Privacy Policy
Privacy Policy
Data Controller: Class RDA Impex SRL · Jurisdiction: RO VAT / Registration No.: 29867320 · Address: Str. Pridvorului, nr.5, bl.6, Ap.1, Sector 4, București, RO Version: vL2.2 · Effective from: 05 September 2026
This Privacy Policy describes how Class RDA Impex SRL collects, uses, stores, and protects your personal data within the 4PRO Client application, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.
Please read this document carefully. If you have questions, you may contact our Data Protection Officer (DPO) at dpo@4pro.io.
1. Who is your data controller
Class RDA Impex SRL is the controller of the personal data collected through 4PRO Client.
| Name | Class RDA Impex SRL |
| Registered office | Str. Pridvorului, nr.5, bl.6, Ap.1, Sector 4, București, RO |
| VAT / Reg. No. | 29867320 |
| Jurisdiction | RO |
| DPO | dpo@4pro.io |
Depending on your country of residence or on the application you use, your effective controller may differ. In that case, you will be notified at registration of the entity that controls your data, in accordance with our system's entity routing rules.
2. Data Protection Officer (DPO)
We have appointed an internal DPO to ensure GDPR compliance. You may contact the DPO at any time at dpo@4pro.io for:
- exercising your rights (access, erasure, portability, etc.);
- questions about how we process your data;
- reports or complaints regarding data protection.
3. What data we collect
3.1 Identification and account data
When creating an account we collect: first and last name, email address, phone number (optional), password (stored in hashed form, never in plain text). If you authenticate via SSO (Single Sign-On) from another application in the 4PRO ecosystem, we receive the session token and the associated profile data.
3.2 Service usage data
We collect automatically: access logs (IP address, User-Agent, timestamp), in-app navigation events (pages visited, features used), the preferences set in your account, and the history of actions performed.
3.3 Communication data
If you opt in to notifications via WhatsApp, SMS, or email: WhatsApp/SMS phone number and notification preferences.
3.4 Payment data
Payments are processed by certified third-party providers (Stripe, Revolut Business, etc.). We do not store bank card data. We receive only the transaction confirmation and a subscription identifier.
3.5 Technical data and cookies
IP address, browser type, operating system, screen resolution, session data and cookies — as described in the Cookie Policy.
4. Purposes and legal bases for processing
| Purpose | Data categories | Legal basis (GDPR) |
|---|---|---|
| Account creation and management | Identification data | Art. 6(1)(b) — contract performance |
| Providing the core features of 4PRO Client | Usage data, account data | Art. 6(1)(b) — contract performance |
| Sending notifications (push, WhatsApp, email) | Contact data, preferences | Art. 6(1)(a) — consent; or Art. 6(1)(b) for essential account-related notifications |
| Payment processing and subscription management | Transaction data | Art. 6(1)(b) — contract performance |
| Security, fraud and abuse prevention | Technical data, logs | Art. 6(1)(f) — legitimate interests |
| Product improvement and usage analysis | Usage data (anonymised or pseudonymised) | Art. 6(1)(f) — legitimate interests; or Art. 6(1)(a) — consent, for personalised data |
| Compliance with legal obligations (accounting, audit) | Identification data, transaction data | Art. 6(1)(c) — legal obligation |
| Dispute resolution and defence of our rights | Data relevant to the dispute | Art. 6(1)(f) — legitimate interests |
Our legitimate interests (Art. 6(1)(f)) are assessed through a proportionality (balancing) test and do not override your fundamental rights. You may request a copy of the relevant balancing test by contacting the DPO.
5. Recipients and data processors
We may share your data with third parties exclusively in the contexts below:
5.1 Processors (acting on our behalf)
| Processor | Role | Location | Transfer safeguard |
|---|---|---|---|
| Hosting provider (VPS / cloud) | Server infrastructure | EU/EEA | Not applicable (processing within the EEA) |
| Stripe / Revolut Business | Payment processing | EU/EEA and USA | USA: Standard Contractual Clauses, Decision (EU) 2021/914; EU-US Data Privacy Framework where the provider is certified |
| Meta Platforms (WhatsApp Business API) | WhatsApp notifications | USA | Standard Contractual Clauses, Decision (EU) 2021/914; EU-US Data Privacy Framework where Meta is certified |
| AI providers (e.g. Google Gemini, Anthropic, Groq) | Automated processing within the service | EU/EEA and USA | USA: Standard Contractual Clauses, Decision (EU) 2021/914; EU-US Data Privacy Framework where the provider is certified |
| Transactional email service | Sending system emails | EU/EEA and, as applicable, USA | USA: Standard Contractual Clauses, Decision (EU) 2021/914; EU-US Data Privacy Framework where the provider is certified |
All processors are contractually bound to comply with GDPR through Data Processing Agreements (DPAs).
5.2 Public authorities
We share data with public authorities exclusively where we are under a legal obligation to do so (e.g. the tax authority ANAF, courts of law), strictly within the limits of the request.
5.3 Other controllers in the 4PRO ecosystem
If you use several applications in the 4PRO ecosystem (e.g. 4PRO Client, 4PRO Pro), account data may be shared via the SSO mechanism for unified authentication. Each application operates its own features as a distinct controller.
Where two or more applications jointly determine the purposes and means of a given processing, they act as joint controllers within the meaning of Art. 26 GDPR. In that case, the essence of the arrangement between the joint controllers (the allocation of responsibilities for meeting GDPR obligations, in particular the exercise of your rights, and a single point of contact for exercising those rights) is made available to you, and you may exercise your rights against any of the joint controllers.
We do not sell your personal data.
6. International data transfers
Your data controller is an entity established in Romania/the EU; there is no international transfer at controller level. However, certain recipients and sub-processors do process data outside the European Economic Area (EEA) — in particular the AI and communications providers listed below. We ensure that these transfers are carried out exclusively on the basis of a valid legal mechanism under Art. 46 GDPR:
- Stripe / Revolut Business (payment processing, USA) — Standard Contractual Clauses, Decision (EU) 2021/914, supplemented by the EU-US Data Privacy Framework where the provider is certified;
- Meta Platforms / WhatsApp (notifications, USA) — Standard Contractual Clauses, Decision (EU) 2021/914, supplemented by the EU-US Data Privacy Framework where Meta is certified;
- AI providers — e.g. Google Gemini, Anthropic, Groq (USA) — Standard Contractual Clauses, Decision (EU) 2021/914, supplemented by the EU-US Data Privacy Framework where the provider is certified;
- Transactional email service / hosting — where this involves processing outside the EEA — Standard Contractual Clauses, Decision (EU) 2021/914, or a European Commission adequacy decision.
For recipients in countries covered by a European Commission adequacy decision, the transfer relies on that adequacy decision. You may request a copy of the applicable safeguards by contacting the DPO at dpo@4pro.io.
7. Retention periods
| Data category | Retention period |
|---|---|
| Account data (active) | Duration of the active account + 90 days after deletion |
| Access and security logs | 12 months |
| Transaction and billing data | 10 years (legal obligation — tax law) |
| Communications with the DPO | 5 years (defence of legal rights) |
| Marketing data (with consent) | Until withdrawal of consent |
| Inactive accounts | 24 months of inactivity → notification → 30 days → deletion |
Upon expiry of the retention period, data is permanently deleted or irreversibly anonymised.
8. Your rights under GDPR
Under GDPR, you have the following rights, which you may exercise by contacting dpo@4pro.io:
Right of access (Art. 15): You may request a copy of the personal data we process about you and information about how it is processed.
Right to rectification (Art. 16): You may request the correction of inaccurate data or the completion of incomplete data.
Right to erasure — "the right to be forgotten" (Art. 17): You may request the erasure of your data when: the purpose of processing has ceased, you have withdrawn your consent, you have objected to the processing and there are no overriding legitimate grounds, the processing was unlawful, or there is a legal obligation to erase. Exceptions: data necessary for legal obligations or for the defence of rights in legal proceedings.
Right to restriction of processing (Art. 18): You may request the restriction of processing in certain situations (e.g. where you contest the accuracy of the data).
Right to data portability (Art. 20): You may receive the data you have provided in a structured, commonly used, machine-readable format (JSON/CSV), and transmit it to another controller, where the processing is based on consent or on a contract and is carried out by automated means.
Right to object (Art. 21): You may object at any time to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds which override your rights. You have an unconditional right to object to processing for direct marketing purposes.
Right to withdraw consent (Art. 7(3)): Consent may be withdrawn at any time, as easily as it was given, without affecting the lawfulness of processing carried out beforehand. Withdrawal can be done from Settings → My Account or by contacting the DPO.
Right not to be subject to an automated decision (Art. 22): We do not apply automated decisions producing significant legal effects based solely on automated processing without human involvement. AI recommendations are advisory and produce no legal effects.
Response time: We will respond to your request within 30 calendar days of receipt. This period may be extended by 60 days in complex cases, with prior notice to you.
9. Data security
We implement appropriate technical and organisational measures to protect your data:
- Encrypted transmission: all communications use TLS 1.2+;
- Secure storage: passwords are stored hashed with bcrypt (cost factor ≥ 12); sensitive data is encrypted at rest;
- Limited access: the need-to-know principle for employees and contractors;
- Monitoring: access logs and intrusion detection systems;
- Breach notification procedures: in the event of an incident affecting your rights, we will notify you within 72 hours of discovery (or as soon as possible), in accordance with Art. 33-34 GDPR.
10. Cookies
We use cookies as described in the Cookie Policy, which forms an integral part of this Privacy Policy.
11. Children and minors
The Service is not intended for children under 16. We do not knowingly collect data from minors below this age. If you become aware that a minor has provided us with data without adequate parental consent, please contact us at dpo@4pro.io and we will promptly delete the data in question.
12. Changes to this Policy
This Policy may be updated periodically. Significant changes will be communicated via an in-app banner and/or email at least 14 days before they take effect. The date of the last update is indicated in the document header.
Continued use of the Service after the changes take effect constitutes acceptance of the new Policy.
13. Right to lodge a complaint with the supervisory authority
If you consider that your data is being processed in breach of GDPR, you have the right to lodge a complaint with the competent supervisory authority:
Romania — ANSPDCP (National Supervisory Authority for Personal Data Processing) Bd. G-ral. Gheorghe Magheru, nr. 28-30, Sector 1, Bucharest, Postal code 010336 Phone: +40.318.059.211 Email: anspdcp@dataprotection.ro Web: https://www.dataprotection.ro
You also have the right to contact the supervisory authority of the EU member state where you have your habitual residence, your place of work, or the place of the alleged infringement.
Exercising this right does not affect your right to seek judicial remedies.
Contact
Class RDA Impex SRL Str. Pridvorului, nr.5, bl.6, Ap.1, Sector 4, București, RO DPO Email: dpo@4pro.io
Version vL2.2 · Effective from 05 September 2026