PRIVACY POLICY / PRIVACY NOTICE (Articles 13–14 GDPR) – AI4Dealers SRL

Last updated: 30/12/2025

This Notice describes how AI4Dealers SRL (“AI4Dealers”, “we”) processes the personal data of website visitors, platform users, business contacts, customers, suppliers and, in certain cases, end users who interact with communications enabled through our services (e.g. WhatsApp/SMS/voice/email), when those communications are managed by our Customers through the platform.

AI4Dealers operates in compliance with Regulation (EU) 2016/679 (GDPR) and applicable legislation on personal data protection and electronic communications.

1) Data Controller and Contact Details

Data Controller: AI4Dealers SRL
Registered office: STR. BRADUL, NR. 18, Sca. B, Ap. 12, Timișoara, jud. Timiș, Romania
VAT number: RO50713612
EUID: ROONRC.J2024031996000
Email: info@ai4dealers.com
Telephone: +40 0758519816

Privacy contact (single channel): info@ai4dealers.com

2) Who This Notice Applies To

This Notice applies to processing carried out by AI4Dealers in relation to:

  • The AI4Dealers website and contact channels (forms, email, telephone).

  • The AI4Dealers SaaS platform (accounts, access, security, logs, support).

  • Contractual relationships with Customers, suppliers and partners.

  • Technical support and service communications.

  • Processing carried out on behalf of Customers, when Customers use the platform to communicate with their contacts/customers (e.g. WhatsApp/SMS/voice/email), with third-party integrations (e.g. Meta, Twilio).

3) GDPR Roles: When We Are a Controller and When We Are a Processor

3.1 AI4Dealers as Controller

AI4Dealers is the Controller when it processes data for its own purposes, for example:

  • managing the website and incoming contacts;

  • managing accounts and platform access;

  • administrative/accounting and contractual management;

  • security, abuse/fraud prevention, internal audits;

  • compliance with legal obligations and defence of rights in legal proceedings.

3.2 AI4Dealers as Data Processor (Article 28 GDPR)

When a Customer uses AI4Dealers to manage communications and processes (e.g. WhatsApp/SMS/voice messages, automations, address books/contacts, conversation logs, integrations), as a rule:

  • the Customer is the Controller of end-user data (e.g. its leads/customers);

  • AI4Dealers is the Processor, and processes data only to provide the service and in accordance with the Customer’s instructions, under a data processing agreement (DPA).

Important (operating model): AI4Dealers is a self-service service: the Customer decides whether, how and when to use the features. AI4Dealers does not carry out operational or “marketing” activities on behalf of the Customer, except for technical support, maintenance, security and contractual/legal obligations.

4) What Data We Process (Categories)

Depending on the interaction and services activated, we may process:

4.1 Contact and Business Data

First name, surname, email, telephone number, company, role/job title, content of requests submitted through forms/email/tickets.

4.2 Account and Platform Data

Credentials (in protected/hashed form), roles/permissions, preferences, access events, usage activity.

4.3 Technical and Security Data

IP address, system and application logs, user agent, timestamps, technical identifiers, security events, audit logs.

4.4 Administrative/Contractual Data

Data required for quotations, contracts, invoicing and accounting/tax obligations.

4.5 Data Processed on Behalf of the Customer (end users)

If the Customer uses AI4Dealers to communicate with its contacts/customers:

  • telephone numbers/channel IDs, emails, messaging identifiers;

  • message content (if and to the extent that the Customer manages it on the platform) and related metadata (delivery status, timestamps, errors);

  • tags, notes, outcomes, appointments/actions set by the Customer.

4.6 Special Categories of Data (Article 9 GDPR) and Minors

AI4Dealers does not request special categories of data. If such data is entered by the Customer or voluntarily disclosed by a data subject, it will be processed only where necessary and with appropriate safeguards; the Customer remains responsible for the legal basis when acting as Controller.
The services are intended for professional/B2B settings.

5) Purposes of Processing and Legal Bases (Article 6 GDPR)

A) Managing Incoming Contacts, Demos and Sales Enquiries

Purpose: responding to enquiries, arranging calls/demonstrations, sending requested information.
Legal basis: pre-contractual measures/contract (Article 6(1)(b)) and/or legitimate interest (Article 6(1)(f)).

B) Providing the SaaS Service and Managing Accounts

Purpose: creating/managing accounts, authentication, platform operation, technical support, service communications.
Legal basis: contract (Article 6(1)(b)).

C) Security, Abuse/Fraud Prevention, Business Continuity

Purpose: log monitoring, access controls, incident management, backups, business continuity, protection against attacks.
Legal basis: legitimate interest (Article 6(1)(f)) and/or legal obligation (Article 6(1)(c)).

D) Legal and Tax Obligations

Purpose: accounting, invoicing, civil-law/tax obligations, lawful requests from authorities.
Legal basis: legal obligation (Article 6(1)(c)).

E) Service Improvement (Technical Analysis, Not Marketing)

Purpose: maintenance, diagnostics, performance, stability, bug fixing, technical statistics not directed towards marketing.
Legal basis: legitimate interest (Article 6(1)(f)), prioritising aggregated/pseudonymised data.

F) Processing on Behalf of the Customer (Article 28 GDPR)

Purpose: providing the Customer with tools for its communications/processes (e.g. WhatsApp/SMS/voice/email), according to the Customer’s configurations.
Legal basis: for AI4Dealers: contract/DPA with the Customer (Article 28).
Note: the legal basis in relation to end users is the responsibility of the Customer (Controller).

6) No Use for Marketing Purposes

AI4Dealers does not carry out marketing activities using the personal data of Customers or end users, and does not use Customers’ data (or end-user data managed by Customers through the platform) for:

  • commercial profiling,

  • its own promotional campaigns,

  • disclosure to third parties for marketing.

Any communications sent by AI4Dealers are only:

  • responses to enquiries,

  • service/technical communications,

  • contractual/administrative management.

7) Where Data Is Processed/Hosted

Data from the AI4Dealers platform and services is hosted in Italy on a dedicated Aruba Business server.

Processing/transit through third-party providers necessary for the service (e.g. communications via Meta/Twilio) remains possible, including through infrastructure outside the EEA (see sections 9–10).

8) Recipients, Authorised Persons and Data Disclosure

Data may be accessible/disclosed to:

  1. Authorised AI4Dealers personnel (employees/collaborators) bound by confidentiality and instructed on processing.

  2. Suppliers/Processors (Article 28) necessary to provide the service (e.g. hosting, maintenance, security, ticketing, email providers, technical tools), to the extent necessary.

  3. Technology partners and communication channels activated by the Customer (in particular Meta and Twilio or equivalents), according to the service configurations.

  4. Advisers (legal, tax, auditors) and banking institutions, where necessary for obligations or protection.

  5. Public authorities or authorised parties, when required by law or valid orders.

Disclosure “Where Required” + Notification/Objection (Protective Approach)

  • In the event of binding requests from Authorities (order/decision), AI4Dealers may be required to disclose data without the data subject being able to object, within the limits established by law.

  • Where legally permitted and without compromising investigations/security, AI4Dealers will notify the data subject (or the Customer, if the data concerns end users processed on its behalf).

  • In the event of requests from private parties or requests that are not immediately binding, AI4Dealers, where applicable, provides notification and allows data subjects to object or exercise their protections, unless AI4Dealers has a legal obligation, an order from an Authority or an overriding legitimate interest to protect.

On request, AI4Dealers can provide an updated list of the categories of suppliers (and, where appropriate, the main sub-processors).

9) Transfers outside the EEA (European Economic Area)

Although data is hosted on servers in Italy, some integrated services (e.g. communication channels/global providers) may involve transfers to countries outside the EEA (e.g. the United States).

In such cases, AI4Dealers adopts appropriate safeguards, such as:

  • adequacy decisions of the European Commission where applicable;

  • Standard Contractual Clauses (SCCs) and supplementary measures (data minimisation, access controls, encryption in transit, etc.) where necessary.

10) Meta and Twilio (Roles and Operational Notes)

10.1 Meta (e.g. WhatsApp/Business Assets/APIs)

The platform may integrate with Meta products and APIs depending on the Customer’s enabled features. Meta may also process data as an independent controller for its own purposes (e.g. security, integrity, management of the Meta platform). Users are also encouraged to consult the relevant Meta privacy notices.

10.2 Twilio (Messaging/Voice and Communication Services)

AI4Dealers may integrate Twilio services to enable communications and notifications (depending on the modules activated). Data processed may include numbers, content and technical metadata necessary for delivery and reporting.

Important note: the use of communication channels towards end users (WhatsApp/SMS/voice/email) is configured by the Customer, which remains responsible for privacy notices, legal bases, consent and opt-out management where required.

11) Retention Periods

We retain data for the time strictly necessary for the stated purposes and in accordance with legal obligations:

  • Contractual/administrative and tax data: for the duration of the relationship and the periods required by applicable legislation (typically up to 10 years for accounting/tax documents).

  • Account and platform data: for the duration of the account; after closure, limited retention for technical needs, security and legal obligations.

  • Security and audit logs: for a period proportionate to security purposes (generally from a few weeks to 6/12 months, unless an investigation requires otherwise).

  • Tickets/support: for the time necessary to handle the request and a reasonable subsequent period for continuity and protection (e.g. 12/24 months), unless litigation is involved.

For data processed on behalf of the Customer, retention periods are determined by the Customer/Controller; AI4Dealers retains data according to the contract, instructions and technical needs.

12) Security Measures (TOMs)

AI4Dealers adopts technical and organisational measures appropriate to the risk, including, by way of example:

  • access controls and privilege management (the “least privilege” principle);

  • authentication and credential protection;

  • encryption in transit (TLS) and hardening measures;

  • logging and monitoring, backups and recovery procedures;

  • logical segregation of environments and patch/update management;

  • incident and data breach management procedures (notification where required).

13) Data Subjects’ Rights (Articles 15–22 GDPR)

You have the right to obtain:

  • access, rectification, erasure (where applicable),

  • restriction,

  • portability (where applicable),

  • objection (particularly to processing based on legitimate interest),

  • withdrawal of consent (if and when processing is based on consent),

  • information about any automated processes with significant effects (where applicable).

How to exercise your rights: write to info@ai4dealers.com stating the subject and your request. We respond within the statutory deadlines.

Complaints

You may lodge a complaint with a competent supervisory authority (normally the authority in your place of habitual residence or the place of the alleged infringement). For AI4Dealers (established in Romania), the national authority is ANSPDCP.

14) End Users Contacted through an AI4Dealers Customer

If you receive communications (e.g. WhatsApp/SMS/voice/email) managed through AI4Dealers technology on behalf of one of our Customers, as a rule:

  • the Customer contacting you is the Controller for the processing of your data;

  • AI4Dealers acts as a Processor and processes data only to provide the service.

To exercise your rights regarding that processing, contact the Customer that contacted you. Where possible, AI4Dealers may forward the request to the Customer or provide technical support in handling it.

15) Cookies and Tracking Technologies (Technical Only)

The AI4Dealers website and/or platform use only technical cookies and technologies strictly necessary for operation and security (e.g. session management, authentication, load balancing, abuse prevention, essential settings).

  • We do not use profiling/marketing cookies.

  • We do not use non-technical analytics cookies, except for any tools configured in a strictly technical/anonymised mode and in any case without marketing purposes (if present, these will be specified in a dedicated Cookie Policy).

You can manage or disable technical cookies through your browser settings; however, some website/platform features may not work correctly.

16) Changes to This Notice

We may update this Notice to reflect regulatory, technical or organisational developments. The updated version will be published with the date of the latest update.