Legal
Privacy policy
What personal data SUDOLESS processes when you visit our sites, write to us, join ROME's early birds or work with us. Why we process it, for how long, who receives it, and the rights you have over it.
1Who we are
SUDOLESS S.R.L. is the controller of the personal data this policy describes: we decide why and how it is processed.
- Company
- SUDOLESS S.R.L.
- Registered office
- Bd. 1 Decembrie 1918 nr. 39, 032457 Bucuresti, Romania
- Trade Register
- J40/1168/2021
- Fiscal code (CUI)
- 43611954
- Administrator
- Alexandru-Paul Copil
- Privacy requests
- privacy@sudoless.org
- Security
- security@sudoless.org
- General
- contact@sudoless.org
2What this policy covers
This policy covers the personal data we process as controller when you:
- visit sudoless.eu, sudoless.com, sudoless.org, sudoless.net or rome.sudoless.eu;
- write to us, call us or meet us;
- join ROME's early birds;
- work with us as a client, or as a client's contact, including contracts and invoicing.
It also covers the automations we build and run for these purposes. They handle the same data, for the same purposes, on the same terms.
Data our clients put into the systems we build, host or run for them is processed on their behalf and on their instructions, under the data-protection annex to their contract. The client is the controller of that data. If your data is in such a system, contact the business that runs it. If you write to us instead, we pass your request on to them without undue delay.
Software we publish comes with its own privacy policy. ROME gets its own at launch.
Sites we link to, such as GitHub and LinkedIn, follow their own policies.
3What we collect and why
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Delivering our sites and keeping them secure | IP address, browser and device type, the page requested, the time of the request | Our legitimate interest in keeping the sites available and secure (art. 6(1)(f) GDPR) | 30 days. Longer only for the logs needed to investigate a security incident. |
| Answering your emails, calls and requests to meet | Your name, email address, phone number, company, and what you tell us | Steps you ask us to take before a contract (art. 6(1)(b)); otherwise our legitimate interest in answering the people who contact us (art. 6(1)(f)) | 2 years after our last contact |
| Telling ROME's early birds about its launch, setting them up first and asking for their input | Your name, email address, company, and what you tell us about what you store and how you sell | Your consent, given when you ask to join (art. 6(1)(a)) | Until 12 months after ROME's launch, or until you ask to be removed |
| Making and carrying out contracts with our clients | Names, roles, work email addresses and phone numbers of a client's representatives and contacts; the company's identification details | The contract, where you are the client (art. 6(1)(b)); our legal obligations (art. 6(1)(c)); for a client's representatives and contacts, our legitimate interest in working with the client (art. 6(1)(f)) | The term of the contract, plus 5 years |
| Answering support requests and keeping a record of them | The request, what is attached to it, and who sent it | Our legitimate interest in delivering what the contract covers, and in establishing, exercising or defending legal claims (art. 6(1)(f)) | The term of the contract, plus 3 years |
| Invoicing and accounting | Billing details, invoices and their supporting documents | Our legal obligations under Romanian tax and accounting law (art. 6(1)(c)) | As long as Romanian accounting law requires: 5 years from 1 July of the year after the financial year they belong to, or longer where the law says so |
You choose what to give us. We need an email address or a phone number to answer you, and a client's identification and billing details to sign a contract and issue the invoices the law requires.
Most of this data comes from you. When a client names you as their contact, your name, role and work contact details come from that client.
4Who receives data
The providers below process personal data for us. Each works under a data-processing agreement (art. 28 GDPR) and receives only what its task needs. We do not sell personal data.
| Provider | Based in | What for | Where data is processed |
|---|---|---|---|
| Hetzner Online GmbH | Germany | Cloud infrastructure, servers and storage | Germany and Finland (EU) |
| Cloudflare, Inc. | United States | DNS, delivering our sites, and protecting sites and APIs from attacks and automated traffic; serverless functions | EEA and United States |
| Backblaze, Inc. | United States | Encrypted backups, kept outside our main infrastructure | EU |
| Fastmail Pty Ltd | Australia | Email, and the storage of our correspondence | EU and United States |
| Linear Orbit, Inc. | United States | Tickets, issues and the tracking of our work | EU |
| GitHub, Inc. | United States | Source code and continuous integration | EU and United States |
| Anthropic Ireland, Limited | Ireland | AI tools and agents that assist with our communications, support and software development. They can see the content of what you send us. | United States |
| Ask For Accounting | Romania | Accounting, and our financial records | Romania (EU) |
We also send invoices and accounting records to the Romanian tax authority, ANAF, including through the national RO e-Factura system, as the law requires. ANAF receives them as a public authority, in its own right.
When we add or replace a provider, we update this list and the date at the top of this page. Clients whose data a new provider will process hear from us by email beforehand.
5Transfers outside the EEA
Our own servers are in the European Economic Area. Some of the providers above are based outside it, in the United States and Australia, and some process data in the United States; the table above says which.
Each of these transfers is covered by a safeguard the GDPR recognises, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework, and only the data a task needs is sent.
For a copy of the safeguards, write to privacy@sudoless.org.
6How we protect data
We protect personal data with technical and organisational measures suited to the risk (art. 32 GDPR), and review them regularly.
- Access
- Named accounts, a second factor wherever it is available, rights by role and need to know, and access removed when someone leaves.
- Encryption
- TLS for data in transit. Encryption at rest on the systems that store client data. Backups encrypted before they leave our systems.
- Infrastructure
- Dedicated servers in the EEA, services isolated in their own containers or virtual machines, hardened operating systems, network filtering, protection from attacks and automated traffic, and security updates applied.
- Logging
- Access and key operations are logged and collected in one place, with alerts on security events.
- Backups
- Regular and encrypted, kept both on equipment we control and with a provider listed above, and checked that they restore.
- Development
- Version control, every change reviewed before it reaches production, and development kept apart from production.
- People
- Few people with access, each bound to confidentiality; a record of our processing; a procedure for incidents.
- Less data
- We collect only what we need, and delete it on the schedule above.
No system is infallible. No network or system, ours included, can guarantee complete protection against the destruction, loss, alteration or disclosure of data, or unauthorised access to it.
If a breach is likely to put people at risk, we notify the supervisory authority without undue delay, and tell the people affected when the risk to them is high.
To report a security concern, write to security@sudoless.org.
7Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and get a copy of it;
- have inaccurate data corrected, and incomplete data completed;
- have your data erased when we no longer need it or have no other basis to keep it;
- restrict how we use your data while a question about it is settled;
- receive the data you gave us in a common, machine-readable format, or have it sent to another company, where we process it on the basis of your consent or a contract;
- object, on grounds relating to your situation, to processing based on our legitimate interests; we then stop, unless we have compelling legitimate grounds or need the data for legal claims;
- withdraw your consent at any time, for example by leaving ROME's early birds; this does not affect what we did with your consent before.
To use any of these rights, write to privacy@sudoless.org. We answer within one month. When a request is complex, or there are many, we may take up to two more months, and we tell you so within the first month.
We reply to the email address or account a request came from. When we cannot otherwise be sure a request is yours, we ask you to confirm who you are.
For data we process for a client, we pass your request on to that client, who answers it, and we help them do so.
You can also complain to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), at dataprotection.ro, or to the supervisory authority where you live or work.
8Automated decisions
We make no decision with legal or similarly significant effects on you by automated means alone, we build no profile of you, and we use none of your data for advertising.
9Children
Our services are for businesses. We do not knowingly collect personal data from children.
11Changes to this policy
We update this policy when the way we process personal data changes, and change the date at the top. When a change affects our clients, we tell them by email.
Versions
- Version 3.0. Rewritten in full, in line with our data-protection annex: every provider, the legal bases, how long we keep data, transfers, and rome.sudoless.eu.
- The previous version.
12Contact us
- Privacy requests, and questions about this policy
- privacy@sudoless.org
- Reporting a security concern
- security@sudoless.org
- General
- contact@sudoless.org