How we use contact data
This page is a courtesy translation. The Romanian version, «Cum folosim datele de contact», is the original and prevails in case of any difference. Read the Romanian original.
Who we are
ZEPHREN S.R.L., tax ID CUI 54561142, trade register no. J2026027529009, registered office at B-dul Libertății nr. 38, ap. 4, Bușteni, Prahova county, the controller and operator of the zephren.ro platform. Contact for personal data: legal@zephren.ro. We have not appointed a data protection officer, as we are not required to.
What data we use and where we get it
Name, profession, specialty, county and email address, from one of these sources: the subscription form on zephren.ro (with confirmation of the address), your Zephren/VerificAI account, or one of the public professional registers, that is, publicly accessible sources (the controller's decision of 28 October 2026; energy auditors are not contacted):
- The list of certified design verifiers and the list of certified technical experts, published by MDLPA at https://www.mdlpa.ro/pages/registrepublice;
- The register of authorised site supervisors and the register of technical execution managers, published by ISC on https://data.gov.ro.
The first email tells you exactly which register, and the date of the list, your address comes from.
From marketing emails we also learn whether you open them and which links you click (through a pixel and redirected links), so that we can measure deliverability and interest and apply the deletion rule below. For the newsletter subscription, giving your email address is voluntary; without it we cannot send you the newsletter.
Purpose and legal basis
To send you news about Zephren tools: on the basis of your consent (Article 6(1)(a) GDPR and Article 12(1) of Law 506/2004); for customers who have bought a Zephren or VerificAI subscription, on the basis of Article 12(2) of Law 506/2004, for similar products or services that we sell (we offered you the possibility to refuse when your address was collected and we offer it again in every message); for data from the public registers, the processing of personal data within the meaning of the GDPR (the name, profession, specialty, county and email address from the register) rests on our legitimate interest in presenting professional tools to the specialists they are meant for (Article 6(1)(f) GDPR). Legitimate interest is a basis only for processing the data from the public source; it does not replace consent for commercial communications by email, which are regulated separately by Law 506/2004.
Right to object
You can object at any time to your data being used for direct marketing, with one click on «Dezabonare» (unsubscribe) in any email you receive; after that we no longer process it for this purpose (Article 21(2)-(4) GDPR). After you unsubscribe we stop writing to you and delete your data from the contact list; we keep only a cryptographic fingerprint (SHA-256) of the address, based on our legitimate interest in respecting your objection and in not adding you again.
How long
Contacts from public registers: at most 24 months from the date of the list or until you object; the date of the list is the publication date of the most recent official list in which you appear, and after that term the address is deleted. Newsletter subscribers and customers: until you withdraw your consent or object. After an objection we keep only the SHA-256 fingerprint of the address, solely to respect the objection.
Who has access
Only the Zephren administrator, with two-step authentication. Providers: Supabase Inc. (USA; the data is stored in the EU) and Resend Inc. (USA; emails are sent from the EU, eu-west-1). Any transfers to the USA rest on the adequacy decision for the EU-US Data Privacy Framework.
Your rights
Access, rectification, erasure, restriction of processing, data portability and withdrawal of consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can exercise them by writing to the address above.
Complaint: the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, www.dataprotection.ro).
No automated decisions
We do not take automated decisions that have legal effects on you.