Privacy Policy

01Who we are and what this policy covers

EDI & SAP Solutions SRL ("ESS", "we") is an enterprise integration company based in Brașov, Romania. ESS develops and provides ESS Hub, an enterprise supplier collaboration and WebEDI platform, and operates the public ESS Hub website at esshub.ai (the "Website").

This policy covers the public Website only. The ESS Hub application (app.esshub.ai) is used by our customers and their suppliers under the agreements concluded with the customer organisation. The processing of personal data within the application is governed by those agreements and by the notices provided inside the application, not by this policy.

02Data controller

Controller

EDI & SAP Solutions SRL

Registered office

Aleea Episcop Popeea 31, Bl. 31, Sc. A, Ap. 10, 505600 Săcele, Brașov County, Romania

Business address

Nicolae Titulescu 4, 500010 Brașov, Romania

Trade Register / CUI

J08/1656/2013 · CUI 32430677

Country

Romania (European Union)

E-mail

contact@edisapsolutions.com

Telephone

(+40) 729 103 638

Contact form

Contact page

03Personal data we process

Technical data when you visit the Website

When you open a page of the Website, the systems that deliver it process technical data transmitted by your browser: your IP address, the date and time of the request, the pages you visit, the referring page and information about your browser, device and operating system. This data is needed to deliver the Website to you and to keep it secure.

Contact and demo requests

The Website itself does not contain a contact or demo request form. Every "Request a Demo", "Talk to an Integration Expert" and "Contact" link leads to the contact page of our corporate website, edisapsolutions.com, where you can call us or use the contact form (name, e-mail address, telephone number, company name and your message). The data you submit there is processed by EDI & SAP Solutions SRL as controller, as described in this policy and in the privacy policy of edisapsolutions.com.

Business communications

If we correspond with you after your request, we process the content of that correspondence and the related contact details.

We do not process special categories of personal data through the Website, and the Website is not directed at children.

04Why we process personal data

• Operating the Website and delivering its content to your browser.
• Protecting the Website against misuse, attacks and technical faults, and diagnosing errors.
• Understanding how the Website is used, in aggregated form, in order to improve its content (see the section on cookies and analytics).
• Responding to demo and contact requests and preparing proposals.
• Business communication with prospective and existing customers, partners and suppliers.
• Complying with legal obligations, for example accounting and record-keeping obligations, and establishing, exercising or defending legal claims.

05Legal bases under the GDPR

• Website operation, security and aggregated usage measurement: our legitimate interest in providing a functioning, secure and useful website (Article 6(1)(f) GDPR).
• Demo and contact requests: the steps you ask us to take before entering into a contract (Article 6(1)(b) GDPR) where you act on your own behalf, and our legitimate interest in responding to business enquiries (Article 6(1)(f) GDPR) where you act on behalf of a company.
• Business communication with customers and partners: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in maintaining business relationships (Article 6(1)(f) GDPR).
• Legal obligations: Article 6(1)(c) GDPR.
• Marketing communications by e-mail: your consent (Article 6(1)(a) GDPR), unless another legal basis applies to communications with existing customers under applicable law. You can withdraw your consent or object at any time.

Requesting a demo does not require you to consent to marketing communications. A demo request and a subscription to marketing communications are separate.

06Recipients and processors

We share personal data only with:

• Framer B.V., Netherlands: the platform on which the Website is built, hosted and delivered, including its built-in analytics. Framer processes the technical data described above on our behalf as a processor, under its data processing terms (Article 28 GDPR).
• Google (Google Ireland Limited / Google LLC): the fonts used on the Website are loaded from Google Fonts when a page is displayed, so Google receives the technical request data, including your IP address, needed to deliver the font files. Google processes this data under its own privacy policy.
• The providers of our e-mail and IT infrastructure, which process business correspondence on our behalf as processors.
• Public authorities, where we are legally obliged to disclose data.
• Professional advisers, where necessary to protect our rights.

We do not sell personal data and we do not share it with third parties for their own marketing purposes.

07International data transfers

Framer and Google may process the technical data described above on infrastructure located outside the European Economic Area, including in the United States. Where personal data is transferred to a country for which the European Commission has not adopted an adequacy decision, the transfer relies on appropriate safeguards under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses or a certification under the EU-U.S. Data Privacy Framework, as provided for in the terms of the respective provider. You can request information about the safeguards used through the contact details at the end of this policy.

08Data retention

We keep personal data only for as long as necessary for the purposes described in this policy.

• Technical data processed to deliver and secure the Website is kept by Framer for a limited period for security and error diagnosis; the aggregated analytics data does not identify individual visitors.
• Data related to demo and contact requests is kept for as long as needed to handle the request and the resulting business communication. Where a customer relationship follows, the data becomes part of the records of that relationship.
• Where retention periods are prescribed by law, for example for accounting records, we keep the relevant data for those periods.

Afterwards, personal data is deleted or anonymised.

09Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure of your data, where the conditions of Article 17 GDPR are met;
• restriction of processing in the cases provided by Article 18 GDPR;
• object to processing based on our legitimate interests, including profiling based on those interests, and to object at any time to processing for direct marketing;
• data portability, where processing is based on consent or a contract and carried out by automated means;
• withdraw consent at any time where processing relies on consent, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, write to contact@edisapsolutions.com, use the contact page or write to us by post at one of the addresses given in the Data controller section. We may ask you to confirm your identity before responding.

10Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority for EDI & SAP Solutions SRL is the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), www.dataprotection.ro.

11Cookies and analytics

The Website does not set cookies on your device and does not use advertising, social-media or cross-site tracking technologies.

Website usage is measured with Framer Analytics, the built-in analytics of the platform that hosts the Website. It does not use cookies or persistent identifiers stored on your device; page views are counted in aggregated form on the basis of our legitimate interest in understanding how the Website is used. No other analytics, advertising or tracking service is used on the Website.

The fonts used on the Website are loaded from Google Fonts when a page is displayed. Google receives the technical request data, including your IP address, that is needed to deliver the font files; no cookies are set for this purpose.

Videos on the Website, where available, are shown as a preview image first. The third-party video player, and the data transfer to the video provider that comes with it, is only loaded after you click Play.

If we introduce technologies that require your consent in the future, we will ask for your consent before they are used and update this policy.

12Links to other websites and the ESS Hub application

The Website links to other websites, including edisapsolutions.com, drelo.ai and essix.ai, and to the ESS Hub application at app.esshub.ai. Those websites and the application provide their own privacy information.

When you sign in to the ESS Hub application, the processing of your personal data is governed by the agreement between ESS and the customer organisation that gave you access, and by the notices provided in the application.

13Changes to this policy

We may update this policy when the Website or our processing activities change. The current version is always available at esshub.ai/privacy. Material changes are indicated by an updated effective date at the top of this page.

14Contact

For questions about this Privacy Policy or about the processing of your personal data, contact EDI & SAP Solutions SRL at contact@edisapsolutions.com, by telephone at (+40) 729 103 638, through our contact page or by post at one of the addresses given in the Data controller section.