Privacy Policy

1. General Provisions

This Privacy Policy ("Policy") describes how Assembly Softworks, based in Romania ("Assembly", "Operator", "we", "us"), collects, uses, stores, and protects personal data of users who access our website at assembly.lol ("Website") and any related services, software, and products (collectively, the "Services").

This Policy is prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the "General Data Protection Regulation" or "GDPR"), Romanian Law No. 190/2018 on measures for implementing the GDPR, and other applicable data protection legislation of Romania and the European Union.

By creating an account, accessing, or using any of the Services, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein. If you do not agree with this Policy, you must not use our Services.

2. Data Controller

The data controller responsible for processing your personal data is:

• Entity: Assembly Softworks
• Location: Romania
• Contact: [email protected]

For any questions or requests regarding the processing of your personal data, you may contact us at the email address above.

3. Key Definitions

• Personal data: Any information relating to an identified or identifiable natural person ("Data Subject"). An identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, ID number, location data, online identifier, or other factors.
• Processing: Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, restriction, erasure, or destruction.
• Data Subject (User): Any visitor or registered user of the Website.
• Consent: Any freely given, specific, informed, and unambiguous indication of the Data Subject’s wishes by which they signify agreement to the processing of personal data relating to them.
• Cross-border transfer: Transfer of personal data to a recipient in a country outside the European Economic Area (EEA).
• Anonymization: The process of irreversibly altering personal data so that the Data Subject can no longer be identified, directly or indirectly.

4. Data We Collect

We collect and process the following categories of personal data:

• Account information: Username, email address
• Technical data: IP address, browser language, operating system, unique device identifiers (HWID)
• Usage data: Login timestamps, session information, actions performed within the Services
• Communication data: Support ticket messages, uploaded files and attachments
• Payment data: Transaction identifiers (we do not store full payment card details — payment processing is handled by third-party providers)

We also collect anonymized data through cookies and similar technologies. Cookies are small text files stored on your device by your browser. They help us understand how you interact with the Website, improve performance, and remember your preferences.

You may configure your browser to refuse cookies or alert you when cookies are being sent. However, some parts of the Website may not function properly without cookies.

5. Purposes and Legal Basis for Processing

We process your personal data for the following purposes:

• Contract performance (Art. 6(1)(b) GDPR): To create and manage your account, provide the Services, process subscriptions, and deliver purchased products.
• Legitimate interest (Art. 6(1)(f) GDPR): To maintain security, detect fraud or abuse, enforce our Terms of Use, improve our Services, and perform analytics.
• Consent (Art. 6(1)(a) GDPR): To send you marketing communications about new products, offers, or updates. You may withdraw this consent at any time.
• Legal obligation (Art. 6(1)(c) GDPR): To comply with applicable Romanian and EU laws, including tax, accounting, and regulatory requirements.

We may use anonymized and aggregated data for internal analytics, research, and service improvement. Such data does not identify you personally.

6. Data Sharing and Third Parties

We do not sell your personal data. We may share your data with the following categories of recipients, only to the extent necessary:

• Payment processors: Third-party payment services that handle transaction processing on our behalf (e.g., Stripe). These processors have their own privacy policies governing the use of your information.
• Infrastructure providers: Hosting, CDN, and security services (e.g., Cloudflare) that help us deliver and protect the Website.
• Analytics services: Tools that help us understand Website usage patterns through anonymized or aggregated data.
• Legal authorities: Government or law enforcement bodies when required by applicable Romanian or EU law, or to protect our rights, property, or safety.

All third-party service providers are contractually obligated to process your data only for the purposes we specify and in compliance with applicable data protection legislation.

7. Cross-Border Data Transfers

Your personal data may be transferred to and processed in countries outside Romania or the European Economic Area (EEA). In such cases, we ensure that appropriate safeguards are in place, including:

• Transfers to countries recognized by the European Commission as providing an adequate level of data protection;
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Your explicit consent to the transfer, where applicable.

8. Data Retention

We retain your personal data for as long as your account remains active or as necessary to provide the Services. Specifically:

• Account data is retained for the duration of your account and deleted upon account deletion, unless retention is required by law.
• Technical logs (IP addresses, session data) are retained for up to 12 months for security and fraud prevention purposes.
• Financial records may be retained for the period required by Romanian tax and accounting legislation (generally up to 10 years).
• Support ticket data is retained for 24 months after ticket closure.

Upon expiry of the retention period, personal data is permanently deleted or anonymized so that you can no longer be identified.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest where applicable;
• Access controls and authentication mechanisms, including two-factor authentication;
• Regular security assessments and monitoring for vulnerabilities;
• Logging and detection of unauthorized access attempts;
• Secure storage of passwords using industry-standard hashing algorithms.

While we take all reasonable steps to protect your data, no system is completely secure. You are responsible for maintaining the confidentiality of your account credentials. We are not liable for unauthorized access resulting from your failure to protect your login information.

10. Your Rights Under GDPR

As a Data Subject under GDPR, you have the following rights:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to restriction (Art. 18): You may request that we limit the processing of your data under certain circumstances.
• Right to data portability (Art. 20): You may request to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days, as required by GDPR.

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at www.dataprotection.ro.

11. Children’s Privacy

Our Services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly. If you believe a child has submitted personal data to us, please contact us at [email protected].

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, legal requirements, or Services. When we make material changes, we will notify users by posting the updated Policy on the Website and updating the "Last updated" date above.

Continued use of the Services after any changes constitutes your acceptance of the revised Policy. We encourage you to review this page periodically.

13. Applicable Law and Jurisdiction

This Policy is governed by and construed in accordance with the laws of Romania and the applicable regulations of the European Union, including the GDPR. Any disputes arising in connection with this Policy shall be submitted to the exclusive jurisdiction of the competent courts in Romania.

14. Contact

For any questions, requests, or concerns regarding this Privacy Policy or the processing of your personal data, please contact us at [email protected] or open a support ticket from your dashboard.