Privacy policy
Last updated:
This policy describes how NextLevelSoft S.R.L., with its registered office at Bd. Dimitrie Pompeiu 6A, Etaj 4, 020337 București, Romania, registered under number J40/8123/2017 with VAT ID RO38412905, processes personal data in accordance with Regulation (EU) 2016/679 (GDPR).
1. Data controller
The data controller is NextLevelSoft S.R.L.. For any request regarding your data, write to contact@nextlevelsoft.ro or by post to our registered office.
2. What data we collect
- Data you provide directly through the contact form: name, email address, phone (optional), company, job title, project type, estimated budget and your message.
- Technical data generated automatically when you visit the site: IP address, browser type, referring page and access time. These are kept in server logs.
- Application data, when you apply for an open position: your CV and the information you include in it.
3. Purposes and legal bases
- Responding to commercial enquiries — basis: pre-contractual steps at your request, Article 6(1)(b) GDPR.
- Site security and operation — basis: our legitimate interest in preventing abuse, Article 6(1)(f) GDPR.
- Recruitment — basis: pre-contractual steps and your consent to keep your CV in our candidate database.
- Compliance with legal obligations, in particular accounting and tax obligations — Article 6(1)(c) GDPR.
4. Retention period
Contact requests are kept for 24 months from the last interaction. Technical server logs are kept for 90 days. Candidate CVs are kept for 12 months after the recruitment process ends, where you consented to that. Accounting documents are kept for the periods required by law.
5. Recipients
We do not sell or rent personal data. Data may be accessed by our service providers acting as processors, strictly under data processing agreements: our hosting provider (data centre in the European Union), our transactional email provider and our internal customer relationship tooling. All transfers remain within the European Economic Area.
6. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. You may withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
Requests should be sent to contact@nextlevelsoft.ro and are answered within 30 days at most. If you believe your rights have been infringed, you may lodge a complaint with the Romanian supervisory authority (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest.
7. Data security
We apply technical and organisational measures proportionate to the risk: encryption in transit (TLS 1.3), role-based access, logging of administrative operations, daily backups that are tested regularly, and automated software dependency scanning. Further detail is available on our Security and compliance page.
8. Automated decisions
We do not take decisions based solely on automated processing that produce legal effects concerning you, and we do not carry out profiling for marketing purposes.
9. Changes
We update this policy whenever the way we process data changes. The version in force is always published at this address, with the date of the last update shown at the top of the page.