Data Processing Terms
Last updated: 16 September 2026 · version 2026-09-16
These terms are the data processing agreement required by Article 28 GDPR. They apply whenever your website collects personal data from its visitors — a contact-form enquiry, a booking request, a newsletter sign-up. For that data you are the controller and ZOOMERS NETWORK LGTM S.R.L., J2025023161006, CUI 51548084, cod TVA 53833427, Șoseaua Bucium 55K, Bl. C3, Sc. 3, Et. 7, Ap. 7, Iași, Jud. Iași, România (“Vetrosoft”, “we”) is your processor. They form part of our Terms of Service and override them on anything to do with personal data.
1. What we process for you
- Subject matter and purpose: hosting and operating your website, and delivering to you the messages your visitors send through it.
- Duration: as long as we host your site, plus the deletion period in section 9.
- Categories of data subject: visitors to your website — your customers, prospective customers, and anyone else who contacts you through it.
- Types of personal data: whatever the visitor submits, typically name, email address, phone number and the content of their message. Our analytics are cookieless and record no IP address or personal identifier.
- Special categories: we neither ask for nor want special-category data (health, beliefs and the like). Tell us first if you plan to collect any through your site.
2. Your instructions
We process your visitors’ personal data only on your documented instructions — these terms, your settings in the platform, and the change requests you send us — and for no other purpose. We never sell it, and we do not use it to train AI models. If an instruction appears to us to break data-protection law, we will say so and may pause that instruction.
3. Confidentiality
Everyone at Vetrosoft who can reach your visitors’ data is bound to confidentiality and gets only the access their work requires.
4. Security
- Data travels over TLS; site content and uploads live in access-controlled Cloudflare R2 buckets.
- The consent audit log is kept in a private bucket with no public access.
- Server and database access uses individual credentials, and the platform’s admin areas sit behind authentication.
- We keep our servers’ operating systems and dependencies patched.
- We collect as little as possible: no visitor IP addresses, no tracking cookies, no advertising profiles.
5. Sub-processors
You authorise the sub-processors below. We remain responsible to you for what they do with your visitors’ data.
- Cloudflare — CDN delivery of your site and R2 object storage for its content and uploads.
- Contabo (Germany) — the servers your website and our platform run on.
- Brevo, with Resend as failover — email delivery of the enquiries your visitors send you.
- GitHub — version control for hand-built sites, including images supplied for them.
- MiniMax — the AI model that drafts site content from your business details. Visitor enquiries are not sent to it.
- Stripe — billing for your own subscription. That is your data, not your visitors’.
If we add or replace a sub-processor, we tell you at least 14 days beforehand at your account email. Object on reasonable data-protection grounds within those 14 days and you may end the affected service without penalty for the rest of the paid period.
6. Helping you meet your obligations
- Visitor requests: if a visitor asks for access to, correction of, a copy of or deletion of their data, tell us and we will find, export or erase it. We do not answer your visitors directly; we point them back to you.
- Security, breaches and impact assessments: we assist you with Articles 32 to 36 as far as the information is ours to give.
7. Personal data breaches
If we become aware of a personal data breach affecting your visitors’ data, we notify you without undue delay and within 48 hours of becoming aware, at your account email. We tell you what happened, which data and roughly how many people are affected, what we are doing about it, and whom to contact. Reporting to your supervisory authority is your decision as controller; we give you what you need to make it.
8. Audits and information
On request we give you the information needed to demonstrate compliance with Article 28. You may audit us once a year, and after a breach affecting you, with 30 days’ notice, in business hours, without disturbing other customers, at your cost. Where a written questionnaire or our documentation answers the question, that can satisfy the request.
9. Return and deletion
When your service ends you choose: we return the personal data we hold for you, or we delete it. Unless you ask for return, we delete it within 30 days of termination, copies in our systems included. We keep only what the law requires — invoices and tax records, and the consent audit trail as proof of agreement.
10. International transfers
Your visitors’ data is stored in the EU/EEA. Where a sub-processor processes it outside the EEA, that transfer runs on the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.
11. Precedence and changes
These terms override our Terms of Service on personal data. We update them when our processing changes; material changes reach you by email at least 14 days beforehand. Every version is dated, and the version in force when you activated your subscription is stored with your consent record.