decision of the European Commission, or if appropriate safeguards are in place — normally the Standard Contractual Clauses — together with any supplementary measures the transfer requires.

You can request a copy of the safeguards applied to a specific transfer by writing to the privacy address above.

We keep personal data only for as long as it is needed for the purpose it was collected for, and afterwards only where the law requires it:

• Enquiries and correspondence — for the duration of the exchange and a reasonable period afterwards, unless a contract follows.
• Contract and client relationship data — for the duration of the contract and for the limitation period that follows it.
• Accounting and tax records — for the period imposed by Romanian law.
• Recruitment data — until the role is filled; where you consent to it, we keep the application on file for a limited period so we can consider you for future openings.
• Website technical logs — for a short period, for security and troubleshooting.

When a retention period ends, we delete the data or anonymise it irreversibly.

We apply technical and organisational measures appropriate to the risk: encryption in transit, access control on a need-to-know basis, network and endpoint protection, logging, backups, staff confidentiality undertakings and security training, and due diligence on the suppliers we work with.

No system is completely secure. If a personal data breach occurs and it is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority as required by the GDPR.

Under the GDPR you have the right to:

• Access — obtain confirmation of whether we process your data, and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted, where one of the grounds in Article 17 GDPR applies.
• Restriction — have processing limited in the situations listed in Article 18 GDPR.
• Portability — receive the data you provided in a structured, commonly used, machine-readable format.
• Object — object at any time to processing based on legitimate interest, and at any time and without justification to direct marketing.
• Withdraw consent — at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Not be subject to a decision based solely on automated processing that produces legal effects concerning you.

To exercise any of these rights, write to [email protected]. We answer within one month; where a request is complex, we may extend that period by two further months and will tell you if we do.

If you consider that we have infringed your rights, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro), or with the supervisory authority of your habitual residence, and you may also apply to the competent courts.

When we deliver call center, BPO or managed IT services, we usually process personal data on behalf of a client — for example the details of the client’s own customers. In that relationship the client is the controller and we are the processor.

In such cases we act only on the client’s documented instructions, under a data processing agreement compliant with Article 28 GDPR, and we do not use the data for our own purposes. If you are a customer of one of our clients and want to exercise your rights, please contact that company; if you contact us instead, we will forward your request to them.

Our website and services are addressed to businesses and are not directed at children. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, write to us and we will delete it.

We may update this policy to reflect changes to our operations or to the law. The version in force is always the one published on this page, with the date shown at the top. Where a change materially affects you, we will make it visible in advance through an appropriate channel.

Questions about this policy or about your personal data: [email protected]. General enquiries: [email protected] or +40 31 229 7003. Postal address: Bd. Dimitrie Pompeiu nr. 5-7, etaj 3, Corp C, Hermes Business Campus, Sector 2, București, România.