Privacy policy
Last updated: 9 November 2026
This policy explains what personal data we process on integrivox.com and in the app.integrivox.com application, why, for how long, and what your rights are.
1. Who processes the data
The controller is AVRI CONCEPT SERVICES S.R.L., registered office in Iași, Romania, str. Moșu nr. 4, mansardă, camera 2, ap. 12, VAT/tax ID 43408659, trade register no. J2020003002227 ("we"). Write to us at contact@i-maxim.com. We have not appointed a data protection officer; requests come straight to us.
2. Reports made through an organization's channel
When someone files a report on an organization's internal channel (the app.integrivox.com/r/… pages), the controller of the report data is that organization, under the EU Whistleblowing Directive and national law. We act as its processor (art. 28 GDPR): we host reports encrypted with a separate key per organization and do not read them. The Integrivox team has no access to case content.
On reporter pages we keep no IP addresses, use no tracking or analytics cookies and load no external scripts. For rights relating to a report, contact the organization's designated person; we can help technically, but the decision is theirs.
3. What we process, why, and on what basis
- Waiting list (form on the home page): email address, type of organization, number of employees and language, used only to tell you about Integrivox. Basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.
- Quote requests (schools page): institution, county, tax ID or SIIIR code, number of employees, name, role, email, phone and message, used to send the offer and prepare the contract. Basis: steps taken at your request before a contract (art. 6(1)(b)) and our legitimate interest in replying (f).
- App account: name, email, password (stored only as an irreversible hash), language, organization and role, invitations sent and, for the sign-in session, IP address and browser type. Basis: performance of the contract (b) and account security (f).
- Organization details you enter: name, tax ID, address, designated person, logo and colours. If you sign up with a company email we read the company's public website to suggest its logo and colours; you can change or remove them. Basis: performance of the contract.
- Payment and invoicing: organization name, tax ID and address, payer email, amount, period and invoice number. Card details are entered directly with Stripe; we never see or store them. Basis: performance of the contract and legal accounting and tax obligations (c).
- App emails: invitations, address confirmation, password reset, notices of new reports and deadlines (without case content) and subscription notices. Basis: performance of the contract.
- Server logs: on every visit to the site the server automatically records the IP address, requested page, date and browser. Basis: legitimate interest in operation and security (f).
- Traffic statistics (Google Analytics, only on integrivox.com and only if you accept): pages visited, referral source, device type, a truncated IP address and a random cookie identifier. Basis: consent (a). Details in the Cookie policy.
- Correspondence with us by email. Basis: legitimate interest in replying and defending our rights (f).
We do not sell data, do not use it for advertising and make no decisions based solely on automated processing that produce legal effects for you.
4. Who we share it with
We use these providers, which process data only on our behalf (processors):
- Hetzner Online GmbH, Germany: servers for integrivox.com, app.integrivox.com and the database (including data from the site's forms and backups).
- Claus Web S.R.L., Romania: email for the integrivox.com domain, including emails sent by the app.
- Stripe Payments Europe, Ltd., Ireland: card payments.
- Oblio Software S.R.L., Romania: invoicing; invoices are sent to the Romanian tax authority's RO e-Factura system as the law requires.
- Google Ireland Limited: Google Analytics and Google Tag Manager, only if you accept analytics.
We disclose data to authorities only when the law requires it.
5. Transfers outside the European Economic Area
The site, its forms, the application, reports and email are hosted in the EU (Germany and Romania). Only Google (if you accept analytics) and Stripe (for card payments) may transfer data to the USA. These transfers rely on the adequacy decision for the EU-US Data Privacy Framework, for certified providers, or on the European Commission's standard contractual clauses (art. 45 and 46 GDPR). You can ask us for a copy of the safeguards at contact@i-maxim.com.
6. How long we keep it
- Waiting list: until you unsubscribe, or at most 2 years after signing up.
- Quote requests: at most 3 years after the last contact if no contract is concluded.
- Account: while it is active. Sessions expire after 12 hours.
- Organization data and reports: while the organization has a subscription. After it lapses, open cases can be finished within the legal deadline, the organization receives the full archive, and after the grace period announced by email we permanently delete the data. Separately, the app automatically deletes each report 5 years after receipt, as Romanian Law 361/2022 requires.
- Payments and invoices: as long as accounting and tax law requires.
- Server logs: generally at most 90 days.
- Google Analytics data: 14 months.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time without affecting earlier processing. Write to contact@i-maxim.com; we reply within one month. You can complain to the Romanian supervisory authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, or the authority in your EU country.
8. Security
We use encrypted connections (HTTPS), per-organization encryption of report content, irreversibly stored passwords, a tamper-evident audit log, restricted server access and encrypted backups.
9. Changes
When we change this policy we update the date above. For significant changes we notify app users by email.