Operator and scope
This notice describes how SC DEVO SRL, Romania ("DEVO", "we"), uses personal data in connection with devo-soft.com, the company panel and the online account and licensing services used by the DEVO application. Contact: office@devo-soft.com. Formal registration details are pending completion and will be added when available.
It covers visitors, people making inquiries, company representatives and application users. It does not replace the separate privacy information a customer company must give for its own clients, staff and business records.
Data categories and sources
We receive information directly from you, from the company administrator who creates or manages your access, and from the technical use of the website and account services.
- Inquiries: company, fiscal ID, e-mail, phone, category, subject, message and subsequent correspondence.
- Company and licensing records: company identification and contact details, license code, validity, activation limits and relevant billing records.
- User access: user names, password hashes, enabled status, device identifiers, session and connection timestamps, authorization information and the company-configured working path.
- Technical information: IP address, browser/request information and service logs used to operate and protect the service.
Do not send passwords, identity documents or sensitive personal information through the Contact form. We do not request special categories of personal data for ordinary product inquiries.
Purposes and legal grounds
We use personal data only for the relevant purpose and legal ground under Article 6(1) of Regulation (EU) 2016/679 (GDPR):
- Inquiries and services: steps requested before a contract and performance of a contract with the individual, where applicable (Article 6(1)(b)).
- Business contacts and company users: legitimate interests in responding to inquiries, providing company access and administering the business relationship (Article 6(1)(f)), subject to the individual’s rights.
- Security: legitimate interests in preventing misuse and protecting accounts and service availability (Article 6(1)(f)).
- Required records: applicable legal obligations, including accounting obligations where relevant (Article 6(1)(c)).
- Optional consent: Article 6(1)(a) applies only when specific consent is requested; sending an ordinary inquiry does not subscribe you to marketing.
This website does not currently provide a card checkout. License and service arrangements are agreed separately.
Required information
The Contact form marks the fields needed to submit a request. Without adequate contact details or a message, we may be unable to respond. Account and license information is necessary to authenticate users, verify access and provide the requested service.
When an administrator provides another person’s details, the company must inform that person and ensure it has an appropriate basis for doing so.
Application business files
Operational records, documents, inventory, private chat and report discussions are stored in the local or shared company locations configured in DEVO. The account and licensing services do not upload those working files as part of normal license verification.
The company determines access to its working folders and any external synchronization service it chooses. It remains responsible for the purposes, access rules and retention of those business records. If you voluntarily send files for support, we process the material received to handle that request; remove unrelated personal data before sending it.
Cookies and browser storage
The company panel uses the essential devo_company session cookie for authenticated access. It is protected with Secure, HttpOnly and SameSite=Strict attributes in production, and has a maximum duration of 12 hours. Signing out invalidates the session.
If you select “Remember me”, the browser stores the company license code locally to prefill the next login. It does not store the company password for that option. You can remove the saved code by clearing that choice or the website’s browser storage.
The website currently includes no advertising or behavioral analytics scripts. Hosting and security providers may use technical cookies or logs for their services. Blocking essential storage may prevent authentication; external services linked from the site have their own policies.
Recipients and service providers
Access is limited to people and providers who need the information for the relevant service. The website uses Vercel for hosting, Upstash/Redis infrastructure for account and license records, and e-mail/SMTP infrastructure for messages. Domain, DNS and security providers also support operation of the site.
Authorized company administrators can see and manage their company’s users and access status. Relevant information may also be disclosed to professional advisers or public authorities where required by law or necessary for legal claims. We do not sell personal data.
Opening a Discord, WhatsApp or other external link takes you to a separate provider; its processing is governed by its own privacy information.
Processing outside the EEA
The technical providers used by the service may operate outside the European Economic Area. Any transfer subject to the GDPR must have an applicable Chapter V basis, such as an adequacy decision or appropriate contractual safeguards. We do not represent that all infrastructure is located in Romania or the EEA.
Contact office@devo-soft.com for information about the providers and transfer arrangements relevant to your data, including any applicable safeguards.
Retention
Inquiry and support correspondence is kept for the time needed to resolve the request and any related business follow-up. Company, user and license records are retained while needed to provide and administer access, address disputes and meet applicable record-keeping duties.
Retention depends on the active relationship, the purpose of the record, any statutory obligation and relevant claim periods. Technical logs follow the operational retention settings of the relevant service. Short-lived sessions expire automatically. Where continued retention is no longer justified, data should be deleted or anonymized; restricted legal records are kept only for the required purpose.
Security and access
The service uses HTTPS, password hashing, controlled sessions and server-side authorization for company actions. Access is restricted according to account permissions. These measures reduce the risk of unauthorized access but cannot eliminate every security risk.
Keep your credentials confidential, use a unique password and sign out on shared devices. Report suspected unauthorized access to office@devo-soft.com. Where a personal data breach triggers statutory notification duties, the applicable GDPR procedures and deadlines must be followed.
Your rights and complaints
Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction or portability of your data, object to processing based on legitimate interests, or withdraw consent for consent-based processing. Withdrawal does not affect prior lawful processing. Rights may be limited by lawful retention requirements.
Send requests to office@devo-soft.com. We may request the minimum information necessary to verify identity. Responses are due within one month; complex or numerous requests may require up to two additional months, with notice and reasons within the first month.
You may complain to a competent supervisory authority. In Romania, contact the ANSPDCP. This does not affect your right to a judicial remedy.
Automated decisions, changes and contact
The website does not use profiling for advertising or automated decisions with legal or similarly significant effects on individuals. Technical access checks enforce license and account settings and can be raised with us for review.
This notice is updated when relevant services or processing change. The date shown above identifies the current version.