GDPR and data protection

• You are the controller of the personal data in your workspace (your clients, contacts, team members and leads). All in One Software S.R.L. is your processor, acting only on your instructions, under the Data Processing Agreement that forms part of the Terms of Service.
• We are the controller of our own account, billing and security data (see the Privacy Policy).
• We do not sell personal data, use customer data for advertising, or profile website visitors.
• Frusma gives you tools for the duties you have as a controller (section 5), but remaining compliant is your responsibility and depends on how you use it.

The database, authentication and file storage are hosted in the European Union. The application itself is served by Vercel Inc., and e-mails you send from Frusma pass through our e-mail delivery provider; both are US-based providers, and transfers rely on the EU Standard Contractual Clauses (and on the EU–US Data Privacy Framework where the provider is certified). Details are in the sub-processor list below.

• Workspace isolation: every record belongs to one workspace, and database-level access rules prevent one workspace from reading another’s data.
• Role-based access: admins, employees, freelancers and client-portal users see only what their role allows; financial data is limited to admins; freelancers see only projects they are assigned to; clients see only their own company.
• Private file storage: documents, receipts and logos are stored privately and opened through links that expire after a few minutes.
• Encryption and passwords: connections use TLS; passwords are stored only as salted hashes; sessions can be ended on other devices.
• Least privilege and logging: privileged server operations run only from server code, and personal-data exports and erasures are recorded in an audit log that stores identifiers, not names.
• Public forms: lead forms include spam protection, rate limiting and a consent checkbox you can configure.
• People: access to production systems is limited to the operator.

These measures are described in more detail in Annex 2 of the Data Processing Agreement.

These providers process customer personal data on our behalf. We give customers at least 30 days’ notice before adding or replacing one, and you may object on reasonable data-protection grounds (see the DPA).

Optional connections you set up yourself (for example Google Analytics, or signing in with Google, Microsoft, GitHub or Facebook) are not our sub-processors: they are governed by your own relationship with those providers.

• Export (access and portability): workspace admins can download everything held about a company or a contact as a file (company or contact page, privacy actions).
• Erasure and anonymisation: admins can erase a contact or anonymise a company, with a confirmation step.
• Consent on lead forms: forms include a consent checkbox and a link to your privacy policy, and store the time of consent.
• Audit log: Settings → Privacy lists exports and erasures.
• Retention: invoices are kept for the legally required period; other data is deleted on request. Confirm the retention period with your tax adviser.
• Export of your data: including an accountant export, at any time.

So that you know exactly what to expect when you erase a person’s data:

• A contact is deleted.
• A company with invoices is restricted: contact data is erased, while the name, address and VAT number needed for the invoices are kept for the legal retention period. A company without invoices is fully anonymised.
• Documents classified as invoice or contract are kept; other documents, including stored files, are deleted. Portal logins are deleted and deals and proposals are anonymised.
• Not covered automatically: contracts and proposals you created in Documents → Contracts & proposals, free-text notes and e-mail copies you sent, and exports you already downloaded. Review and delete those yourself when you erase a person.

If you are the client or contact of a Frusma customer and want to access, correct or delete your data, please contact that business: it is the controller. If you contact us instead, we will pass your request to the relevant customer or tell you whom to ask, and we will help our customers respond within the legal deadline. For the personal data we control about our own users, see the Privacy Policy.

If we become aware of a personal data breach affecting data we process for you, we will notify you without undue delay so that you can meet your own notification duties (generally 72 hours to the supervisory authority), and give you the information you need about its nature, the data concerned and the measures taken.

Privacy questions and data-protection requests: cristianvieru3@gmail.com (All in One Software S.R.L., Bd. Dinicu Golescu, nr. 7, et. Parter, ap. SP. COM. 3, Sector 1, București, România). We have not appointed a data protection officer. You can complain to the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), dataprotection.ro, or to the supervisory authority in your own country.