Privacy Policy

VDI.ro respects the privacy of its users and is committed to protecting personal data in accordance with Regulation (EU) 2016/679 on data protection (GDPR) and the applicable national legislation.

This policy describes how we collect, use, store and protect your personal data when you use the VDI.ro platform (the website, the mobile apps and the agency websites hosted by VDI.ro).

Who we are — the data controller

The VDI.ro platform is operated by:

• SUIF GRUP SRL
• Tax ID (CIF): RO29727806 · Trade Register No.: J26/127/2012
• Registered office: Str. Constandin Hagi Stoian nr. 162B, 540256 Târgu Mureș, Mureș County, Romania
• Email: suport@vdi.ro

SUIF GRUP SRL is the controller of the data we process for the platform's own purposes (accounts, listings, payments, communication, statistics). For the data that real estate agencies enter about their clients in the CRM module, the agency is the controller and SUIF GRUP SRL is the processor (see section 1.3).

1. What data we collect

1.1. Data provided by the user

• Account data: first name, last name, email address, phone number, password (encrypted).
• Listing data: property address, description, photos, price, surface area, technical characteristics and any other information voluntarily included in the listing.
• Agency data: name, tax ID (CUI), registered office address, contact details, logo, description, agents' details.
• Correspondence: messages sent through the platform's messaging system or through the contact form.

1.2. Data collected automatically

• Browsing data: IP address, browser type, operating system, pages visited, duration of the visit, traffic source.
• Device data: device type, screen resolution, language setting.
• Cookies and similar technologies: as detailed in the Cookie Policy (in Romanian).
• Location data: approximate location based on the IP address, used to display relevant results.

1.3. Identity document data (entered by real estate agencies)

Real estate agencies that use the client management module (CRM) may enter into the platform the data needed to draw up the brokerage contracts, viewing forms and GDPR annexes they sign with their clients:

• Personal numeric code (CNP);
• Series, number, issuer and date of issue of the identity document;
• Home address.

This data is entered by the agency, as part of its contractual relationship with the client. For this data, the agency is the controller and VDI.ro is the processor: we store it and make it available to the agency, but we do not use it for our own purposes, we never publish it in listings and we do not pass it on to other users of the platform.

How it is protected, specifically:

• it is encrypted in the database, not kept in plain text;
• it is displayed masked (only the last digits are visible), and revealing it in full is a separate action that only an agency user with write access to the CRM can perform;
• every consultation and every change is recorded in an access log, with the user, the moment and the IP address;
• it never appears on the public listing page, in the feeds to external portals, in the mobile app or in presentation mode (the screen turned towards the client).

Optionally, the agent may photograph the identity document so that the data is filled in automatically instead of being typed. In this case, a resized copy of the image is sent to the artificial intelligence provider OpenAI (United States of America), exclusively to read the text from the document. The photo is not kept — neither by us nor on our server: the temporary file is deleted immediately after reading, and only the filled-in fields remain in the platform, which the agent can correct before saving. The transfer takes place under the conditions described in section 9. Using this function is the agency's choice; the data can also be entered manually, without any photo.

1.4. Electronic signing of documents

Real estate agencies may send their clients documents to sign (contracts, viewing forms, annexes). Signing takes place on a page of the platform, with a confirmation code sent by email. So that the signature can be proven, the following are recorded at each step:

• the exact date and time (server time, with the time zone);
• the IP address of the connection and the network headers sent by the browser (for example X-Forwarded-For), the latter only as declared information;
• the browser and the device (the text sent by the browser and the basic platform hints), the screen size, the browser's language and time zone;
• where the link and the code were sent (the email address is kept encrypted and displayed masked), when the code was requested, sent, delivered and entered, and how many attempts there were; the code itself is not kept;
• the digital fingerprint (SHA-256) of the displayed document and of the signed document, the text of the ticked agreement, the answers to the questions about personal data and the drawn signature;
• the approximate location (rounded to about 100 m) only if the signer ticks it separately; signing works without it.

We do not use browser fingerprinting techniques (canvas, fonts) and we do not use this data for advertising or statistics. The signing page does not load fonts or scripts from third parties.

The controller of this data is the agency that sent the document; VDI.ro is the processor. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and the legitimate interest of the parties in being able to prove the signature (Art. 6(1)(f)). Recipients: the agency, the signers of the document (through the signing certificate, with contact details masked) and the email provider Mailgun, for sending the messages.

A signature applied in this way is a simple electronic signature within the meaning of Regulation (EU) No 910/2014 (eIDAS). The retention periods are in section 8.

2. How we use the data

We process your personal data for the following purposes:

2.1. Providing the services

• creating and managing the user account;
• publishing and managing real estate listings;
• facilitating communication between users;
• processing payments for promotion services.

2.2. Communication

• notifications related to the account and listings;
• answers to your requests and questions;
• alerts about new properties that match the saved criteria.

2.3. Analysis and improvement

• analysing the use of the platform to improve its features;
• generating aggregated and anonymised statistics;
• identifying and fixing technical problems.

2.4. Marketing

• commercial communications about VDI.ro services (with your prior consent);
• personalisation of content and recommendations.

You can unsubscribe from marketing communications at any time, using the unsubscribe link in the email or through the account settings.

3. Legal basis for processing

We process your data on the following legal bases:

• Performance of the contract — to provide the requested services (account, listings, messaging).
• Consent — for marketing communications and non-essential cookies.
• Legitimate interest — for the security of the platform, fraud prevention and improving the services.
• Legal obligation — to comply with the applicable legal requirements.

4. Sharing the data

We do not sell your personal data to third parties. We may share the data in the following circumstances:

• Real estate agencies: the contact details included in listings or sent through the messaging system are visible to the respective recipients.
• Service providers: we work with providers of hosting, backups, payments, invoicing, email sending, WhatsApp messaging, phone notifications, artificial intelligence and web analytics, who process data on our behalf. Their full list, with what each of them does and where they are located, is in section 9.
• SUIF GRUP SRL staff: only the employees who handle technical support and the operation of the platform, and only as much as is needed for a particular request or problem.
• Public authorities: we may disclose personal data when we are required to by law or at the request of the competent authorities.
• Protection of rights: we may disclose data when necessary to protect the rights, property or safety of VDI.ro, its users or the public.

5. Your rights

Under the GDPR, you have the following rights:

• Right of access — you can request confirmation that your data is being processed and a copy of it.
• Right to rectification — you can request the correction of inaccurate data or the completion of incomplete data.
• Right to erasure — you can request the deletion of your data, subject to legal retention obligations.
• Right to restriction of processing — you can request that processing be limited under certain conditions.
• Right to data portability — you can request to receive your data in a structured, commonly used and machine-readable format.
• Right to object — you can object to processing based on legitimate interest or for direct marketing purposes.
• Right not to be subject to automated decisions — you have the right not to be subject to a decision based solely on automated processing.

To exercise these rights, you can write to us at suport@vdi.ro or through the contact form on the website. We will reply within one month of receiving the request at the latest.

A copy of your data, straight from your account: in your account settings (Edit profile, Agent profile or Agency settings, on the website and in the VDI Agent app) you will find the “Descarcă-mi datele” (Download my data) button. We prepare an archive with your account data (the account, the profile, your listings, messages, saved searches, favourites, the consents you gave and the logs that concern you, including the activity log: what you did in the account and your logins, with the date, channel, device and IP address), in a format any program can read (JSON) and in tables that open in Excel (CSV), and we email you the link. The link works for 48 hours; you can request one archive per day. For agency accounts, the archive contains the data of the person requesting it, not the agency's data.

What happens, specifically, when you delete your account from the settings: the account immediately becomes unusable, the email address of the account is changed so that it can no longer be used to log in, your listings are hidden from the website, and your favourites and saved searches are deleted. 30 days after the deletion we automatically clear the remaining personal data of the account (the name, the email address, the phone number, the billing details, the connected devices, the IP addresses in the logs), and the listings of a private individual are deleted permanently, together with their photos. We keep only what the law obliges us to keep (the invoices and the payment records) and figures without personal data. Listings published through agencies belong to the agency and are not deleted together with an agent's account. If you want the deletion sooner, write to us.

You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

6. Cookies

The platform uses cookies and similar technologies. For detailed information about the types of cookies used and how to manage them, see the Cookie Policy (in Romanian).

7. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, including:

• encryption of connections via the SSL/TLS protocol;
• storing passwords in encrypted form (hash);
• access control to the database and internal systems;
• regular data backups;
• monitoring of access and suspicious activity.

8. Data retention

Below are the periods that the platform actually applies. Where there is no automatic deletion, we say so directly.

8.1. Data kept for as long as the account exists

• Account data: for as long as the account exists. When the account is deleted from the settings, what is described in section 5 happens; the remaining personal data is cleared automatically 30 days after the deletion (except for invoices and payment records).
• Listings: after they expire or are hidden, listings no longer appear on the website, but remain in the database for as long as the account exists; we also delete them on request. The listings of a private individual who deleted their account are deleted permanently, with their photos, 30 days after the account was deleted.
• Messages, contacts, requests and activities in the CRM: for as long as the account (or the agency account) exists. They are not deleted automatically.
• Identity document data (section 1.3): until the agency deletes it from the contact's record or until the agency account is deleted. The access log for this data is kept in the same way, for as long as the agency account exists, so that the agency can answer the question “who has seen my data”.
• Agency accounts: at the agency's request, we permanently delete the agency account together with all the agents' accounts, listings, settings and files.
• Signed documents, the evidence of signing (section 1.4) and the documents uploaded to listings: we keep the signed documents, the evidence of signing and the documents the agency uploads to listings (for example the land register extract, the cadastral documentation or the identity document) for as long as the agency has an account on VDI.ro. When the account is closed, the agency receives the complete archive, including all of these, and we delete them after 30 days. Each signer can download the signed document, with the evidence, from their personal link, for 90 days after all parties have signed, and anyone who provided an email address also receives it there. The evidence log cannot be modified or deleted from the interface.

8.2. Data with a fixed period, deleted automatically

• Website traffic log (IP address, page accessed): 30 days.
• Listing view history: 180 days for visitors and 90 days for robots (search engines, etc.).
• Login log (IP address, browser, success or failure): 180 days.
• IP addresses and browser details in the visit and event logs, in the listing contact logs, in the action log and in the mobile app log: cleared after 180 days; the rows remain only for the figures, without this data.
• Agency activity log (who did what in the account and when, from which device and IP address, without the changed values): 12 months.
• Log of emails sent by the platform: 365 days.
• Personal data in the signing log of documents that were not signed (cancelled, expired or refused) — IP address, browser, device, destination of the code, location: cleared after 12 months; only the type and time of the steps remain.
• The agencies' AI campaigns: the content of the technical requests and responses is cleared after 30 days, and the log row is deleted after 90 days; the change history of a campaign (who changed what) is kept for 365 days.
• Invitations sent to private owners that were not activated: the invitation expires, and the account and the draft listing created for it are deleted after 14 days; the expired invitation, with the phone number, is deleted 14 days after it expired.
• Temporarily uploaded files (for example a photo that was not saved): 24 hours.
• Backups of the database and of the uploaded documents are made every night. Our server keeps the copies from the last 3 days (or fewer, if the disk space fills up). In the Google Drive storage we keep the copies from the last 7 days and, in addition, one copy per week (Sunday's) from the last 4 weeks. A copy removed from Google Drive stays for another 30 days in the Drive trash, then it is permanently deleted. Therefore, information deleted from the platform may still exist in these copies for at most approximately two months (4 weeks, plus the 30 days in the trash).

8.3. Other data

• Invoices and payment records: for as long as required by tax and accounting legislation. They are not deleted when the account is deleted. Card data does not reach us: payment is made directly at Stripe.
• Data collected by the analytics and advertising tools (section 9.3), only if you have accepted the respective cookies: it is kept by the provider of each tool (Google, Meta, TikTok), for the retention period set in our account with that provider and according to each provider's policies. We do not keep copies of this data ourselves.
• Social network accounts and Google Calendar: according to sections 10 and 11.

9. Our providers and transfers outside the European Union

The servers on which the platform and the database run are in the European Union, at the provider Hetzner. For certain functions we use external providers. Some of them are companies from the United States of America, so the data sent to them may leave the European Union. For these transfers we rely on the safeguards provided by the GDPR and included in the providers' data processing terms: the standard contractual clauses approved by the European Commission or, for the providers that are registered, the EU-US Data Privacy Framework.

9.1. Providers in the European Union

• Hetzner — hosting of the servers and the database.
• SmartBill (Romania) — issuing invoices: name or company name, billing details, amount paid.

9.2. Providers that may transfer data outside the European Union

• OpenAI (USA) — artificial intelligence: generating titles and descriptions for listings, analysing photos, natural language search (the search text), drafting and analysing the messages in the agencies' AI campaigns and in the conversations with private owners and — at the express request of the agency — reading the data from a photographed identity document (section 1.3).
• Anthropic (USA) — artificial intelligence: the texts, corrections and translations for the agencies' websites, help with drafting document templates and blog articles. It may receive the content that the agency puts on its website (for example the contact details of the agency and of the agents).
• Twilio (USA) — sending and receiving WhatsApp messages: the phone number and the content of the message. WhatsApp messages also pass, by the nature of the service, through Meta's infrastructure.
• Mailgun (USA) — sending the platform's emails: the email address, the name and the content of the message.
• Stripe — processing card payments: the name, the email address and the payment details. Card data is entered directly at Stripe; we do not see it and do not keep it.
• Google (USA) — login with a Google account, synchronisation with Google Calendar (section 11), phone notifications in the mobile apps (Firebase: the phone identifier and the text of the notification) and storing backups (Google Drive).
• Meta Platforms (Facebook, Instagram) — publishing to the social network accounts connected by agencies (section 10).

Under the API terms of OpenAI and Anthropic, the content we send them is not used by them to train models.

9.3. Analytics and advertising tools (only with your consent)

On VDI.ro, the tools below start only after you accept the corresponding category of cookies in the cookie banner. Until then they are not loaded (or, in Google's case, they work without cookies, in “consent denied” mode):

• Google Analytics (Google, USA) — traffic statistics (the “Analytics” category). Google Analytics does not receive your VDI.ro account number;
• Meta Pixel (Meta Platforms: Facebook, Instagram) and TikTok Pixel (TikTok) — ad measurement (the “Marketing” category).

For ad measurement, the platform may send to Meta, directly from the server, events such as a registration or a payment, together with the email address and the phone number of the account irreversibly transformed (hashed), so that they cannot be read as such.

The agency websites hosted by VDI.ro may also use the analytics tools chosen by the respective agency (for example Google Analytics or Meta Pixel), configured by the agency. These too start only after the visitor accepts them, in the cookie banner shown on the agency's website. An agency website without such codes shows no banner and loads no tracking tool.

9.4. Maps (OpenStreetMap)

The maps on the listing pages and on the residential development pages (and on the agency websites) are drawn with OpenStreetMap (the OpenStreetMap Foundation, United Kingdom — a country for which the European Commission has recognised an adequate level of data protection). To display the map, your browser requests the map images directly from the OpenStreetMap servers, which therefore receive the IP address of your device and the page the request comes from — otherwise they would not know where to send the images. We do not send them any other data, and the map does not set tracking cookies. The program that draws the map (Leaflet) is downloaded from unpkg.com, which likewise receives the IP address. The “Open in Google Maps” link, where it exists, takes you to Google only if you click it.

10. Social network accounts connected to VDI.ro

An agency that uses the Social Media module can connect its own social network accounts, in order to publish its listings directly from VDI.ro. The connection is made by an administrator of the page, only once, and can be undone at any time. Nothing in this section happens unless you connect an account.

10.1. Which networks

Today: Facebook (Pages) and Instagram (business accounts linked to the Page). In preparation: LinkedIn, TikTok, YouTube and Google Business Profile. This section applies to each of them, as they are activated.

10.2. What data we receive from the network

• The identifier of the Page or account and the display name — so that you know which account the post goes to.
• The profile picture of the Page — only so that you can recognise it in the list.
• The Page access token — the key with which the network allows us to publish on your behalf.
• The identifier of the account with which the connection was made — so that we know what to delete if you request deletion through the network.
• The figures of the posts made from VDI.ro — how many people saw them, how many clicks, reactions, comments, saves — plus the public address of the post.

What we do NOT take: the list of friends or followers, private messages, posts that we did not make, other people's data, ad accounts, budgets or payment methods on the network. We do not read comments or messages and we do not reply to them on your behalf.

10.3. Why

For one thing only: to publish on the accounts you have connected, when you ask us to — by clicking “Publish” or by scheduling a post — and then to show you how the post performed. We do not publish anything on our own initiative and we do not use your accounts for any other purpose. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).

10.4. How long we keep them and how we store them

• The access token is stored encrypted in our database and only while the account is connected. The moment you disconnect the account, we delete it — we do not keep it “for later”.
• The name, picture and identifier of the account — while the account is connected.
• The posts made from VDI.ro and their figures — for as long as your agency account exists, so that you have the history. You can delete them at any time from the panel.

10.5. Who we do not give this data to

We do not sell it, we do not rent it and we do not give it to another agency. We do not use it for advertising and we do not train artificial intelligence programs with it. It does not leave VDI.ro except towards the network you publish on, and only as much as is needed for the post to get there.

10.6. How to delete the data received from the networks

Three ways, any of them works:

• From the panel — Social Media → Conexiuni (Connections) → the “Scoate” (Remove) button next to a Page, or the “Șterge datele mele de la Facebook/Instagram” (Delete my Facebook/Instagram data) button, which removes all connected accounts at once. Posts scheduled on them remain drafts and are not published.
• From Facebook — Settings → Apps and Websites → remove the VDI app. Facebook notifies us, and we delete the data automatically.
• Directly from us — through the contact form on the website, or from the page deletion of the data received from the networks (in Romanian), the address that Meta also uses for deletion requests. You receive a confirmation code and a page where you can see the status of the request.

What is deleted, in all three cases: the access token, the name, the picture and the identifier of the account. Deletion does not affect the posts already published on the network — those are on your account and you delete them from there.

10.7. The networks' rules

When we publish on a network, we comply with its developer and content rules (Meta, LinkedIn, TikTok, Google/YouTube). The network in turn processes the data according to its own privacy policy — which you can find on its website.

11. Google Calendar — data received from Google

Agents and agencies can connect, from their account profile, their own Google Calendar, so that the activities in the VDI.ro agenda (viewings, calls, meetings) appear in their calendar. The connection is made only at the user's request, after the user accepts the permission on the Google screen, and can be undone at any time. Nothing in this section happens unless you connect the calendar.

11.1. What permission we request

A single permission: “View and edit events on all your calendars” (https://www.googleapis.com/auth/calendar.events). We use it to create, modify and delete the events that come from your VDI.ro agenda. We do not read, copy or modify the other events in your calendar. Login with a Google account (“Continue with Google”) is separate and receives only the name, the email address and the profile picture.

11.2. What data we receive from Google and what we keep

• The access token and the refresh token — the key with which Google allows us to write in your calendar. It is stored in our database, with restricted access, only while the calendar is connected.
• The identifier of each event created by us — so that we can move or delete the event when you move or delete the activity in the agenda.

11.3. What we send to your calendar

For each activity in the agenda that you own or to which you have been added: the title and type of the activity, the date, time and duration, the location, the details written in the activity, the name and phone number of the person linked to the activity and a link back to the VDI.ro agenda. When the activity is cancelled or deleted, we remove the event from the calendar.

11.4. How we use the data received from Google

Only for the function described above, which you see and control from your profile. We do not sell this data, we do not use it for advertising, we do not pass it on to third parties, we do not use it to train artificial intelligence models and it is not read by humans — except when you explicitly ask us for help, when it is necessary for security or to comply with the law.

VDI.ro's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11.5. How to disconnect and what is deleted

• From VDI.ro — account profile → Google Calendar → “Deconectează” (Disconnect). We revoke the token at Google and immediately delete, on our side, the token and the event identifiers.
• From the Google account — myaccount.google.com/permissions → VDI.ro → remove access. From then on we can no longer write anything in your calendar.

The events already created remain in your calendar: they are yours and you can delete them from Google Calendar. For any other request related to this data, you can write to us through the contact form.

14. Changes to the privacy policy

We reserve the right to update this policy. Changes will be published on this page, with the date of the last update. For significant changes, we will notify users by email or by a notification on the platform.

15. Contact

For any questions about the processing of your personal data or to exercise the rights described above, you can contact us:

• by email, at suport@vdi.ro;
• through the contact form on the website;
• by post, at the registered office of SUIF GRUP SRL: Str. Constandin Hagi Stoian nr. 162B, 540256 Târgu Mureș, Mureș County, Romania.

SUIF GRUP SRL has not appointed a data protection officer (DPO). For any question or request regarding personal data, write to us at suport@vdi.ro.

We will reply within one month of receiving the request at the latest.