Privacy policy
MARLINK TRADING SRLVersion: 2026-11-06 · Last updated: 2026-11-06
This policy explains how AI Focus processes personal data through aifocus.ro and its training and consulting services.
1. Controller
The controller is MARLINK TRADING SRL, registered office Str. Vaselor 2 Bl. 34 Et. 1 Ap. 9, Sectorul 2, București, 021254, registration no. 6612637, VAT RO6612637, operating the AI Focus brand.
Contact: office@aifocus.ro.
We have not appointed a data protection officer (DPO). An appointment is not mandatory in our case (GDPR art. 37 and art. 10 of Law no. 190/2018). Our core activity is training. We do not process data on a large scale, we do not process special categories of data, and we do not collect the Romanian personal numeric code (CNP). For any question about your data, write to the address above.
2. Data we process
Depending on how you interact with us, we may process the following categories of data:
- Contact form: your name, email address, the category and subject of your enquiry, and your message. With the message we also receive technical hints that help us reply: device type, browser, operating system, browser language, time zone, screen size, and the page you wrote from. The message reaches us by email, and you receive an acknowledgement. Your IP address is used only as a hashed value, to limit abusive submissions.
- Account: your name, email address and its verification, your password (stored only in cryptographic form, never in plain text), the sign-in method you use, the organizations you belong to and your role in them, your preferred language for communications, and your notification preferences, including interest you register in courses.
- Sign-in sessions: creation and expiry time, and the IP address and browser identifier (user agent) associated with each session.
- Orders, payments and invoicing: tickets and orders, payment status and any refunds, and your requests to withdraw from, change, transfer or refund an order, with our replies. If you exercise the right of withdrawal from your account, we record the withdrawal statement and the date and time we received it. If you asked for a service to start during the withdrawal period, we record that request and acknowledgement: who made it, when, and which text was accepted. Card payments are made on the payment page hosted by Stripe; card details never reach us. For invoicing we process, for individuals, name, email address and country, and for companies, legal name, tax and VAT codes, registration number, address and billing email address; company identification data is checked against the public ANAF and VIES registers.
- Transfers and invitations: when a ticket or seat is transferred or offered to another person, that person's name and email address, and the invitation or transfer email we send them. These data are provided to us by the person who transfers or offers the ticket.
- Attendance and certificates: allocated seats, attendance confirmation, certificate eligibility, and issued certificates, which carry the holder's name, the course and the relevant dates.
- Online meetings: for each meeting, your presence: the first and the last time you had the meeting page open from your account, from when it opens, 30 minutes before the meeting, until the meeting's scheduled end time (refreshed at most once a minute), the source of the record and, where relevant, our staff's confirmation or correction of your presence. We use it to decide whether you qualify for the certificate (Terms of service, 6.6); for the certificate only the window in 6.6 counts, from 15 minutes before the meeting's start time until its scheduled end time. Presence shows that you had the meeting page open, not how long you watched. We do not film participants. The meetings are streamed through the YouTube player embedded on the site. While you are connected to the meeting chat, our server keeps in its memory only, without saving it, the fact that you are connected: the participants see only the number of people connected, and our staff also see the names of the people connected at that moment. To learn which meeting views are used, the server counts in its memory, during the meeting, how many different people use each view (normal, cinema, floating window, YouTube full screen); at the end of the meeting it writes only the totals for each view to the application log, without any account identifier.
- Meeting chat: the meeting chat is provided by us (Terms of service, 6.7). For each message we process its text; the name shown (for a participant, the first name and the initial of the last name; for our staff, the staff member's name or "Echipa"); the author's account and seat, the meeting and the event; the date and time; whether it is a question, whether it was answered and which message it replies to; its visibility and, where relevant, the reason it was hidden. A mention (@name) is part of the message text. When our staff switch on the review of new accounts, a message from an account created less than 24 hours earlier stays pending until our staff publish or hide it. We also process the reports you make (the message, the reason, the time and the outcome), the measures that stop a participant from writing for an event (the reason, when it was applied and lifted and by whom), and a record of every moderation measure and every report, which shows who acted, when, on which message or account, and the reason, but not the text of the message. Our staff may download a meeting's chat as a file for internal use; every download is recorded.
- Interactive meeting features: on the meeting page, our staff may launch polls, and participants may press "Și eu" ("Me too") on their classmates' questions, send a signal about the pace of the meeting (the meeting pulse) and, after the meeting, say how the meeting went. These features are provided by us on our site. For each vote in a poll we process the account, the poll, the option chosen and the date and time; you have one vote per poll, which you cannot change after you have sent it. For each "Și eu" press we process the account, the question, the meeting and the date and time; you can take it back while the meeting is in progress, and a press taken back is deleted. For the meeting pulse ("Clar", "Prea repede", "M-am pierdut", that is "Clear", "Too fast", "I'm lost"), our server keeps your signal in its memory only, without saving it, for 3 minutes, linked to the account only so that a new choice replaces the previous one; at the end of the meeting it writes to the application log only the number of signals of each kind, in 5-minute intervals, without any account identifier. For meeting feedback, which you can give after every meeting except the last meeting that teaches a lesson and is not cancelled, and any meeting after it, we process the rating from 1 to 5, the comment (optional, at most 500 characters), the language, the meeting and the event, the date and time and, for a limited period (section 5), the link to the account. You can change your answer until the scheduled start time of the next meeting, as it was set when you first answered.
- Feedback and reviews: for feedback about the site: the topic you choose (a problem, an idea, something you liked, something else), your message and, if you choose, the type of page you wrote from; we do not keep the full page address. For a review of an event: your rating from 1 to 5, your text (optional), the language you wrote in, the event and the attendance that entitles you to review it, the display option you chose (not published, anonymous, with the name you choose, with that name and your company, or with your company only), the displayed name, the company, the record of your agreement to publication (the exact text shown, its version, the language, the date and time), the review status and, where relevant, the reason it was not published. We also keep your choices about the invitation to review ("Not now", "No, thanks") and the date and outcome of the post-event email.
- Site usage analysis: data about the pages visited, collected through Google Analytics only after you accept analytics, as described in the Cookie policy.
- Ad measurement (Meta Pixel): data about the pages you visit and your actions on the site (viewing a course or event, pressing "Enroll", a paid order with its value, currency and a conversion code from which the order cannot be identified, sending the contact form), the page address, IP address, browser information, the identifiers in the
_fbpand_fbccookies and, in hashed form, the contact data you enter in the site's forms (email address, phone number, first and last name, city or county, and country), collected only after you accept the Marketing category, as described in the Cookie policy.
Do not send special-category or confidential data through the general contact form unless we specifically request it through an appropriate channel.
3. Purposes and legal bases
We process data only for the purposes below. For each purpose, the table shows the data used, the legal basis under GDPR art. 6(1), and the retention period. Section 5 sets out the periods in detail.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering messages sent through the contact form | name, email address, category, subject and message, technical hints | (b), where the message concerns a contract you wish to conclude; otherwise (f), our legitimate interest in answering the messages we receive | as long as needed to answer and follow up your message |
| Site security and prevention of abusive submissions | hashed IP address, sign-in session data | (f), our legitimate interest in the security of the site | sessions: 7 days from last renewal; hashed value: as long as needed to limit abusive submissions |
| Creating and managing your account, sign-in | account and sign-in session data | (b), performance of the contract | while the account is active; after deletion, as set out in section 6 |
| Enrolments, orders, payments, refunds, attendance and certificates | order, payment, attendance and certificate data | (b), performance of the contract | as long as needed to perform the contract and as the law requires |
| Recording presence at online meetings, to issue the certificate | presence at each meeting (section 2) | (b), performance of the contract | as for attendance records (section 5) |
| Providing the meeting chat: showing messages to the event and to staff, mentions, the number of people connected, answering questions, the read-only chat after the meeting and, when staff switch it on, the review of messages from new accounts | the "Meeting chat" data and the connection data in the "Online meetings" category (section 2) | (b), performance of the contract | as set out in section 5; connection data is not saved |
| Moderating the meeting chat: receiving and examining reports, hiding messages, stopping a participant from writing, recording the measures taken and answering objections to them | reports, measures, moderation records and the messages concerned (section 2) | (f), our legitimate interest in keeping the chat safe and lawful, protecting participants and staff, and being able to show which measures we took and why; (c), legal obligation, for handling reports and stating the reasons for measures under Regulation (EU) 2022/2065 (Digital Services Act) | as set out in section 5 |
| Providing the interactive meeting features: polls, "Și eu" and the meeting pulse, with the totals shown to participants and staff | votes, "Și eu" presses and pulse signals (the "Interactive meeting features" category, section 2) | (b), performance of the contract | as set out in section 5; pulse signals are not saved |
| Receiving and reading meeting feedback, to improve the course | the rating, the comment and the other meeting feedback data (section 2) | (f), our legitimate interest in learning how each meeting went and what needs improving | as set out in section 5 |
| Transferring or offering a ticket or seat to another person | the name and email address of the person receiving the ticket | (f), our legitimate interest in delivering the ticket to the person the buyer named | same as the order data |
| Order and account emails (confirmations, sign-in, notifications) | name, email address, message content | (b), performance of the contract | same as the order or account data |
| Notifications about courses you registered interest in | name, email address, notification preferences | (a), consent | until you withdraw consent or delete your account |
| Invoicing and accounting records, including checking company data against the ANAF and VIES registers | invoicing data | (c), legal obligation (Accounting Law no. 82/1991) | 5 years, as set out in section 5 |
| Evidence of a withdrawal from the contract and of the information sent for an order | the withdrawal statement and the log of emails sent for the order (section 6) | (f), our legitimate interest in the establishment, exercise or defence of legal claims | 3 years and 6 months, as set out in section 5 |
| Public verification of certificates and seats | the course or event, dates, status; the holder's name only with the holder's agreement | (b) for the certificate and seat; (a), consent, for displaying the name | as long as we keep the certificate or seat |
| Receiving and reviewing site feedback and event reviews, to improve our services | the data in the "Feedback and reviews" category (section 2), the author's name and email address | (f), our legitimate interest in learning what works and what needs improving | as set out in section 5 |
| Publishing a review on the site, with the name you choose, with that name and your company, or with your company only, and quoting it anonymously elsewhere (social media, print, presentations), attributed only as "Participant" followed by the course name | the text, rating, displayed name, company, month and year of attendance | (a), consent, which you can withdraw at any time in My account › My feedback | while the review is published; the record of agreement, as set out in section 5 |
| Calculating a course's average rating, shown publicly without names | the rating of every verified review, including unpublished ones | (f), our legitimate interest in showing a fair average that does not depend on the publication choice | as long as we keep the rating (sections 5 and 6) |
| Checking that the author attended the event, and checking the content before publication | attendance data, the text, the reason a review was not published | (f), our legitimate interest in publishing only genuine reviews, in line with Law no. 363/2007, art. 7(6) | same as the review |
| The post-event thank-you email, with your certificate status and an invitation to give feedback | name, email address, the event, certificate status | (f), our legitimate interest in thanking participants and asking for their feedback, with the option to refuse when your address is collected and in every email (Law no. 506/2004, art. 12(2)) | 24 months for the sending record |
| Site usage analysis (Google Analytics) | data about the pages visited, IP address, browser information, identifiers in the analytics cookies | (a), consent, given by accepting analytics; you can withdraw it at any time through Cookie settings | 14 months |
| Measuring our ads on Facebook and Instagram, matching site visits with Meta accounts (including through hashed contact data) and reaching people who visited the site through ads (Meta Pixel) | the data in the "Ad measurement" category (section 2) | Art. 6(1)(a), consent, given by accepting the Marketing category; you can withdraw it at any time through Cookie settings | cookies: as in the Cookie policy; data received by Meta: under Meta's terms, which allow event data to be kept for up to two years (https://www.facebook.com/legal/terms/businesstools) |
| Establishment, exercise or defence of legal claims | the data relevant to that claim | (f), our legitimate interest in defending our rights | for the limitation period and, where relevant, the proceedings |
| Answering requests from public authorities | the data the law requires | (c), legal obligation | as the law requires |
Account, order and invoicing data are needed to conclude and perform the contract, and invoicing data are also required by accounting and tax law; without them we cannot process an enrolment.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. If you accept the Marketing category, Meta may use the data received through Meta Pixel, including hashed contact data, to recognise your Meta account and to show you ads, including ours, under its own privacy policy.
Certificate verification
Every certificate and every seat has a unique verification link (and QR code). Anyone holding the link can see, for a certificate, the course, the delivery and issue dates, and whether the certificate is valid or revoked, and the holder's name only if the holder has agreed to its display; for a seat, the event, the date, its status, and whether attendance was confirmed.
Feedback and reviews
You can send us feedback about the site from your account at any time. Site feedback is seen only by our staff and is never published.
You can review an event only if your attendance at that event was confirmed. Our staff and the event's trainers cannot review it. You can leave a review up to 90 days after the event ends.
A review is published only if you choose so. By default, only our staff see it. If you choose to publish it, you can appear: anonymously ("Anonymous participant"); with the name you choose (we suggest the name on your account, which you can change); with that name and your company; or with your company only ("Someone at" followed by the company name). You can choose a company only if you are a member of it in your account. Before you send the review, you see exactly how it will appear. In a small team, colleagues may recognise you from the company alone.
A review that names a company is labelled "Personal opinion". The owner of a company can turn off, for the whole company, the display of the company name on reviews; the review then appears only with the chosen name or anonymously.
A review with text is published only after we check it. We check attendance and content, not the rating. We publish negative reviews too. We decline to publish a review only for the reasons listed in the Terms of service, section 14, and we tell you the reason. The chosen name is published only if it does not mislead, for example if it is not another person's name. Reviews of events held for a single company are not published.
A course's average rating includes the ratings of all verified reviews, published or not. In the average, your rating appears without your name.
A published review may also be quoted anonymously outside the site (social media, print, presentations), verbatim or shortened without changing its meaning, attributed as "Participant" followed by the course name. Your name or company appears next to a quote only with your separate agreement (Terms of service, 14.4).
A review appears on the pages in the language you wrote it in. We do not translate it.
Your certificate does not depend on a review. We do not pay for or reward reviews.
4. Recipients and transfers
Data may be made available to service providers that support hosting, authentication, communications, payments, accounting, analytics, and service delivery, as well as advisers or public authorities where required by law. We do not sell personal data.
The providers we currently use are:
| Provider | Role | Data involved |
|---|---|---|
| Neon (Neon, LLC, a subsidiary of Databricks, Inc.) | the site's database, hosted in the AWS Frankfurt region (Germany, EU) | account, order, attendance, certificate, meeting-chat and interactive meeting feature data |
| Resend | sending email (confirmations, sign-in, notifications, the post-event email, contact form) | name, email address, message content |
| Stripe | card payment processing, on the payment page hosted by Stripe | email address, amount, payment details entered at Stripe |
| SmartBill (Intelligent IT S.R.L., Romania) | issuing invoices and pro formas | invoicing data |
| Google Cloud Storage | storing the site's files and images, in a Google Cloud region in the EU | files stored by the site |
| Google Analytics | site usage analysis | see the Cookie policy |
| Meta Platforms Ireland Limited (Ireland) | measuring our ads on Facebook and Instagram (Meta Pixel), only with your consent; joint controller for collection and transmission | the data in the "Ad measurement" category (section 2), including hashed contact data |
| Google (Sign in with Google) | optional sign-in, when it is offered on the sign-in page and you choose it | name and email address from your Google account |
| YouTube (Google) | streaming online meetings and their recordings through the player embedded on the site | the data your browser sends when the player loads (see the Cookie policy) |
| Vultr (The Constant Company, LLC, USA) | application hosting on a server in Frankfurt (Germany, EU) | all data the site processes |
These providers process data on our behalf, as processors, under data processing agreements (GDPR art. 28). Stripe acts as our processor for payments and, for fraud prevention and its own legal obligations, as an independent controller under its own privacy policy. For Sign in with Google, Google processes your Google account data under its own privacy policy. For the YouTube player, Google processes the data as an independent controller, under its own rules. For Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR) for collecting the data on the site, including hashed contact data, and transmitting it to Meta, under Meta's joint-controller agreement ("Controller Addendum"). For later processing, including matching with your Meta account and showing ads, Meta is an independent controller under its privacy policy. You can exercise your rights with us or directly with Meta.
Public authorities, including the tax authority (ANAF), receive data only where the law requires it.
Published reviews, with the display option you chose, are visible to anyone who visits the site. Site feedback and unpublished reviews are seen only by our authorised staff. The organizations you belong to do not see your feedback or reviews, and do not see your course progress.
In the meeting chat, the participants in the same event and our authorised staff see each message with the name shown and the time. The participants do not see the messages our staff hid or the messages waiting for review, except their own. Our staff also see the reports, the measures, the moderation records and the names of the people connected at that moment. The meeting chat is not shown to Google or to other providers; it is stored with our database and hosting providers listed above.
In polls, the participants in the event and our staff see only the number of votes: how many votes each option has and how many votes there are in total. Our staff can see the split of the votes at any time. A participant sees it, depending on the poll, after voting or after our staff show it and, in any case, after the poll closes; until then the participant sees only the total number of votes. For "Și eu", everyone on the meeting page sees only the number of presses. The site does not show anyone, not even our staff, who voted, what anyone voted or who pressed "Și eu"; each participant sees only their own vote and their own presses. Only our staff see the meeting pulse, as the number of signals of each kind; when fewer than 3 signals are active, our staff see only their total number. Only our staff see meeting feedback: the number of answers, the average rating, how many ratings of each kind there are and the comments, with the date and time, without the author's name. Participants do not see each other's feedback. If you write something in a comment by which you can be recognised, our staff may recognise you.
Transfers outside the European Economic Area
Some providers may process data in the United States of America (USA). For these transfers we rely on the safeguards in the table below:
- DPF means the EU-U.S. Data Privacy Framework. The European Commission has adopted an adequacy decision for it (Implementing Decision (EU) 2023/1795, GDPR art. 45). The decision covers only certified companies, which are listed at www.dataprivacyframework.gov/list.
- Standard clauses means the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (GDPR art. 46(2)(c)). They apply in addition, through the providers' agreements.
| Provider | Entity | Where data is processed | Safeguard for the transfer to the USA |
|---|---|---|---|
| Stripe | Stripe Payments Europe, Limited (Ireland) and Stripe, LLC (USA) | EU and USA | DPF (Stripe, LLC is certified) and the standard clauses in Stripe's Data Transfers Addendum |
| Resend | Plus Five Five, Inc. (USA) | the site's emails are sent from Resend's EU region; Resend also processes data in the USA | DPF (Plus Five Five, Inc. is certified) and the standard clauses (module 2) in Resend's data processing agreement |
| Google Analytics | Google Ireland Limited and Google LLC (USA) | EU and USA | DPF (Google LLC is certified) and the standard clauses in the Google Ads Data Processing Terms |
| Meta | Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (USA) | EU and USA | DPF (Meta states that Meta Platforms, Inc. is certified) and Meta's Global Data Transfer Addendum (in the Business Tools Terms) |
| Google Cloud Storage | Google LLC (USA) and its affiliates | files are stored in a Google Cloud region in the EU | DPF (Google LLC is certified) and the standard clauses in the Cloud Data Processing Addendum, for any access from outside the EU |
| Google (Sign in with Google) | Google LLC (USA) | as set out in Google's policy | DPF (Google LLC is certified) |
| YouTube | Google Ireland Limited and Google LLC (USA) | as set out in Google's policy | DPF (Google LLC is certified) |
| Neon | Databricks, Inc. (USA), the parent company of Neon, LLC | the AWS Frankfurt region (Germany, EU); some of Neon's infrastructure services are in the USA | DPF (Databricks, Inc. is certified) and the standard clauses in the Databricks data processing agreement |
| SmartBill | Intelligent IT S.R.L. (Romania) | EU (Ireland and Germany), according to SmartBill's terms | SmartBill states that its hosting provider, Amazon Web Services, is DPF-certified |
| Vultr | The Constant Company, LLC (USA) | the server in Frankfurt (Germany, EU) | the data is hosted in the EU, in Frankfurt (Germany) |
You may ask us for a copy of these safeguards at office@aifocus.ro.
5. Retention
We retain data only for as long as required for the purpose for which it was collected, applicable accounting and legal obligations, security, and the establishment or defence of legal claims. The periods are:
| Category | Period |
|---|---|
| Sign-in session | 7 days from its last renewal, then it expires |
| Email sign-in link | 10 minutes |
| Password reset link | 60 minutes |
| Account deletion confirmation link | 60 minutes |
| Account data | while the account is active; after deletion, as set out in section 6 |
| Contact form messages | as long as needed to answer and follow up your message, and longer only where the law requires it |
| Invoices, accounting registers and other accounting records | 5 years, counted from 1 July of the year following the end of the financial year in which they were drawn up (Accounting Law no. 82/1991, art. 25), and longer only where another law requires it |
| Orders, attendance records (including presence at online meetings) and certificates | as long as needed to perform the contract and as the law requires, including for the establishment or defence of legal claims |
| Meeting-chat messages (text, name shown and details), reports and the measures that stop a participant from writing | 90 days after the end of the event's last meeting that was not cancelled or, if every meeting of the event was cancelled, 90 days after the end of its last meeting. Nothing is deleted while a meeting of the event is live. A report is deleted together with the message it concerns |
| Records of moderation measures and of reports, without the text of the message | 12 months from the record |
| A meeting's chat downloaded as a file by our staff | only as long as needed for the internal purpose for which it was downloaded, and no longer than the period for meeting-chat messages |
| Poll votes (the link between the account and the option chosen) | until the first daily automatic deletion after 24 hours have passed since the poll closed. A poll closes when our staff close it or, at the latest, when our staff end the meeting. The number of votes for each option remains, with no link to any account |
| "Și eu" presses | as long as the question they refer to exists, under the period for meeting-chat messages; a press taken back is deleted at once |
| Meeting pulse signals | not saved; the server keeps them in memory only, until the end of the meeting, and each signal stops counting after 3 minutes. Only the numbers of signals remain in the application log, without an account identifier |
| Meeting feedback | the link to the account: until the scheduled start time of the next meeting, as it was set at the first answer, then it is removed at the first daily automatic deletion. The rating and the comment then remain with no link to the account and are not deleted automatically |
| Event reviews (text and rating) | until you delete them or delete your account; after account deletion, as set out in section 6 |
| Site feedback | 24 months from sending |
| Record of agreement to publish a review, and of its withdrawal | for as long as the review exists, plus 3 years (Romanian Civil Code, art. 2517) |
| Choices about the invitation to review ("Not now", "No, thanks") | 12 months from the end of the event |
| Record of sending the post-event email | 24 months from sending |
| Withdrawal statements and the log of emails sent for an order | 3 years and 6 months from the completion of the refund or, where no refund was made, from the end of the order's withdrawal period. The period covers the general 3-year limitation period (Romanian Civil Code, art. 2517). A pending complaint or dispute extends retention until it is resolved |
| Analytics data (Google Analytics) | 14 months for user-level and event-level data, as set in our Google Analytics property |
| Ad measurement data (Meta Pixel) | the _fbp and _fbc cookies: as in the Cookie policy; event data received by Meta: up to two years under Meta's terms, and contact information used for matching is deleted by Meta after the matching process. On the site we keep only the local notes in your browser described in the Cookie policy (aif-meta-sent:…, aif-meta-pending-purchase) |
| Database backups | the limited restore window configured with our database provider |
6. Account deletion lifecycle
Account deletion is a verified, recoverable process, which you can start from the Data and privacy section of your account. The working lifecycle is:
- Request and verification. When you initiate deletion, we send a single-use verification link, valid for 60 minutes, to the account email address. The account and access remain unchanged unless and until you confirm through that link.
- Immediate access revocation. Confirmation closes active sessions and blocks new sign-ins. It does not immediately erase the account.
- Fourteen-day recovery window. Confirmation starts a 14-day recovery period. Until the deadline stated in the confirmation email, you may cancel through the purpose-bound cancellation link. Cancellation restores sign-in eligibility but does not create a new session; you must sign in again.
- Ownership and administrative review. If you are the sole owner of a company organization, you must transfer ownership or otherwise resolve that organization before confirmation. Finalization also requires administrative approval, which we give without undue delay after the 14-day period. A documented legal obligation or legal-claims need may place the request on hold.
- Finalization. After the 14-day period, and only after approval and the absence of an applicable hold, we remove or replace direct account identifiers, authentication providers, sessions, and invitations, and pseudonymize the account and its personal organization. Pseudonymized data remains personal data where it can be attributed to a person using additional information; it is not automatically anonymous.
- Completion notice. We send a completion message to the notification address retained specifically for this process, then remove that address from the deletion request.
Some fiscal documents, orders, receipts, seat and attendance records, certificates, and security or audit evidence may be retained separately where and only for as long as an applicable legal obligation or the establishment, exercise, or defence of legal claims requires it. Retained records do not restore account access and must not be reused for an unrelated purpose.
Withdrawal statements and the log of emails sent for an order are kept after account deletion, as evidence in case of a complaint or dispute (GDPR art. 17(3)(e)). These records contain the name, email address, order, and the date and time of each statement and of each email sent. We keep them for the period set out in section 5. You may ask us at any time, at office@aifocus.ro, for a copy of these records that concern you, including after your account is deleted.
When account deletion is finalized, the link between your reviews and your account is removed: not even our staff can see who wrote them any more. The text and rating stay as they are and keep counting in the average rating. A published review stays published, but appears as "Anonymous participant", with no name and no company. The text of a review that was never published is deleted 24 months after the account is deleted; the rating stays. If you do not want it to remain, delete the review in My account › My feedback before you request account deletion. Site feedback remains, unlinked from the account, until the end of the period in section 5. The record of agreement to publication is kept for the period in section 5.
When account deletion is finalized, the text of your meeting-chat messages is deleted and the name shown is replaced by "Deleted account", so that the order of the conversation stays readable. The reports you made, the measures that stopped you from writing and the moderation records that concern you stay linked to the pseudonymized account until the end of the periods in section 5.
When account deletion is finalized, your poll votes and "Și eu" presses are deleted, and your meeting feedback loses its link to the account; the rating and the comment remain, without a name. The number of votes in a closed poll does not change, because it was set when the poll closed.
If the request is cancelled, blocked, rejected, or placed on hold, we record that outcome and its reason. You may contact office@aifocus.ro to ask about the status of a request or the legal basis and retention period for information that cannot yet be erased.
7. Your rights
Subject to the GDPR and applicable conditions, you may request access, rectification, erasure, restriction, portability, or object to processing. Where processing is based on consent, you may withdraw it without affecting earlier lawful processing.
You can download a copy of your account data, in JSON format, at any time from the Data and privacy section of your account.
The copy of your account data includes your feedback and reviews, your display choices, the record of your agreement to publication, and the record of post-event emails. You can withdraw your agreement to publish a review at any time in My account › My feedback; the review stops appearing publicly the next time the page is shown. You can edit or delete a review; a deleted review no longer counts in the average rating. You can object to post-event emails at any time, free of charge, through the link in every such email or in My account › Notifications.
The copy of your account data also includes your meeting-chat messages (the text, the name shown, the question and answer status, the message replied to, the visibility and, where relevant, the reason for hiding), the reports you made with their reason, time and outcome, the measures that stopped you from writing, and your presence records at online meetings (the source, the result, the first and the last time seen). Presence is recorded for the seat: the copy includes the presence of the seat assigned to you or, while a seat you hold as ticket holder is not assigned, of that seat. If a seat is assigned to another person, the presence recorded earlier stays with the seat and appears in that person's copy; you can ask us for your presence records from that seat at office@aifocus.ro.
The copy of your account data also includes your poll votes (the meeting, the question, the option chosen, the date and time), as long as they have not been deleted, your "Și eu" presses (the meeting, the message and its text, the date and time) and your meeting feedback (the meeting, the rating, the comment, the date and time of the first answer), as long as it is linked to the account (section 5). The meeting pulse does not appear in the copy, because we do not save it. Once a vote is deleted or feedback loses its link to the account, we can no longer tell which vote or which feedback is yours. If you want to withdraw your feedback on a meeting while it is linked to the account, write to us at office@aifocus.ro.
We inform you of the action taken on a request, including a deletion request, without undue delay and in any event within one month of receiving it. Where a request is complex or we receive many requests, this period may be extended by two further months; in that case we tell you within the first month and explain why.
Send requests to office@aifocus.ro. You may also lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.
8. Cookies and changes
Our use of cookies is described in the Cookie policy. We may update this policy when our services or legal obligations change; the version shown above identifies the applicable text.