Privacy Policy

This Privacy Policy explains how Unified Systems collects, uses, discloses, protects and retains personal data in connection with unifiedsystems.ro, Unified Systems products and services, Unified Engine and communications with Clients and prospective Clients.

The policy applies to individuals whose data is processed directly as well as representatives, employees or contact persons of corporate Clients and partners.

This policy should be read together with the Terms and Conditions and, where relevant, the Cookie Policy.

The main controller of data processed through the website and the Unified Systems commercial relationship is:

Controller

S.C. Eight Sigma S.R.L.

Trading name

Unified Systems

Registered office

Bucharest, Sector 1, Sos. Gh. I. Sisesti, no. 303-309, Romania

Tax identification number

51250206

Trade Registry number

J2025008601008

Email

contact@unifiedsystems.ro

Phone

0775 111 888

For specific processing activities, our providers may act as processors, independent controllers or joint controllers depending on the service and the actual legal role of each party.

This policy applies when you visit the website, contact us, request information, become a Client, purchase a digital product, use Unified Engine, make a payment, receive an invoice or interact with measurement and advertising technologies used by Unified Systems.

As of this version, the website does not use user accounts and does not offer a separate newsletter subscription.

The website does not currently use general contact forms. Contact takes place through the channels indicated on the website and through the flows required to purchase products available online.

If we later introduce accounts, new forms, newsletters or other mechanisms that materially change processing, this policy will be updated.

We process personal data in accordance with the applicable principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

We seek to collect only information necessary for the stated purposes and not retain identifiable data longer than justified by the purpose, legal obligations or the establishment, exercise or defence of legal claims.

Depending on your interaction with Unified Systems, we may process the following categories of data:

• first and last name;
• email address;
• phone number;
• company or organisation details and professional role;
• website address supplied for analysis;
• billing and tax information;
• order, product, service or project information;
• transaction identifiers and payment status;
• content of communications with us;
• technical information about the device, browser and website interaction;
• visit source, campaign, conversion and digital event data;
• public information analysed from the website indicated by the Client where relevant to the requested product or service.

We do not intentionally request special categories of personal data for ordinary use of our services.

Data may come directly from you, from communications with Unified Systems, from the purchase and payment process, from technical data generated through use of the website, from providers involved in a transaction or from public sources analysed in connection with the website indicated by the Client.

We do not build our marketing database by purchasing contact lists.

If you provide us with personal data relating to another person, you must have the right to do so and, where required, ensure that the person has received the relevant information about the processing.

You may contact us by email, phone and WhatsApp. We process the information communicated to identify the request, respond, continue a commercial discussion, prepare an offer or administer a contractual relationship.

When you use WhatsApp, information is also processed through the infrastructure of the WhatsApp service provider under its own terms and policies.

A simple request for information does not automatically subscribe you to marketing.

For the purchase and delivery of a Unified Engine report we may request:

• first name;
• last name;
• phone number;
• email address;
• address of the website to be analysed.

The Client declares that they own the website submitted or otherwise have the necessary right or authorisation to request its analysis.

The data is used for contracting, order identification, payment, generation and delivery of the report, support, security, prevention of abuse and administration of the Client relationship.

The report and input data may be retained within the periods described in this policy for support, verification of delivery, continuity of the commercial relationship and defence of legal rights.

Unified Engine and other Unified Systems services may analyse technical, structural, commercial and publicly available information on the website indicated by the Client.

The purpose of the analysis is to provide the requested product or service, not to create an independent database about individuals appearing on that website.

If the analysis incidentally encounters personal data published on the analysed website, it will be processed only to the extent relevant and necessary to perform the analysis, subject to applicable legal obligations.

Online payments for products available directly through the website are processed through NETOPIA Payments.

The payment provider may process the information necessary to authorise, secure and administer the transaction under its own obligations and policies.

Unified Systems does not intend to store full payment card details. We may receive and retain information such as the transaction identifier, amount, currency, payment status and other information required for reconciliation, support, fraud prevention and accounting.

We use Oblio to issue and administer billing documents.

For this purpose, information such as the Client name or company name, billing address, tax details, email address, billed products or services, amounts and information required for financial and accounting documents may be transmitted.

Financial and accounting information is retained in accordance with applicable legal obligations.

Operation and security of the website may generate technical data such as IP address, request date and time, accessed URL, browser type, device, operating system, errors, technical identifiers and security information.

This information may be used for security, abuse prevention, incident diagnosis, infrastructure administration and correct operation of the service.

Unified Systems uses Unified Event Core, the first-party technical layer known as Unified Tracking, to standardise 21 canonical in-browser events concerning interaction with the website.

The 21 contracts cover page or section views, interactions with elements, visit source, campaign parameters, commercial actions, the Unified Advisor flow and technical metadata required for measurement. Advisor text, intent and WhatsApp URLs are not included in the Analytics V1 payload.

Generating a Unified event does not automatically transmit it to an external provider. The Analytics V1 architecture permits transmission to Google Analytics 4 and Microsoft Clarity only with Analytics consent, and to Meta Pixel and Meta Conversions API only with Advertising consent.

In the Analytics V1 architecture, Google Analytics 4 is the provider for measuring website usage, understanding content performance, analysing traffic sources and measuring relevant actions. The GA4 tag may load and receive events only with Analytics consent.

Google Tag Manager is the management layer for Analytics V1 tags and measurement technologies. GTM Version 2 respects the independent consent categories and does not activate non-essential tags before the corresponding consent is provided.

Depending on configuration and user choice, Google may receive technical identifiers and information about the device, browser, pages accessed, events, campaign and conversions.

The configuration uses Google Consent Mode v2 Basic: Analytics and Advertising signals are denied by default, and non-essential tags are not activated before the corresponding consent is provided.

In the Analytics V1 architecture, Microsoft Clarity is the Analytics provider used to understand website interactions and identify usability and experience issues, with the Balanced configuration.

Clarity may process navigation and interaction information such as pages viewed, clicks, scrolling, technical characteristics of the device and other information required to provide the analytics service.

Clarity is OFF by default, is not loaded without Analytics consent and receives no events when that category is refused.

Google Ads is not activated and is not part of Analytics V1. Its inclusion in a distinct version constitutes a separate change subject to technical and legal review.

Before any potential activation, the effective configuration, consent category, transmitted data and need to update this policy must be verified.

In the Analytics V1 architecture, Meta Pixel and Meta Conversions API are Advertising components used to measure campaign performance, attribute conversions, deduplicate events and optimise advertising on Meta platforms.

Meta Conversions API transmits server-side only the `Contact` event for the approved Home WhatsApp, Product WhatsApp, Project WhatsApp and Advisor handoff commercial interactions. Pixel and CAPI use the same event name and event_id for deduplication.

For Event Matching, Meta may receive event_name, event_id, event_time, the approved commercial source, the sanitised URL, the real IP address and User-Agent and, where legitimately available, the `_fbp` and `_fbc` Meta browser identifiers. Email, phone number, Advisor messages and WhatsApp content are not automatically extracted or transmitted.

Meta Pixel and Meta Conversions API are OFF by default and operate only after Advertising consent. The IP address and matching identifiers are not stored in raw form in D1 or application logs; the IP is processed transiently and is also used to generate a temporary HMAC digest for abuse prevention.

The website may use cookies, local storage, identifiers and similar technologies for operation, security, preferences, analytics and advertising.

Strictly necessary technologies may operate without consent where they are indispensable to provide the service requested by the user or for necessary technical operation.

Non-essential technologies are activated in accordance with applicable consent requirements.

A valid choice is stored for 180 days unless changed or deleted earlier. The confirmed technical inventory and the subsequent LIVE-scan validation rule are described in the Cookie Policy.

Unified Systems may send occasional commercial communications about its own products, services, features, projects or offers.

The applicable legal basis and rules depend on the relationship with the individual and the communication channel.

Messages strictly necessary to perform a contract, confirm a payment, deliver a report, invoice, provide support or respond to a request are not treated as marketing merely because they are sent by email or phone.

Where Unified Systems obtains an existing Client email address directly in connection with the sale of a product or service, that address may be used for commercial communications concerning our own similar products or services under the conditions permitted by law.

The Client will be given a clear and free opportunity to object to such use both when the address is collected and in each subsequent commercial communication.

If the Client objects to direct marketing, the data will no longer be used for that purpose.

For individuals who do not fall within the applicable existing-customer exception, email marketing is based on consent where consent is required by law.

For promotional communications by SMS or WhatsApp, if we use these channels for marketing, we will request express consent.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

As of this version, the website does not operate a separate newsletter subscription mechanism.

Contract performance or pre-contractual steps

For commercial requests, orders, Unified Engine, product delivery, support and administration of the Client relationship.

Legal obligation

For invoicing, accounting, tax matters, responses to legitimate authority requests and other obligations imposed by law.

Legitimate interests

For security, abuse prevention, defence of legal rights, administration of commercial relationships and certain communications to existing Clients within the applicable legal conditions.

Consent

For non-essential analytics or advertising technologies and commercial communications for which applicable law requires consent.

Where we rely on legitimate interests, we seek to identify a genuine legitimate interest and assess the impact on the rights and freedoms of the individual.

Where necessary, personal data may be disclosed to the following categories of recipients or providers:

• NETOPIA Payments for payment processing;
• Oblio for invoicing and financial and accounting documents;
• Google, only where Analytics consent exists, for Google Analytics 4 and Google Tag Manager; Google Ads is not activated in Analytics V1;
• Microsoft, only with Analytics consent, for Microsoft Clarity;
• Meta, only with Advertising consent, for Meta Pixel and Meta Conversions API and, when you use WhatsApp, for WhatsApp infrastructure;
• hosting, CDN, infrastructure, security, backup and technical service providers;
• email, telecommunications and messaging providers;
• legal, tax, accounting or technical advisers where necessary;
• public authorities or institutions where required by law or pursuant to a valid request.

We do not sell personal data as a commercial product.

The final hosting infrastructure for Unified Engine has not yet been selected. This policy will be reviewed and, where necessary, updated before the final infrastructure is launched.

Some global providers used by Unified Systems may process personal data in countries outside the European Economic Area.

Where an international transfer requires additional safeguards, the transfer must rely on a mechanism permitted by applicable law, such as an adequacy decision, Standard Contractual Clauses or other safeguards recognised by the GDPR.

The exact conditions may vary depending on the provider, infrastructure region and service configuration.

We do not apply an unlimited retention rule. The applicable period depends on the purpose, relationship with the individual and legal obligations.

Requests not resulting in a contract

Generally up to 3 years from the last relevant interaction unless there is a reason for earlier deletion or longer retention.

Contractual and commercial relationships

For the duration of the relationship and generally up to 3 years after it ends for relationship administration and defence of legal rights, without affecting longer statutory periods.

Unified Engine

Identification data, order information, inputs and the report may generally be retained for up to 3 years after delivery or the end of the relevant relationship.

Financial and accounting documents

Retained for the period required by applicable accounting law. As of this policy, the relevant general rule is 5 years calculated from 1 July of the year following the financial year in which the documents were prepared.

Technical and security logs

Generally up to 12 months, with a longer period possible where necessary to investigate an incident or defend legal rights.

Marketing

Until objection, withdrawal of consent or expiry of the applicable legal basis. We may retain a minimal suppression record for as long as necessary to respect the objection and prevent the person from being reintroduced into campaigns.

Evidence of consent or choices

May be retained for as long as necessary to demonstrate compliance with legal obligations, including after consent has been withdrawn.

Information may be retained longer where required by law or necessary in connection with litigation, investigation, debt or the establishment, exercise or defence of legal claims.

Unified Systems adopts technical and organisational measures proportionate to the nature of the data, systems used and identified risks.

Depending on the specific system, such measures may include access controls, authentication, separation of privileges, encryption in transit, backups, monitoring, logging, security updates and incident response procedures.

No internet-connected system can provide absolute security, but safeguards are assessed and adapted according to risk and the evolution of the infrastructure.

Some Unified Systems products may use automation, algorithms, software and artificial intelligence models for analysis, classification, generation of results or process efficiency.

As of this policy, Unified Systems does not intend to make decisions concerning data subjects based solely on automated processing that produce legal effects or similarly significantly affect them.

A Unified Engine report or recommendation is an informational or analytical output and does not itself constitute such an automated legal decision about an individual.

Subject to the conditions of the GDPR, you may have the following rights:

• right of access;
• right to rectification of inaccurate data;
• right to erasure where the statutory conditions are met;
• right to restriction of processing;
• right to data portability where applicable;
• right to object to certain processing;
• right to withdraw consent at any time for processing based on consent;
• right to lodge a complaint with the supervisory authority;
• rights applicable to decisions based solely on automated processing where relevant.

To exercise your rights, you may contact us at contact@unifiedsystems.ro.

We may request reasonable information to verify identity where necessary to avoid disclosing information to an unauthorised person.

We will respond within the timeframe established by the GDPR. The normal period is one month from receipt of the request and may be extended in the circumstances permitted by the Regulation.

If you believe the processing of your personal data infringes applicable law, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing, ANSPDCP.

We may update this policy when legislation, the website, services, providers, infrastructure, tracking technologies, Unified Engine products or commercial flows change.

The published version will indicate the date of the latest update.

Material changes will be reflected on this page and, where necessary, through other appropriate information mechanisms.

For questions concerning this Privacy Policy or our processing of personal data:

Trading name

Unified Systems

Controller

S.C. Eight Sigma S.R.L.

Registered office

Bucharest, Sector 1, Sos. Gh. I. Sisesti, no. 303-309, Romania

Tax identification number

51250206

Trade Registry number

J2025008601008

Email

contact@unifiedsystems.ro

Phone

0775 111 888