Privacy policy

Operated by SELFSOFT TECH SRL,
Registered Address: Str. Matei Millo, Nr. 126, IF, Voluntari, ROMANIA
Registration Number (CUI): RO23359004,
Contact Email for Privacy Matters: office@ethiclink.eu

At Ethic Link, we are committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, store, process, and protect your personal data, including sensitive whistleblower data, in full compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and relevant Romanian legislation, particularly Law No. 361/2022 on the protection of whistleblowers in the public interest.

By using the Ethic Link web application (the "Service"), you agree to the collection and use of information in accordance with this policy.

1. Definitions

For the purposes of this Privacy Policy.

• Personal Data: Any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Sensitive Data (Special Categories of Personal Data): Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. Whistleblowing reports may inherently contain sensitive data depending on the nature of the reported misconduct.
• Processing: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of Ethic Link, the subscribing organization (your employer or the organization you are reporting about) is the primary Data Controller for the content of the Whistleblowing Reports. Ethic Link (SELFSOFT TECH SRL) acts primarily as a Data Processor on behalf of the subscribing organization regarding the whistleblower data itself, and as a Data Controller for certain operational data related to your use of our platform (e.g., account details, billing).
• Processor: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
• Data Subject: The individual whose personal data is being processed (e.g., users of Ethic Link, whistleblowers, people implicated in a report).
• Service: The Ethic Link web application.
• Whistleblower: An individual who reports breaches of Union law or national law, as defined by Law No. 361/2022.

2. Principles of Data Processing (GDPR Article 5)

We adhere to the following GDPR principles when processing personal data:

• Lawfulness, fairness, and transparency: Data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.
• Purpose limitation: Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
• Data minimization: Data collected is adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
• Accuracy: Data is accurate and, where necessary, kept up to date. Every reasonable step is taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
• Storage limitation: Data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
• Integrity and confidentiality (security): Data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures.

3. Types of Data We Collect and Why

We collect and process different types of personal data for various purposes related to providing and improving our Service.

A. Data Collected for Account Management and Service Provision (Where Ethic Link is the Controller)

This data is processed for the purpose of managing your subscription, providing access to the Service, and ensuring its technical functionality.

Types of Data:

• Contact Information: Name, email address, company name (for organizational accounts), phone number..
• Account Details: Username, password (hashed), subscription plan details, trial status.
• Billing Information: For paid subscriptions us use stripe (stripe.com) as a payment processor. We do not store credit card details on our servers.
• Usage Data: Information on how the Service is accessed and used (IP address, browser type, operating system, pages visited, time spent on pages, reporting activity within the platform, error logs). This helps us improve the Service and troubleshoot issues.
• Communication Data: Records of communications with our support team (via email).

Purpose of Processing:

• To provide and maintain the Service.
• To manage your account and subscription, including free trial activation and transition to paid plans.
• To process payments and issue invoices (including 19% Romanian VAT).
• To communicate with you regarding your account, updates, and Service-related information.
• To provide email support.
• To monitor the usage of the Service and improve its functionality and user experience.
• To detect, prevent, and address technical issues or fraudulent activities.

Legal Basis for Processing:

• Performance of a Contract: Processing is necessary for the performance of the subscription contract with you (GDPR Article 6(1)(b)).
• Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject (e.g., tax and accounting obligations in Romania related to billing, GDPR compliance) (GDPR Article 6(1)(c)).
• Legitimate Interests: To improve our Service, ensure network and information security, and prevent fraud (GDPR Article 6(1)(f)). We ensure these interests do not override your fundamental rights and freedoms.

B. Data within Whistleblowing Reports (Where the Subscribing Organization is the Controller, and Ethic Link is the Processor)

Legal Basis for Processing:

When you submit a whistleblower report through Ethic Link, the content of that report, including any personal data it contains, is processed by us on behalf of the subscribing organization. The subscribing organization is the Data Controller for this data, determining the purposes and means of processing these reports. We act strictly as a Data Processor under a data processing agreement with the subscribing organization.

Types of Data (may include, but are not limited to):

• Information about the Whistleblower: Name, contact details, role, relationship to the organization (if provided and not submitted anonymously).
• Information about the Person(s) Implicated: Name, role, department, potentially sensitive data if relevant to the reported misconduct (e.g., health information, trade union membership, or criminal allegations, if they are directly related to the reported breach of law).
• Details of the Alleged Breach: Description of the facts, dates, locations, types of misconduct (e.g., financial fraud, harassment, data privacy violations, health and safety concerns).
• Supporting Evidence: Documents, images, or other files uploaded by the whistleblower, which may contain personal data.
• Communication within the platform: Anonymous or identified communication between the whistleblower and the organization's designated personnel.

Purpose of Processing (on behalf of the Controller):

• To securely receive, store, and transmit Whistleblowing Reports to the designated personnel within the subscribing organization.
• To facilitate secure communication between the whistleblower and the designated personnel.
• To provide the subscribing organization with tools to manage and track the investigation process of the reports.

Legal Basis for Processing (for Ethic Link as a Processor):

• Contractual Obligation: Our processing of this data is governed by the Data Processing Agreement (DPA) between Ethic Link and the subscribing organization. The legal basis for processing by the subscribing organization (Controller) will typically be their legal obligation under Law No. 361/2022 and EU Directive 2019/1937, or their legitimate interest in maintaining ethical conduct and preventing breaches.
• Law No. 361/2022, on the protection of whistleblowers in the public interest: This law mandates the establishment of secure reporting channels and the processing of personal data for the purpose of investigating breaches of law.

4. Anonymity and Confidentiality

• Confidentiality: We are committed to maintaining the confidentiality of the identity of whistleblowers and the information contained in the reports. Access to whistleblower reports is strictly limited to authorized personnel within the subscribing organization and our technical support team only when necessary for maintenance or troubleshooting, under strict confidentiality agreements.
• Anonymous Reporting: Ethic Link provides features designed to allow for anonymous reporting. While we implement technical and organizational measures to support anonymity, users should be aware that absolute anonymity in online environments can be challenging to guarantee. Whistleblowers who choose to remain anonymous should avoid including information within their report that could directly or indirectly identify them.
• Disclosure of Identity (as per Romanian Law No. 361/2022): The identity of a whistleblower (if not anonymous) will only be disclosed in the following circumstances:
  • With the explicit consent of the whistleblower.
  • When there is an obligation imposed by law (e.g., a court order or request from a competent authority).
  • If the whistleblower has intentionally revealed their identity in the context of a public disclosure.

5. How We Store and Protect Your Data

• Data Storage Location: All data processed by Ethic Link is stored on secure servers located within the European Union (EU). This ensures compliance with GDPR requirements for data residency.
• Security Measures: We implement robust technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, and destruction. These measures include:
  • Encryption: Data is encrypted both in transit (using TLS/SSL) and at rest (using industry-standard encryption protocols).
  • Access Control: Strict access controls and authentication mechanisms are in place to limit access to personal data only to authorized personnel who have a legitimate need to access it.
  • Regular Security Audits: We conduct regular security audits and vulnerability assessments to identify and address potential weaknesses.
  • Employee Training: Our employees receive regular training on data protection, security best practices, and confidentiality obligations.
  • Backup and Recovery: We maintain secure backup and disaster recovery procedures to ensure data availability and integrity.
  • Physical Security: Our data centers are protected by comprehensive physical security measures.
• Data Retention:
  • Account and Operational Data: We retain your account and operational data for as long as your subscription is active and for a limited period thereafter as required for legal, accounting, and legitimate business purposes (e.g., to resolve disputes, enforce agreements).

6. Sharing Your Personal Data

We will not sell or rent your personal data to third parties. We may share your personal data only in the following circumstances and for the stated purposes:

• With the Subscribing Organization: As a Data Processor, we share the content of Whistleblowing Reports with the designated personnel of the subscribing organization (the Controller) for the purpose of investigating and addressing the reported breaches.
• With Service Providers (Processors): We engage trusted third-party service providers (e.g., cloud hosting providers, payment processors) to assist us in operating the Service. These service providers act as Data Processors on our behalf and are contractually bound to process data only according to our instructions and in compliance with GDPR. We ensure they meet high standards of data protection and security.
• Legal Requirements: We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court order, a request from a competent Romanian authority like the National Supervisory Authority for Personal Data Processing - ANSPDCP).
• Business Transfers: In the event of a merger, acquisition, or asset sale, your personal data may be transferred as part of the transaction. We will provide notice before your personal data is transferred and becomes subject to a different Privacy Policy.

7. Your Data Protection Rights (GDPR Rights)

Under GDPR, you have the following rights concerning your personal data. Please note that for data within Whistleblowing Reports, your rights may need to be exercised directly with the subscribing organization (the Data Controller), as they are primarily responsible for that data.

• The Right to Be Informed: You have the right to be informed about the collection and use of your personal data. This Privacy Policy serves to fulfill this right.
• The Right to Access: You have the right to request copies of your personal data that we hold.
• The Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• The Right to Erasure ("Right to Be Forgotten"): You have the right to request that we erase your personal data, under certain conditions.
• The Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The Right to Object to Processing: You have the right to object to our processing of your personal data, under certain conditions.
• The Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• Rights in relation to automated decision-making and profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not use automated decision-making or profiling that would have such effects.

To exercise any of these rights regarding the data for which Ethic Link is the Controller, please contact us at office@ethiclink.eu. We will respond to your request without undue delay and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests.

8. Cookies and Tracking Technologies

Ethic Link uses "cookies" and similar tracking technologies to track activity on our Service and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Other tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyze our Service.

We use cookies for purposes such as:

• Authenticating users
• Remembering user preferences
• Analyzing Service usage and performance
• Security purposes

Specifics regarding Google Analytics:

We use Google Analytics, a web analytics service provided by Google Ireland Limited ("Google"). Google Analytics uses cookies and similar technologies to collect and analyze information about the usage of our Service.

• What Data is Collected: When you visit our Service, Google Analytics collects data such as:
  • Your IP address (we use IP anonymization, so your IP address is truncated before being stored by Google).
  • Pages visited on our Service.
  • Time spent on pages.
  • Referring website (how you found our Service).
  • Browser type and operating system.
  • Device type.
  • Clicks and interactions within the Service.
• Purpose of Data Collection: The data collected by Google Analytics helps us understand how our Service is used, identify popular content, troubleshoot technical issues, and improve the overall user experience and functionality of Ethic Link. We use this information to:
  • Analyze user behavior patterns.
  • Improve our Service's design and features.
  • Measure the effectiveness of our marketing efforts.
• Legal Basis for Processing: We process data via Google Analytics based on our legitimate interest (GDPR Article 6(1)(f)) in understanding and improving our Service, provided that your fundamental rights and freedoms are not overridden. We ensure that your privacy is respected by implementing IP anonymization and offering clear opt-out options.
• How Google Processes Data: Google will use this information on our behalf for the purpose of evaluating your use of the Service, compiling reports on Service activity for us, and providing other services relating to Service activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google is an independent data controller for its own processing activities related to the data collected via Google Analytics.
• Data Location and Transfers: The information generated by Google Analytics cookies about your use of the Service (including your anonymized IP address) is transmitted to and stored by Google on servers, which may be located in the United States. Google ensures an adequate level of data protection through Standard Contractual Clauses (SCCs) and other necessary safeguards (e.g., encryption, transparency reports).
• Data Retention by Google Analytics: We configure our Google Analytics settings to retain user-level and event-level data for a period of 14 months before it is automatically deleted. Aggregate and anonymized data may be retained longer.
• Your Control and Opt-Out Options:
  • Browser Settings: You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service, or some features might not function as intended.
  • Google Analytics Opt-out Browser Add-on: To prevent your data from being used by Google Analytics, you can download and install the Google Analytics Opt-out Browser Add-on, available at: https://tools.google.com/dlpage/gaoptout
• Our use of other cookies: We also use other cookies that are strictly necessary for the operation of the Service (e.g., for user authentication, session management). These essential cookies do not require your consent as they are vital for the Service to function.

9. Links to Other Websites

Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

10. Children's Privacy

Our Service is not intended for use by individuals under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and updating the "Last Updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us:

By email: office@ethiclink.eu

By visiting this page on our website: www.ethiclink.eu