1. Introduction & Scope
This Privacy Policy describes how Atek Software, a company established in Iași, Romania ("Atek Software," "we," "us," or "our"), collects, uses, stores, and protects personal data in connection with its services.
Atek Software is the legal entity that owns and operates the Aflux web application, available at aflux.io (the "Platform").
This Privacy Policy applies to the processing of personal data in relation to:
- The aflux.io website
- The Aflux web application and related software
- Application programming interfaces (APIs)
- All platform modules, including Bulk Email, Electronic Signature, QR Code Generation, and the core user and file management services
This Privacy Policy applies to the following categories of individuals:
- Account holders, including individual users and organizational customers
- End users operating under an account, such as administrators, users, and guests
- Third parties whose personal data may be processed through the Platform, including email recipients, document signatories, and individuals accessing content via QR codes, where applicable
This Privacy Policy should be read together with, and is incorporated by reference into, the Aflux Terms of Service, which govern the contractual relationship between users and Atek Software in connection with the Platform.
2. Who Is the Data Controller
For the purposes of applicable data protection laws, including Regulation (EU) 2016/679 (the General Data Protection Regulation – GDPR), the roles of the parties with respect to the processing of personal data are as follows.
Atek Software, as the legal entity operating the Aflux platform, acts as a data controller with respect to personal data processed for its own purposes, including:
- Account data, such as user registration details, authentication information, and account management data
- Website visitor data, including information collected through the aflux.io website and related analytics or technical logs
- Billing and marketing data, including subscription information, invoicing details, payment-related records, and marketing communications
In addition, Atek Software acts as a data processor on behalf of its customers with respect to personal data processed through the Aflux platform in the course of providing the Services, including:
- User Content, such as documents, files, and data uploaded or generated by users
- End-user data, including personal data relating to administrators, users, guests, email recipients, signatories, or other individuals whose data is processed at the direction of customers
In such cases, customers using the Aflux platform act as the data controllers, and Atek Software processes personal data solely on their behalf and in accordance with their instructions.
Atek Software makes a Data Processing Agreement (DPA) available to customers, which sets out the parties' respective obligations regarding the processing of personal data in accordance with GDPR and other applicable data protection laws.
3. Categories of Personal Data Collected
This section describes the categories of personal data that may be collected and processed through the Aflux platform, depending on how the Services are used.
3.1 Account & Identity Data
Atek Software may collect and process the following categories of personal data related to account creation, authentication, and account management:
- Identification and contact information, such as first and last name, email address, company or organization name, and assigned role (e.g. administrator, user, guest)
- Account credentials and authentication data, including securely hashed passwords, authentication tokens, session identifiers, and similar security-related information
Authentication data is processed solely for the purpose of securing access to the Platform and is stored using appropriate technical and organizational security measures.
3.2 Usage & Technical Data
Atek Software may collect and process certain technical and usage-related data when users access or use the Aflux platform, including:
- Network and device information, such as IP address, device type, operating system, browser type, and language settings
- Usage logs and technical metadata, including access logs, timestamps, feature usage, actions performed within the Platform, and error or diagnostic information
- Tenant, workspace, or account identifiers, used to associate activity and data with the appropriate organization, account, or workspace within the Platform
This data is processed for purposes such as operating and securing the Services, monitoring performance, preventing fraud or abuse, and improving functionality and reliability.
3.3 Content-Related Personal Data (Processor Role)
When customers use the Aflux platform to upload, manage, or process content, Atek Software may process personal data contained within such content on behalf of the customer and in its role as a data processor.
This may include, depending on the customer's use of the Services:
- Documents and files uploaded to the Platform, which may contain personal data relating to identified or identifiable individuals
- Signatory information, such as names, email addresses, signature metadata, and timestamps associated with electronic signature workflows
- Email recipient data, including names, email addresses, and related metadata used in connection with the Bulk Email module
- QR-linked data, including personal data accessible through QR codes generated by users, such as document metadata or access logs
Such personal data is processed solely in accordance with the customer's instructions and for the purpose of providing the Services, as further described in the applicable Data Processing Agreement.
3.4 Billing & Payment Data
Atek Software may collect and process personal data related to billing and payment for paid subscription plans, including:
- Invoicing and billing information, such as billing name, billing address, email address, and invoice history
- Subscription details, including selected plan, subscription status, pricing, and applicable VAT identification number
Payment processing is handled by authorized third-party payment service providers. Atek Software does not store or process raw payment card details, such as full credit card numbers or security codes. Such information is collected and processed directly by the payment provider in accordance with their own privacy and security practices.
3.5 Marketing & Communication Data
Atek Software may collect and process personal data related to marketing and communications, including:
- Marketing preferences and newsletter opt-ins, such as consent to receive product updates, announcements, or promotional communications
- Support and customer communications, including information provided when contacting support, submitting requests, or otherwise communicating with Atek Software
Such data is processed for the purposes of responding to inquiries, providing customer support, managing relationships with users, and, where permitted by applicable law, sending marketing communications. Users may withdraw their consent to receive marketing communications at any time in accordance with the opt-out mechanisms provided.
4. How Personal Data Is Collected
Atek Software collects personal data through various means in connection with the operation of the Aflux platform, including the following:
- Directly from users, when they create an account, subscribe to a plan, configure settings, upload content, communicate with support, or otherwise provide information through the Platform
- Automatically through the use of the Services, including through technical means such as logs, cookies, and similar technologies that collect usage, device, and activity information when users access or interact with the Platform
- Via third-party integrations, when users choose to connect external services or storage providers (such as Google Drive or similar platforms), in which case personal data may be accessed or received in accordance with the user's authorization and the applicable third-party terms
- From customers on behalf of their end users, where customers upload or process personal data relating to their administrators, users, guests, email recipients, signatories, or other individuals through the Services, and Atek Software processes such data as a data processor acting on the customer's instructions
This data is collected solely for the purposes described in this Privacy Policy and in accordance with applicable data protection laws.
5. Purposes of Processing
Atek Software processes personal data collected through the Aflux platform for the following purposes, depending on the nature of the data and how the Services are used:
- Provide and operate the Services, including enabling access to the Platform, delivering its modules and core functionality, managing accounts and workspaces, and ensuring the proper performance of the Services
- User authentication and security, including verifying user identities, managing access controls, preventing unauthorized access, detecting and preventing fraud or abuse, and maintaining the security and integrity of the Platform
- Document signing and audit trails, including facilitating electronic signature workflows, recording signature events, timestamps, and related metadata, and maintaining audit logs associated with signed documents
- Email sending and tracking, including managing email campaigns, delivering messages, handling bounces or unsubscribes, and providing basic delivery or engagement metrics where applicable
- QR code access control, including managing access to QR-linked content, enforcing permissions, tracking access events, and administering lifecycle rules for QR codes
- Billing and subscription management, including processing subscriptions, issuing invoices, managing payments, handling taxes, and maintaining financial records
- Customer support, including responding to inquiries, troubleshooting issues, providing assistance, and communicating with users regarding their accounts or use of the Services
- Legal compliance, including complying with applicable laws and regulations, responding to lawful requests from public authorities, and enforcing or defending legal rights
- Product improvement, including analyzing usage trends and performance metrics using aggregated or anonymized data to improve functionality, reliability, and user experience, without identifying individual users
Personal data is processed only for the purposes described above and in accordance with applicable data protection laws.
6. Legal Bases for Processing (GDPR)
Atek Software processes personal data in accordance with the legal bases set out in Article 6 of the General Data Protection Regulation (GDPR). Depending on the context and purpose of processing, one or more of the following legal bases apply:
- Performance of a contract: Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract. This includes providing access to the Aflux platform, operating its modules, managing accounts, and delivering the Services as agreed.
- Legitimate interests: Processing is necessary for the purposes of Atek Software's legitimate interests, such as ensuring the security and integrity of the Platform, preventing fraud and abuse, maintaining service availability, and improving the Services, provided that such interests are not overridden by the rights and freedoms of data subjects.
- Legal obligations: Processing is necessary to comply with legal obligations to which Atek Software is subject, including accounting, tax, regulatory, and recordkeeping requirements, as well as responding to lawful requests from public authorities.
- Consent: Where required by applicable law, Atek Software processes personal data based on the data subject's consent, including for marketing communications, the use of non-essential cookies, or similar technologies. Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.
- Customer instructions (processor role): Where Atek Software acts as a data processor, personal data is processed on the basis of the customer's instructions and for the purpose of performing the Services under the applicable contract or Data Processing Agreement.
Personal data is processed only where a valid legal basis applies and in compliance with GDPR and other applicable data protection laws.
7. How Data Is Shared
Atek Software may share personal data with third parties only to the extent necessary to operate the Aflux platform, provide the Services, and comply with legal obligations. Personal data is not sold to third parties.
Personal data may be shared in the following circumstances:
- Sub-processors: Atek Software may engage trusted third-party service providers (sub-processors) to support the operation of the Services, such as cloud hosting providers, email delivery services, payment processors, analytics providers, or customer support tools. These sub-processors process personal data solely on Atek Software's behalf and in accordance with contractual obligations that ensure appropriate data protection and confidentiality.
- External storage providers (at user request): Where users choose to connect External Storage services (such as Google Drive or similar providers), personal data may be shared with or accessed from such providers in accordance with the user's authorization and the applicable third-party terms. Atek Software shares data with External Storage providers only as instructed by the user.
- Legal authorities and compliance: Personal data may be disclosed to public authorities, regulators, courts, or law enforcement agencies where required to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
- No selling of personal data: Atek Software does not sell, rent, or trade personal data to third parties for marketing or other commercial purposes.
All data sharing is carried out in accordance with applicable data protection laws and subject to appropriate safeguards.
8. International Data Transfers
Personal data processed through the Aflux platform is primarily hosted and processed within the European Union (EU) and the European Economic Area (EEA).
In cases where personal data is transferred or accessed outside the EU/EEA, Atek Software ensures that such transfers are carried out in compliance with applicable data protection laws and are subject to appropriate safeguards. These safeguards may include:
- Standard Contractual Clauses (SCCs) approved by the European Commission, entered into with the relevant service providers or sub-processors
- Adequacy decisions issued by the European Commission, where the destination country has been recognized as providing an adequate level of data protection
Atek Software maintains transparency regarding the use of cloud and infrastructure providers and ensures that any international data transfers are limited to what is necessary for the provision of the Services and protected by appropriate legal and technical measures.
9. Data Retention
Atek Software retains personal data only for as long as necessary to fulfill the purposes for which it was collected, to provide the Services, and to comply with applicable legal obligations.
- Account data retention: Personal data related to user accounts (such as registration details and account settings) is retained for the duration of the active account and for a limited period thereafter, as necessary to comply with legal, accounting, or security requirements.
- Content retention (customer-controlled): User Content and any personal data contained therein are retained in accordance with the customer's configuration and instructions. Customers may delete their Content at any time during the term of the Agreement, subject to applicable retention requirements.
- Logs and backups: Technical logs, audit trails, and backup data are retained for limited periods to ensure security, troubleshooting, and disaster recovery. Backup data may persist for a defined retention cycle before being automatically overwritten or deleted.
- Post-termination deletion timelines: Upon termination or expiration of the Agreement, Atek Software will delete or anonymize personal data and User Content within a reasonable timeframe, unless retention is required by law or otherwise agreed in writing. Users are responsible for exporting their data prior to termination.
- Enterprise exceptions: Enterprise customers may agree to custom data retention and deletion terms under an applicable Enterprise Agreement or Data Processing Agreement, which shall prevail in case of conflict with this section.
Data retention practices are reviewed periodically to ensure compliance with applicable data protection laws.
10. Data Security Measures
Atek Software implements appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
These measures include, at a high level:
- Encryption in transit and at rest: Personal data is protected using industry-standard encryption mechanisms when transmitted over networks and when stored, where appropriate.
- Access control and role separation: Access to personal data is restricted to authorized personnel and systems based on the principle of least privilege. Role-based access controls are used to ensure that users and internal staff can access only the data necessary for their respective functions.
- Audit logging and monitoring: The Platform maintains logs and monitoring mechanisms to track access, changes, and significant actions within the system, supporting security monitoring, troubleshooting, and compliance efforts.
- Incident response procedures: Atek Software maintains procedures for identifying, responding to, and mitigating security incidents. Where required by applicable law, affected parties and authorities will be notified of personal data breaches in a timely manner.
While Atek Software takes reasonable steps to safeguard personal data, no system can be guaranteed to be completely secure, and users are encouraged to take appropriate measures to protect their accounts and information.
11. Data Subject Rights (GDPR)
Under the General Data Protection Regulation (GDPR), individuals whose personal data is processed by Atek Software have certain rights regarding their personal data. Subject to applicable legal conditions and limitations, these rights include:
- Right of access: The right to obtain confirmation as to whether personal data is being processed and, where that is the case, to access such personal data and receive information about the processing.
- Right to rectification: The right to request the correction of inaccurate or incomplete personal data.
- Right to erasure (right to be forgotten): The right to request the deletion of personal data where permitted by law, such as when the data is no longer necessary for the purposes for which it was collected.
- Right to restriction of processing: The right to request that the processing of personal data be limited under certain circumstances, for example while a request for rectification or objection is being assessed.
- Right to data portability: The right to receive personal data provided to Atek Software in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where applicable.
- Right to object: The right to object to the processing of personal data based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: Where processing is based on consent, the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent prior to its withdrawal.
- Right to lodge a complaint with a supervisory authority: The right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU Member State of habitual residence, place of work, or place of the alleged infringement.
To exercise any of these rights, data subjects may contact Atek Software using the contact details provided in this Privacy Policy. Requests will be handled in accordance with applicable data protection laws and within the timeframes prescribed by GDPR.
12. Cookies & Tracking
The Aflux website and platform use cookies and similar tracking technologies to ensure proper functionality, improve performance, and, where applicable, support analytics and marketing activities.
- Essential cookies: Essential cookies are necessary for the operation of the website and the Platform, including enabling core functionality such as authentication, session management, security, and user preferences. These cookies do not require user consent.
- Analytics cookies: Atek Software may use analytics cookies to collect aggregated and anonymized information about how users interact with the website or Platform, such as page visits and usage patterns, in order to improve performance and user experience. Analytics cookies are used only where permitted by applicable law and, where required, subject to user consent.
- Marketing cookies: Marketing or advertising cookies may be used to deliver relevant information or promotions, subject to applicable legal requirements. Where used, such cookies are deployed only with the user's consent and may be disabled at any time.
- Cookie Policy: Detailed information about the types of cookies used, their purposes, and retention periods is provided in a separate Cookie Policy, which is made available through the website.
- Consent mechanism: Where required by law, Atek Software provides a cookie consent mechanism that allows users to accept, reject, or manage non-essential cookies. Users may change their cookie preferences at any time through the available settings.
13. Children's Data
The Aflux platform and Services are not intended for use by children under the age of 16.
Atek Software does not knowingly collect or process personal data relating to children under 16. If we become aware that personal data of a child under 16 has been collected without appropriate legal basis or parental consent, we will take reasonable steps to delete such data promptly.
If you believe that a child under 16 has provided personal data through the Services, please contact Atek Software using the contact details provided in this Privacy Policy.
14. Third-Party Links & Integrations
The Aflux platform may contain links to third-party websites, services, or integrations, or allow users to connect external services such as cloud storage providers or other third-party applications.
These third-party services are operated independently from Atek Software and are governed by their own privacy policies and terms of use. This Privacy Policy does not apply to the processing of personal data by third-party services, and Atek Software does not control or assume responsibility for their content, privacy practices, or data handling activities.
Users are responsible for reviewing and complying with the privacy policies and terms applicable to any third-party services they choose to access or integrate with through the Platform.
15. Changes to the Privacy Policy
Atek Software may update or modify this Privacy Policy from time to time to reflect changes in the Platform, applicable laws, or data processing practices.
When changes are made, the updated Privacy Policy will be published on the Aflux website and the effective date will be revised accordingly. Where the changes are material, Atek Software may provide additional notice through the Platform or by other reasonable means.
Your continued access to or use of the Platform after the effective date of an updated Privacy Policy constitutes your acceptance of the revised terms. If you do not agree with the changes, you should discontinue use of the Services.
16. Contact & Data Protection Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of personal data, you may contact Aflux using the contact information provided in this policy.
Atek Software is established in Romania and is subject to the supervision of the competent data protection authority within the European Union. The relevant supervisory authority is:
Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) Website: https://www.dataprotection.ro
Data subjects may also contact their local EU supervisory authority where applicable.