Privacy policy

Effective date and last updated: 18 October 2026

1. Who we are#

Harmoniq is provided by:

• SYNCDEV S.R.L.
• Romanian Trade Register no.: J2014000164361
• EUID (European Unique Identifier): ROONRC.J2014000164361
• CUI / fiscal identification code: 33129339
• Registered office: Str. Fetițelor nr. 4, camera nr. 1, 820035 Tulcea, Tulcea County, Romania
• General email: hello@harmoniq.ro
• Privacy contact: privacy@harmoniq.ro
• Contact form: https://harmoniq.ro/en/contact

For the processing described in this Privacy Policy, SYNCDEV S.R.L. ("SYNCDEV", "Harmoniq", "we", "us") is the data controller unless Section 2 says otherwise.

SYNCDEV has not appointed a data protection officer because it has determined that the mandatory appointment criteria in Article 37 GDPR do not currently apply. Privacy questions and data subject requests should be sent to privacy@harmoniq.ro.

2. Scope and allocation of roles#

This Policy applies when you:

• visit the public Harmoniq website (https://harmoniq.ro and its English version at https://harmoniq.ro/en);
• send us a message through the contact form, ask for a demo or sign up to receive news about Harmoniq;
• start or complete a company signup to Harmoniq and its free trial;
• act as an owner, administrator, billing contact or other authorised user of a Harmoniq company account in its dealings with SYNCDEV;
• deal with SYNCDEV concerning a subscription, invoice, support request, feedback or security matter; or
• otherwise interact directly with SYNCDEV.

Harmoniq is a software service (SaaS) for businesses only, through which companies manage their people, performance (KPIs), training, internal communication, documents and, on some plans, relationships with their own customers (CRM).

Data in a company's workspace. When a company uses Harmoniq to process the personal data of its employees, contractors and users, of its own customers and contacts (in the CRM module) or of other people it records, that company is the controller and SYNCDEV is its processor. That processing is governed by the company's privacy notice and the Harmoniq Data Processing Agreement ("DPA", https://harmoniq.ro/en/legal/dpa). If you are an employee of a company that uses Harmoniq, or a customer of such a company, please address requests about your data to that company first. Employees can also file requests about their own data in the app (the menu with your name → "My personal data"); the company receives and handles them.

SYNCDEV remains a separate controller for the public website and its forms, signup and the free trial, administration of the contractual relationship with the customer company, platform billing, the direct support relationship, platform security, fraud prevention, legal compliance and defence of claims.

3. Personal data we process#

Depending on how you interact with us, we may process the following categories.

3.1 Public website and cookieless statistics#

When you visit the public Harmoniq website, our servers necessarily receive technical connection data such as your IP address, request time, requested resource, response status and browser information. Security logs may retain some of this data for a limited period.

Our own visit statistics set no cookie and do not keep the IP address. To count visits while reducing identifiability, the system:

• combines the IP address and the browser's user-agent string with a random secret value created each day and never kept with the statistics, and keeps only the resulting hash, so a visitor cannot be followed from one day to the next;
• groups the page views of the same hash that follow each other within 30 minutes into one visit, so that visits and the pages seen during a visit can be counted; no identifier is stored on your device for this;
• stores the page path without its query string, the page's language and the kind of page (for example the home page, pricing or a legal document);
• records only the host of the referring site, its general category (search engine, social network, other site or direct visit) and campaign parameters (utm_source, utm_medium, utm_campaign), if present;
• derives from the user-agent string only the general device type (computer, phone, tablet), the browser family (for example Chrome or Firefox) and the operating system family (for example Windows or Android), without keeping the string itself;
• looks up only the country of the IP address, in a geolocation database kept on our own server (the address is not sent to anyone for this), and keeps only the country code;
• records nothing for search-engine crawlers, nor when the browser sends the Do Not Track or Global Privacy Control signal; and
• honours an objection made through the "Don't count my visits" option in the cookie banner, which can be reopened at any time from "Cookie settings" in the site footer, or by refusing the "Statistics" category when the banner asks for your consent; the objection is kept only in your browser (in local storage and in a first-party cookie, hq_stats_objection, which the server reads in order to honour it), and once you object the page no longer sends visits and the server no longer records them.

We treat the hash and the derived statistics as pseudonymised personal data for GDPR purposes. They are not used to follow you across other websites or across different days.

When measurement or advertising tools are configured on the site, your cookie choice is kept as proof (Article 7(1) GDPR): our server keeps only a keyed hash of a random identifier generated by your browser, the categories chosen, the action taken (accepting all, refusing all, a custom choice or withdrawing consent), the policy version, the language and the time of the choice — never the IP address. The optional measurement and advertising tools that may be configured on the site, and cookies and similar technologies, are described in the Cookie Policy (https://harmoniq.ro/en/legal/cookies); none of them loads before you agree.

3.2 Contact messages, demos and news about Harmoniq#

Through the contact form we may process your name, email address, company, phone number (optional), the topic chosen, your message, the site's language, the IP address used to submit the form, information about where the visit came from (landing page, referring site and campaign parameters, if any — kept in the browsing session and attached only to the message you send; for contact messages we use no click identifiers and report no conversions), our replies and any information you choose to include. Please do not include special-category data or unrelated personal data.

If you sign up to receive news about Harmoniq, we process your email address, name (optional), language, the place on the site where you signed up and the IP address used. Every message contains an unsubscribe link; unsubscribing deletes the record.

3.3 Signup, company verification and the free trial#

During signup we may process:

• your name, email address and a securely hashed password;
• the company name, country, fiscal identification code or VAT number and requested subdomain;
• the plan chosen and preferred language;
• IP address, time of acceptance and the versions of the Terms, the DPA and the Privacy Policy shown;
• the email confirmation code (kept only as a hash); and
• company information returned by the public or official registers we query — ANAF for Romanian companies and VIES for European Union VAT numbers.

The plaintext password and confirmation code are not retained by us.

So that the free trial is granted only once, we keep cryptographic fingerprints (HMACs, computed with a secret key of the application) of the signing-up person's email address, of its domain (not for public email providers, whose domain is shared by many people) and of the company's identification number. The addresses and numbers themselves are not kept for this purpose.

3.4 Account and authorised-user data#

In our direct relationship with the customer company we may process names, work contact details, roles and permissions, account status, password hash, two-factor authentication configuration, security and recovery information, sign-in and activity information, settings, actions recorded in audit logs, and communications with the account's owners and administrators.

If your employer or another organisation creates your user account, we receive this information from that organisation. That organisation is the controller for its own use of your work-account data.

3.5 Subscription, billing and fiscal data#

We may process the customer's legal name, registered office and billing address, trade-register and VAT identifiers, VAT-payer status, billing contact and email, plan, add-ons (seats, storage, modules), billing period, subscription status, invoice and payment history, and tax information.

Subscription payments are processed through Stripe. Harmoniq may receive Stripe's customer and payment references, payment status, card brand, last four digits and expiry information, but does not store the complete card number or the card security code. Fiscal invoices are issued through SmartBill.

3.6 Support, feedback and service communications#

We may process support requests, messages, attachments, feedback sent from the app, incident details, and the name and email address of the user who writes to us. We send the account's owners and administrators service communications: announcements about features, maintenance, and changes to the Terms, prices or sub-processors.

3.7 Security and operations#

We may process records of authorised support access to an account (impersonation), system errors (with sensitive data removed), request metadata, the platform team's audit records, IP address, user agent and other information needed to diagnose an issue, secure the service or establish what happened. Support access to an account happens only on request or for security and operations, and is always logged.

3.8 Data in companies' workspaces#

The data a company enters or generates in Harmoniq — for example employee records (including the CNP, the Romanian personal identification number), leave, performance scores and evaluations, training, internal social network content, documents, occupational health and safety data, survey answers and CRM customer data — is Customer Personal Data, governed by the DPA and by that company's privacy notice. The same applies to features the company chooses, such as the AI assistant (switched on only by the company, with people's names, email addresses and phone numbers replaced by aliases before anything is sent to the AI provider), SMS notifications through the company's own account, or the company API.

3.9 Campaign attribution and conversion reporting#

When you arrive at the site from a campaign, the site keeps in the browsing session (without a separate cookie and without consent being required, as the session cookie is strictly necessary) the campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the ad click identifiers (gclid, gbraid and wbraid from Google, fbclid from Meta, msclkid from Microsoft), the landing page and the referring site. Only the first source of the visit is kept; for a visit without a campaign, nothing is kept.

If you sign up a company in the same session, these values and your choice for the "Advertising" category in the cookie banner (accepted, refused or not asked) are kept with the company's account. We use them to know which campaigns bring paying customers, in an internal acquisition report.

Only if you accepted the "Advertising" category in the cookie banner before signing up, we may report the signup and, later, the first paid subscription (with its value and currency) to Google Ads (offline click conversions, with enhanced conversions) and to Meta (the Conversions API). What is sent: the click identifier from the visit, the event and its time, the value and currency for a subscription, and the account owner's email address as a one-way SHA-256 hash, so that the platform can match it — never in clear. Without that consent, or without a click identifier or an email address that can be matched, nothing is sent. Each report is sent only once, and the platforms accept conversions only within 90 days of the click. We keep a record of what was reported (the platform, the event, the status, the time, the value and the currency).

Click identifiers are erased 120 days after signup. Campaign names describe a campaign, not a person, and stay with the account until it is deleted. The company's Owner sees this data in Company → Company data and account, receives it in the company export (the acquisition.json file) and can erase there the click identifiers, the landing page and the referring site; the campaign names, the recorded choice (proof of consent) and the record of the reports remain.

4. Where the data comes from#

We receive personal data:

• directly from you;
• from the customer company that authorises your account;
• automatically from your device and your use of the website or the service;
• from the payment and invoicing providers we use;
• from public or official business registers (ANAF) and the VAT-validation service (VIES); and
• from another person who contacts us and legitimately identifies you in a business matter.

If you give us another person's data, you must be authorised to do so and must give that person any notice required by law.

5. Purposes and legal bases#

We use personal data only when a legal basis applies.

Where an individual contracts in their own name, the basis for signup, account and billing is performance of the contract. For people acting on behalf of a company (owners, administrators, contacts), the basis is our legitimate interest in entering into and performing the contract with that company.

Our legitimate interests are operating a secure and useful B2B SaaS service, understanding aggregate use of the website, measuring the effectiveness of our own marketing, protecting customers, preventing abuse and defending legal rights. We apply minimisation, identifiers that change daily, limited access and retention limits. You may object as explained in Section 10. For the cookieless statistics you can object directly and immediately, using the "Don't count my visits" option in the cookie banner; no explanation is required.

Consent is asked for news about Harmoniq by email, for cookies and similar technologies that are not strictly necessary (Cookie Policy) and for reporting conversions to advertising platforms (Section 3.9). Consent can be withdrawn at any time as easily as it was given, without affecting processing already carried out lawfully. Consent to conversion reporting is withdrawn through "Cookie settings" on the website or, for an account already signed up, by writing to privacy@harmoniq.ro; withdrawal does not affect reports already sent.

Where Romanian Law no. 506/2004 permits marketing to an existing customer concerning our own similar services, we may rely on that limited rule only if we gave a clear, simple and free opt-out when collecting the address and in every message.

SYNCDEV does not use data in companies' workspaces (Section 3.8) for its own purposes. It processes that data only to provide the service, on the company's instructions and under the DPA.

6. Whether data is required#

Fields identified as required during signup or billing are necessary to verify the company, form or administer the contract, secure the account or issue a valid invoice. If you do not provide them, we may be unable to create the account, enter the contract, take payment or provide the requested feature. The contact form's required fields are needed for us to reply.

Optional profile, news and preference data is not required for the core service.

7. Recipients and disclosures#

We do not sell personal data.

Where necessary and lawful, data may be disclosed to:

• Hetzner Online GmbH (Germany), for hosting the application, database, files and backups;
• Sendinblue SAS (Brevo, France), used as the SMTP relay for service, account and support email;
• Stripe, for Harmoniq subscription payments;
• SmartBill, for fiscal invoices issued by SYNCDEV;
• ANAF and VIES (European Commission), to verify the company's identity and VAT number — only the company's number and country are sent;
• the providers of optional measurement and advertising tools on the website (Google, Meta, TikTok, LinkedIn), only if such a tool is configured and only after you accept the corresponding category, as set out in the Cookie Policy;
• Google Ireland Limited (Google Ads) and Meta Platforms Ireland Limited, for the conversion reporting described in Section 3.9, only if you accepted the "Advertising" category before signing up; each acts under its own terms, as an independent or joint controller for that processing;
• professional advisers, auditors and insurers bound by confidentiality;
• competent courts, tax, regulatory, supervisory, law-enforcement or other public authorities when legally required;
• a purchaser or successor in a genuine corporate transaction, subject to appropriate confidentiality and data-protection measures; and
• the customer company that administers your account.

Processors may act only under contract and on documented instructions.

For data in companies' workspaces (Section 3.8), SYNCDEV uses the sub-processors listed in the Sub-processor register (https://harmoniq.ro/en/legal/subprocessors), which covers hosting, email and — only for companies that switched on the AI assistant on the platform's account — the platform's AI provider (currently Anthropic). If a company connects its own AI account or its own SMS account (smslink.ro), that provider is chosen and contracted directly by the company and is not SYNCDEV's sub-processor.

8. International transfers#

We host the application, database, files and backups in the European Economic Area (Germany), and email leaves through Brevo's relay in the European Union. We prefer EEA processing where reasonably available, but we do not claim that all data remains in the EEA: for example, Stripe, the providers of the website's optional tools, the advertising platforms to which we report conversions and AI providers may also process data outside the EEA. For Google and Meta, any transfers to the United States are carried out under the European Commission's adequacy decision for the EU-US Data Privacy Framework or, where that does not apply, standard contractual clauses.

If personal data is transferred outside the EEA to a country without an applicable European Commission adequacy decision, we use an appropriate Chapter V GDPR mechanism, normally the European Commission Standard Contractual Clauses, together with a transfer-risk assessment and supplementary measures where required. Where a recipient validly participates in the EU-US Data Privacy Framework, that adequacy decision may be used for covered data and services.

You may ask for information about the applicable safeguard by emailing privacy@harmoniq.ro. Commercially confidential information may be redacted.

9. Retention#

We keep personal data only as long as needed for its purpose, then delete or irreversibly anonymise it unless a legal hold applies. Our operational retention schedule applies the following limits:

• uncompleted signup: deleted by a daily task once it is more than one day old;
• HMAC fingerprints used for the one-trial rule: 24 months, then deleted;
• messages received through the contact form: 24 months, then deleted, unless a customer relationship or dispute requires longer;
• signup for news about Harmoniq: until you unsubscribe, which deletes the record, or until we stop these communications;
• proof of the visitor's cookie choice: 24 months, then deleted;
• ad click identifiers kept with the company's account: 120 days from signup, then erased by a daily task (or earlier, at the account owner's request);
• campaign parameters, landing page, referring site and the choice for the "Advertising" category, kept with the company's account: for as long as the account exists (the landing page and the referring site can be erased earlier by the account owner);
• the record of conversions reported to advertising platforms: for as long as the account exists; when the account is deleted, the link to the company is removed, and what remains (the platform, the event, the status, the time, the value and the currency) no longer relates to a person;
• cookieless visit statistics: 25 months, then deleted;
• company account and user data, support requests and feedback: for the life of the account; after the owner closes the account, the company has 30 days to export or reopen it, then all of the account's data is deleted;
• invoices, accounting registers and supporting documents: for the statutory period. Under Article 25 of Romanian Accounting Law no. 82/1991, the general current period is five years calculated from 1 July of the year following the financial year in which the documents were prepared; a longer period applies only where another law, an authority or a documented legal hold requires it. Invoices keep the customer's billing details as at the date of issue, including after the account is deleted;
• the accounts' activity log: IP addresses are removed after 90 days and entries are deleted after 12 months, except those that serve as evidence (signup, acceptance of legal documents, support access, anonymisations), which are kept while the account exists;
• recorded system errors (with sensitive data removed): 30 days;
• security, access and platform-team audit logs containing personal data: only as long as needed for security and accountability, with longer retention only for a documented incident or claim;
• backups: encrypted daily backups kept in rotation (14 daily and 12 weekly copies), so that no copy is older than about 90 days; a restore re-applies the deletion of accounts closed earlier;
• evidence of an account's deletion: only the minimum needed (company name, dates of closure and deletion, number of records deleted) to demonstrate compliance or reapply erasure after a restore, for the applicable accountability and claims period.

Retention is enforced through scheduled deletion or anonymisation tasks. Data preserved for an incident, dispute, authority request or other documented legal hold is isolated, access-restricted and deleted when that reason ends.

Retention periods for data in companies' workspaces are set by each company, as controller, under the DPA.

10. Your rights#

Subject to the conditions and exceptions in the GDPR, you may:

• obtain confirmation and access to your personal data (Article 15);
• correct inaccurate or incomplete data (Article 16);
• request erasure (Article 17);
• request restriction of processing (Article 18);
• receive data you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller (Article 20);
• object to processing based on legitimate interests (Article 21);
• object at any time and without giving reasons to direct marketing;
• withdraw consent at any time (Article 7(3)); and
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects, where Article 22 applies.

Send your request to privacy@harmoniq.ro. Please identify the Harmoniq account or interaction concerned. We may request proportionate information to verify identity and authority. We normally respond within one month. For a complex request or multiple requests, the GDPR permits an extension of up to two further months; if so, we will explain the extension within the first month.

Requests are normally free. A reasonable fee or refusal is permitted only where a request is manifestly unfounded or excessive, particularly because it is repetitive, as allowed by the GDPR.

For data controlled by a company that uses Harmoniq (Section 3.8), please contact that company first; employees can also use the "My personal data" page in the app. If you write to us, we will direct you to the company or pass your request on to it, and SYNCDEV will assist the company as required by the DPA.

11. Complaints#

You may complain to the supervisory authority in the Member State of your habitual residence, place of work or the alleged infringement.

In Romania, the authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

• B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, 010336 Bucharest, Romania
• Email: anspdcp@dataprotection.ro
• Website: https://www.dataprotection.ro/
• Telephone: +40 318 059 211 / +40 318 059 212

We encourage you to contact us first so we can try to resolve the issue, but this is not a condition of your right to complain.

12. Security#

We use technical and organisational measures proportionate to risk, including: HTTPS-only connections (HSTS); access controls and role-based permissions; logical separation of each company's data, verified by automated tests; password hashing (bcrypt); two-factor authentication, which a company can make mandatory and which is mandatory for the platform team; encryption at rest of the CNP, of fields marked as sensitive and of stored keys and credentials; logging of sensitive administrative actions and of support access; rate limiting, security headers and server protections; encrypted backups; and controlled erasure workflows.

No system is completely secure. Users must protect their credentials, enable two-factor authentication, give staff only the permissions they need and notify us promptly of suspected compromise at hello@harmoniq.ro.

13. Automated decisions and AI#

SYNCDEV does not use personal data covered by this Policy to make solely automated decisions about individuals that produce legal or similarly significant effects. Harmoniq may automatically enforce the limits of the chosen plan or restrict an account after the trial or grace period ends, as set out in the Terms (https://harmoniq.ro/en/legal/terms).

In a company's workspace, Harmoniq automatically calculates performance scores and, where the company configures them, bonuses, using formulas set by the company, and shows signals to managers. Harmoniq takes no decisions: the company, as controller, is responsible for ensuring human review before any decision with legal or similarly significant effects and for informing its employees.

The AI assistant, when the company switches it on, produces answers, summaries, drafts and proposals for a human user to check. Proposed changes are saved only after the person confirms them, and drafted messages are not sent by Harmoniq. The assistant does not make legal, employment or similarly significant decisions about a person.

14. Children#

Harmoniq is intended for companies and the users they authorise who are aged 18 or over, not for children. The public website is not directed at children. A company that records data about minors in Harmoniq (for example, about employees or customers who are minors) is responsible for the appropriate legal basis, notices and age-related safeguards.

15. Changes#

We may update this Policy to reflect legal, provider or service changes. We will publish the new version and effective date. Material changes affecting account users will be notified through the service or by email before they take effect where required.

16. Contact#

Privacy questions and rights requests:

• SYNCDEV S.R.L.
• privacy@harmoniq.ro

General questions: hello@harmoniq.ro or the form at https://harmoniq.ro/en/contact.

Related documents: Terms and Conditions (https://harmoniq.ro/en/legal/terms), Data Processing Agreement (https://harmoniq.ro/en/legal/dpa), Sub-processor register (https://harmoniq.ro/en/legal/subprocessors), Cookie Policy (https://harmoniq.ro/en/legal/cookies).