SUMMARY
- 1. Who is responsible
- 2. Two situations to distinguish
- 3. What we process, and why
- 4. We do not sell your data
- 5. Our service providers
- 6. Transfers outside the European Union
- 7. Artificial intelligence
- 8. Your rights
- 9. Security
- 10. Your visitors’ data, in your assistant
- 11. Cookies
- 12. Minors
- 13. Complaints
- 14. Changes
- 15. Contact
This policy explains what personal data we process, why, for how long, and what your rights are. It applies to the pricati.com website, the ia.pricati.com platform, and the Pricati service.
It is drafted in accordance with Regulation (EU) 2016/679 (“GDPR”), Law no. 190/2018, and Law no. 506/2004.
1. Who is responsible
Sdravobiz S.R.L.
Strada Trandafirilor 51, 307220 Giroc, Romania
CUI: RO51472367 — Intra-EU VAT: RO51472369
Trade Register: J2025016522009
Email: contact@sdravobiz.com
Sdravobiz is not required to appoint a Data Protection Officer within the meaning of Article 37 of the GDPR: its activity involves neither large-scale processing of sensitive data, nor large-scale systematic monitoring of individuals.
Any request may be sent to contact@sdravobiz.com, indicating “GDPR” in the subject line.
2. Two situations to distinguish
This is the most important point of this policy.
Your own data, as a client or visitor. We are the data controller. This is the subject of Articles 3 to 9 below.
The data of individuals who interact with your assistant. You are the data controller, and we act only as a data processor, according to your instructions. This is the subject of Article 10.
3. What we process, and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account, subscription, and billing — account creation, contract performance, invoices, accounting obligations | Last name, first name, company, address, email, phone number, VAT number, order and invoice history | Contract performance (Art. 6.1.b) and legal obligation (Art. 6.1.c) | Duration of the contract, then 10 years pursuant to Law no. 82/1991 |
| Service setup — preparation of your assistant, domain configuration, access provisioning | Assistant name, website address, desired domain or subdomain, logo, contact address, zone records | Contract performance (Art. 6.1.b) | Duration of the contract, then 30 days |
| Service provision — access to the administration area, assistant training and execution, technical logs, security | Credentials, IP address, connection and activity logs, configuration, domain, assistant identifiers | Contract performance (Art. 6.1.b); legitimate interest for security (Art. 6.1.f) | Duration of the contract, then 30 days; technical logs: 12 months |
| Payments — collection, fraud prevention, disputes, and refunds | Billing details, transaction history, and transaction IDs | Contract performance (Art. 6.1.b); legitimate interest for fraud prevention (Art. 6.1.f) | 10 years (accounting obligations) |
| Service emails — confirmation, invoice, access, setup steps, expiration, incident, maintenance | Name, email, account ID | Contract performance (Art. 6.1.b) | Duration of the contract, then statutory archiving |
| Support and customer relations | Name, email, content of communications, submitted screenshots | Contract performance (Art. 6.1.b); legitimate interest for prospects (Art. 6.1.f) | 3 years after the last contact (customers); 13 months (prospects) |
| Newsletter and marketing information | Name, email, language, opens, and clicks | Consent (Art. 6.1.a); legitimate interest for customers regarding a similar service | Until withdrawal of consent, and at most 3 years after the last interaction |
| Website audience measurement | Anonymized IP address, page views, duration, traffic source, device, and browser | Consent (Art. 6.1.a) for non-essential cookies; legitimate interest for anonymized measurements | 14 months |
| Legal obligations and litigation | Invoices, supporting documents, connection data | Legal obligation (Art. 6.1.c); legitimate interest for legal defense | Applicable statutory period |
We do not make any fully automated decisions producing legal effects concerning you, and we do not engage in advertising profiling.
4. We do not sell your data
Sdravobiz does not sell, rent, or transfer your personal data to third parties for commercial purposes.
Your data is only shared with the service providers listed in Section 5, competent administrative or judicial authorities upon legal requisition, and our legal counsel in the event of contentious proceedings.
5. Our service providers
We use processors within the meaning of Article 28 of the GDPR, selected for their safeguards. This list is subject to change.
| Service Provider | Role | Location | Transfer Safeguards |
|---|---|---|---|
| Stripe Payments Europe, Ltd | Online payment, fraud prevention | Ireland (EU), group servers in the United States | Standard Contractual Clauses + EU-US Data Privacy Framework |
| o2switch | Hosting of pricati.com and the client portal | France (EU) | No transfer outside the EU |
| Conversational platform (assistant engine, training, indexing, history logs) | Creation, training, hosting, and execution of client assistants | European Union and United States | Standard Contractual Clauses, supplemented where applicable by the EU-US Data Privacy Framework |
| Language model providers | Generation of assistant responses, calculation of vector representations, transcription of audio and video content | European Union and United States | Standard Contractual Clauses + EU-US Data Privacy Framework; options excluding training on submitted content |
| Content delivery network | Delivery of the assistant script and media | Global | Standard Contractual Clauses |
| Google Ireland Ltd (Analytics, Search Console) | Audience measurement and SEO tracking | Ireland (EU), servers in the United States | Standard Contractual Clauses + EU-US Data Privacy Framework |
| FluentCRM (self-hosted) | Emails and newsletter | France (EU) | Not applicable — self-hosted |
| FluentCart / client portal (self-hosted) | Orders, subscriptions, licenses | France (EU) | Not applicable — self-hosted |
| Messaging platforms and third-party services activated by the client | Distribution of the assistant on channels chosen by the client | Global | Independent data controllers, subject to their own terms |
| Accountant and legal counsel | Accounting and legal obligations | Romania | Service agreement, confidentiality clause |
The services you activate yourself — payment, delivery, analytics, automation, messaging — are governed by their own providers and their own terms and conditions.
6. Transfers outside the European Union
The operation of the assistant requires that the questions asked and the excerpts from your knowledge base necessary to generate the response be transmitted to language model providers, part of whose infrastructure is located in the United States. Other service providers may also process data outside the European Economic Area.
These transfers are governed by the safeguards under Chapter V of the GDPR: adequacy decisions where available (notably the EU-US Data Privacy Framework), standard contractual clauses adopted by the European Commission, supplemented where applicable with additional measures (encryption in transit and at rest, data minimization, pseudonymization).
A copy of these safeguards can be obtained upon request at contact@sdravobiz.com.
7. Artificial Intelligence
The assistant’s responses are automatically generated by language models based on the content provided by the customer. They are neither written nor pre-validated, and may be inaccurate or incomplete.
Specifically, to generate a response:
- the question asked and the relevant excerpts from the knowledge base are transmitted to the language model provider;
- the generated response is returned to the user and recorded in the conversation history of the relevant assistant;
- knowledge base contents are converted into vector representations to enable semantic search.
From our language model providers, we select options that exclude the use of transmitted content to train their own models, within the limits of the conditions offered by these providers. We do not use a client’s conversations or knowledge bases to train models intended for other clients.
The assistant makes no automated decisions producing legal effects or significantly affecting you within the meaning of Article 22 of the GDPR. If you configure your assistant to do so, it is your responsibility to assume the obligations as data controller.
8. Your rights
You have the following rights (Articles 15 to 22 of the GDPR):
- access: find out if we process data concerning you and obtain a copy of it;
- rectification: have inaccurate or incomplete data corrected;
- erasure: obtain their deletion, within the limits of our legal retention obligations;
- restriction: temporarily restrict processing;
- portability: receive your data in a structured and machine-readable format;
- objection: object to processing based on legitimate interest, and unconditionally to commercial prospecting;
- withdrawal of consent at any time, without affecting the lawfulness of prior processing;
- post-mortem instructions regarding the fate of your data;
- complaint to a supervisory authority (Article 13).
How to exercise them. By email to contact@sdravobiz.com (subject “GDPR”) or by mail to our registered office. To prevent fraudulent communications, we may request proof of identity. We respond within one (1) month, which may be extended by two months in the event of complexity or high volume of requests (Article 12.3 of the GDPR).
If you have interacted with the assistant of a client company and wish to exercise your rights regarding this conversation, please contact that company directly: it is the data controller (Article 10). We will forward your request if you are unable to identify it.
9. Security
We implement appropriate technical and organizational measures as provided for by Article 32 of the GDPR, including: encryption of connections (HTTPS/TLS), encryption of content at rest, payments processed by a PCI-DSS Level 1 certified provider, strict access control and strong authentication for administrator accounts, customer environment partitioning, access logging, regular backups, continuous security updates, awareness training for personnel with access to data, and contractual confidentiality commitments with our subcontractors.
No system can guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ANSPDCP within seventy-two (72) hours and inform you directly when the risk is high (Articles 33 and 34 of the GDPR).
10. Your visitors’ data in your assistant
This article applies to the personal data you collect, as a customer, through your assistant: conversation content, contact details provided by your visitors, requests, bookings, usage statistics.
You are the data controller. You determine the purposes and means, define the legal bases and retention periods, inform your visitors — including the fact that they are interacting with an automated system and that their messages are processed by language model providers established outside the European Union —, collect any necessary consents, publish your own privacy policy, and respond to the exercise of their rights.
It is also your responsibility to configure your assistant so that it does not request sensitive data within the meaning of Article 9 of the GDPR, nor banking data, nor government-issued identifiers.
We are a data processor within the meaning of Article 28 of the GDPR. As such:
- we process this data solely on your documented instructions, exclusively for the purposes of providing the service: hosting, indexing your knowledge base, running the assistant, generating responses, retaining history, backups, technical support upon your request, security;
- we do not exploit them for our own purposes, analyze them for commercial purposes, market them, or transfer them;
- we do not use them to train models intended for other clients, and we select options from our providers that exclude their use for training purposes;
- our authorized personnel are bound by a confidentiality obligation and only access your data in the event of technical necessity or at your request;
- we implement the security measures set forth in Article 9;
- we reasonably assist you in your obligations regarding security, breach notification, impact assessment, and responding to requests from your visitors;
- we will notify you without undue delay of any data breach affecting your installation;
- we may use the subsequent subprocessors listed in Article 5, for whom we remain responsible to you; any substantial change to this list will be notified to you, and you may object to it on legitimate grounds;
- at the end of the contract, your data can be retrieved for thirty (30) days and is then permanently deleted, subject to our legal retention obligations.
Categories of data and data subjects: visitors to your website and users of your channels — content of exchanged messages, contact details they spontaneously provide, language, timestamp, technical conversation identifier, originating page or channel.
Location. The client portal and the website are hosted in France. The conversational platform and language model providers process data in the European Union and the United States, under the terms of Article 6.
This article constitutes a data processing agreement within the meaning of Article 28.3 of the GDPR between you and Sdravobiz S.R.L. It supplements the General Terms and Conditions of Sale, of which it forms an integral part.
11. Cookies
A cookie is a small file placed on your device during your visit. We use very few of them.
| Category | Tool | Purpose | Duration | Legal basis |
|---|---|---|---|---|
| Strictly necessary | WordPress session (wordpress_*) | Authentication, security | Session / 30 days | Legitimate interest — without consent |
| Strictly necessary | Language preference (pll_language) | Display language | 12 months | Legitimate interest — without consent |
| Strictly necessary | Assistant conversation ID | Retrieve the ongoing conversation thread and avoid restarting it on each page | Session / 30 days (local storage) | Legitimate interest — without consent |
| Audience measurement | Google Analytics (_ga, _ga_*) | Anonymized statistics | 13 months | Consent |
| Functional / marketing | FluentCRM (fcrm_*) | Tracking email opens and clicks | 12 months | Consent |
During your first visit, a banner allows you to accept, decline, or configure non-strictly necessary cookies. You can modify your preferences at any time via the “Manage my cookies” link at the bottom of each page.
Refusing non-essential cookies prevents neither access to the website nor the viewing of its content.
On our clients’ websites. The assistant placed on a client’s website stores a technical conversation identifier in the browser’s local storage in order to retrieve the thread of the exchange. It is the client’s responsibility to inform their visitors of this in their own cookie policy.
12. Minors
The website and service are not intended for minors under sixteen (16) years of age. We do not knowingly collect their data without the consent of the holder of parental authority (Article 8 of the GDPR). If we discover such data, we delete it without delay. Any request may be sent to contact@sdravobiz.com.
If your assistant is aimed at a minor audience, it is your responsibility, as a data controller, to implement the required verification and parental consent collection measures.
13. Complaints
If you believe that the processing of your data does not comply, you may lodge a complaint with the Romanian supervisory authority:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București, 010336, Romania
https://www.dataprotection.ro — anspdcp@dataprotection.ro — +40 318 059 211
If you reside in another Member State, you may also contact your national authority (CNIL in France, AEPD in Spain, Garante in Italy, CNPD in Portugal, BfDI in Germany, etc.).
14. Modifications
We may modify this policy to reflect legal, regulatory, technical, or contractual developments. The applicable version is the one published on the date of your visit. In the event of a material change, we will inform you via a banner on the site or by email if you are a customer.
15. Contact
Sdravobiz S.R.L.
Strada Trandafirilor 51
307220 Giroc, Romania
contact@sdravobiz.com (legal and GDPR) — contact@pricati.com (service and support)
https://pricati.com/en/?page_id=14746
Last updated: September 3, 2026