Privacy Policy & Data Processing Standards

1. Who We Are & Controller Designation

This Privacy Policy explains how CoreZRO (referred to as "CoreZRO", "we", "us", or the "Controller") processes personal data related to visitors of www.corezro.com, corporate partner representatives, and B2B professionals identified during market research and prospecting campaigns.

Under the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR):

• CoreZRO acts as a Data Controller regarding data of website visitors and individuals who submit online inquiries (including general contact forms and the "5 Free Qualified Leads" assessment), as well as professional business contact details validated from public sources for B2B commercial outreach.
• CoreZRO acts as a Data Processor when configuring, migrating data for, or supporting Odoo ERP instances for our Clients, where the Client remains the sole Data Controller of records stored within their ERP database.

Our dedicated data privacy channel is: gdpr@corezro.com.

2. Personal Data We Collect & How We Obtain It

CoreZRO processes strictly the minimum information necessary to execute our commercial advisory and technical services:

2.1. Data Provided Directly by You

• Full Name;
• Corporate / Business Email;
• Business Phone Number (International format);
• Company Name and Website;
• Project Requirements and notes provided in inquiry fields.

2.2. Professional B2B Data Processed for Lead Generation

In executing outbound prospect identification and market research for our corporate partners, we process exclusively public professional business information:

• Full Name;
• Job Title and Professional Function (e.g., Chief Executive Officer, VP of Business Development, Head of Operations, CTO);
• Corporate Employer Name, Headquarters Address, and Tax ID;
• Official Corporate Email Address (e.g., name@company.com);
• Corporate Office Phone / Switchboard Number;
• Public Professional Profile URL (e.g., LinkedIn).

Sources of this data include official corporate registries, official company websites, business directories, and public professional networks. We strictly filter out and reject personal consumer email addresses (@gmail.com, @yahoo.com) and private personal phone numbers.

2.3. Technical Navigation & Server Data

When navigating www.corezro.com, our hosting infrastructure automatically collects standard technical data: truncated/pseudonymized IP address, browser type and version, operating system, and request timestamps. In addition, we store your language preference (preferred-locale) in local storage to maintain your chosen language (English or Romanian).

3. Legal Bases for Processing Under the GDPR

• Contractual Performance & Pre-contractual Steps (Art. 6(1)(b) GDPR): Responding to intake requests, delivering the 5 free qualified leads trial, executing commercial advisory agreements, and deploying Odoo ERP modules.
• Legitimate Interest (Art. 6(1)(f) GDPR): Conducting relevant B2B direct commercial outreach to corporate decision-makers, analyzing industry competitive landscapes, and maintaining platform cybersecurity.
• Legal Compliance (Art. 6(1)(c) GDPR): Fulfilling mandatory statutory fiscal obligations, invoice issuance, and archiving accounting records under applicable Romanian and EU laws.
• Explicit Consent (Art. 6(1)(a) GDPR): Where required by specific electronic communication regulations (e.g., non-essential cookies or voluntary marketing opt-ins).

4. B2B Lead Generation & Legitimate Interest Assessment

Recital 47 of the GDPR expressly affirms that "the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."

CoreZRO has conducted a three-part Legitimate Interest Assessment (LIA) for its B2B outreach services:

• Purpose Test: Introducing relevant B2B commercial systems and operational tools to enterprises that can demonstrably benefit from them.
• Necessity Test: Direct communication to business decision-makers using their professional corporate contact details represents the most proportionate and direct commercial method available.
• Balancing Test: Because communications are strictly confined to the recipient's corporate domain and role, have no bearing on their private personal life, and are accompanied by an immediate opt-out mechanism, the individual’s fundamental privacy rights do not override our legitimate commercial interest.

5. Right to Object & Permanent Suppression Lists

How to exercise your opt-out right:

1. Direct Reply: Reply to any email or message from CoreZRO with "Unsubscribe", "Stop", or "Not interested".
2. Dedicated Email: Send a brief request directly to gdpr@corezro.com specifying your email address.

Upon receipt of an objection, the affected email address is immediately placed on a secure, permanent Suppression List to guarantee that our data pipelines will permanently exclude this address from all future outreach campaigns.

6. Odoo ERP Engagements & Data Processor Role (DPA)

When delivering ERP Implementation with Odoo:

• The Client is the Data Controller, retaining full ownership and governance over their ERP records.
• CoreZRO acts strictly as a Data Processor under Article 28 of the GDPR, processing records solely pursuant to the Client’s documented instructions.
• We execute a binding Data Processing Agreement (DPA) specifying that access is restricted to vetted technical consultants, all migration staging takes place on encrypted environments, and temporary migration dumps are securely deleted within 30 days of Go-Live.

7. Data Recipients & Sub-Processors

CoreZRO does not sell or barter data with external commercial brokers. We share data only with trusted technical sub-processors under strict confidentiality and security terms:

• Cloud infrastructure and content delivery (Cloudflare, EU cloud server facilities);
• Workflow automation (private instance of n8n hosted on secure dedicated server environments);
• Enterprise communication (WhatsApp Business API for requested dialogues, and secure email server infrastructure);
• Professional advisors (licensed accounting firms, legal counsel) under professional secrecy duties;
• Public authorities, solely when compelled by valid legal mandate.

8. Cross-Border Data Transfers

Primary data processing and database hosting are situated within Romania and the European Economic Area (EEA). Where specific software integrations involve service providers located in third countries, transfers are governed by appropriate safeguards recognized by the European Commission, including the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs).

9. Data Retention & Erasure Schedules

• Form Inquiries & Proposals: Maintained for the duration of negotiations and up to 3 years from the last active interaction if no contract is signed.
• Client Contractual & Accounting Records: Retained for 5 to 10 years in compliance with Romanian fiscal statutes and commercial code requirements.
• B2B Prospecting Leads: Maintained for the duration of the campaign cycle or until an objection (opt-out) is registered.
• Suppression Lists: Maintained indefinitely to honor your opt-out preference across all future systems.

10. Your Rights as a Data Subject

Under Articles 15 through 22 of the GDPR, you enjoy the following rights:

• Right of Access (Art. 15): Request confirmation of whether we process your data and receive a copy;
• Right to Rectification (Art. 16): Correct inaccurate or out-of-date records;
• Right to Erasure ("Right to be Forgotten" - Art. 17): Request deletion of data that is no longer required;
• Right to Restriction of Processing (Art. 18): Temporarily halt active processing while an accuracy dispute is investigated;
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used format;
• Right to Object (Art. 21): Object to any processing based on legitimate interest or direct marketing;
• Right to Lodge a Complaint: Contact the supervisory authority:
  National Supervisory Authority for Personal Data Processing (ANSPDCP - Romania)
  28-30 G-ral Gheorghe Magheru Blvd., District 1, Bucharest, Romania
  Website: www.dataprotection.ro

To exercise any of these rights, email gdpr@corezro.com. We resolve all legitimate requests within 30 calendar days at zero cost to you.

11. Cookie & Local Storage Policy

The www.corezro.com website employs a minimal, privacy-centric approach to browser storage:

• Strictly necessary cookies for security and content delivery (Cloudflare);
• Functional language storage (preferred-locale) exclusively to preserve your chosen language (English vs. Romanian);
• No third-party cross-site profiling or tracking cookies.

12. Technical & Organizational Security Measures

CoreZRO protects client and prospect data through enterprise-grade security protocols:

• Transport Layer Security (TLS 1.3 / HTTPS encryption) across all web traffic and API endpoints;
• Role-based access control and two-factor authentication (2FA) for internal environments;
• Dedicated database isolation for ERP client production data;
• Automated, encrypted backups to prevent accidental data loss.

13. Contact Our Data Protection Office

For inquiries regarding our data protection standards, data deletion requests, or DPA agreements:

CoreZRO Data Protection Office
Email GDPR: gdpr@corezro.com
Email general: contact@corezro.com
Phone / WhatsApp: +40 750 207 273
Website: www.corezro.com
Data Protection Officers: Cotia Cosmin & Ovidiu Tulbure · Romania