Privacy Policy

1. Data Controller

Ronala Imobiliare SRL, CUI 52133484, J2025050803009 (hereinafter "FreqVault", "we", "us") is the data controller responsible for the personal data described in this policy. We are established in Bucharest, Romania and operate as an EU-based data controller subject to the General Data Protection Regulation (EU) 2016/679 ("GDPR").

For UAE customers, FreqVault also complies with the UAE Federal Decree-Law No. 45/2021 on Personal Data Protection ("PDPL") as our standard of care for all customers, regardless of location.

Contact for data protection matters: privacy@freqvault.io

2. Data We Collect

2.1 Account & Registration Data

• Name, email address, phone number (where provided);
• Venue name, type, address and country;
• Account credentials (email + password hash via Clerk Authentication);
• Role within the organization (venue owner, manager).

2.2 Billing Data

• Subscription plan and billing cycle;
• Payment information is processed exclusively by Stripe, Inc. (PCI-DSS certified). FreqVault does not store card numbers or CVVs. We receive only a tokenized reference and last 4 digits;
• Invoice history and transaction references for accounting compliance (Romanian Fiscal Code requires 5-year retention; UAE FTA requires 5-year retention).

2.3 Usage & Technical Data

• Play events: which tracks were played, in which zone, at what time, and for how long;
• Schedule configurations (moods assigned to time slots);
• Zone and device identifiers;
• IP addresses (anonymized after 30 days), browser type, and operating system (collected via server logs and Vercel infrastructure);
• Session tokens and authentication data.

2.4 Communications Data

• Content of support tickets and email exchanges;
• Contact form submissions from the public website.

3. Legal Bases for Processing (GDPR)

4. How We Use Your Data

• To create and manage your FreqVault account;
• To provide the music streaming and scheduling service;
• To generate and deliver your subscription certificate;
• To process payments and issue VAT-compliant invoices;
• To send transactional emails (onboarding, certificate renewal, payment receipts, scheduled reports);
• To respond to support requests;
• To detect and prevent fraud, abuse and security breaches;
• To improve the platform through aggregated, anonymized usage analytics;
• To comply with legal obligations under Romanian and UAE law.

We do not sell, rent or trade your personal data to any third party for their marketing purposes.

5. Data Sharing & Third Parties

6. International Data Transfers

As an EU-established controller, we ensure that transfers of personal data outside the European Economic Area (EEA) are protected by:

• Standard Contractual Clauses (SCCs) — EU Commission-approved SCCs are in place with all non-EEA sub-processors (e.g., Stripe US, Vercel US);
• Adequacy decisions — where applicable (e.g., transfers to UK under the UK GDPR adequacy decision).

For UAE customers: We apply GDPR-equivalent protections globally. Data is primarily stored on EU infrastructure. Where data is processed in the UAE (e.g., for local support), it is subject to UAE PDPL Article 22 transfer requirements and equivalent safeguards.

7. Data Retention

8. Your Rights

8.1 Under GDPR (Romania & EU customers)

• Access — request a copy of your personal data;
• Rectification — correct inaccurate or incomplete data;
• Erasure — request deletion ("right to be forgotten") where no legal retention obligation applies;
• Restriction — request we limit processing in certain circumstances;
• Portability — receive your data in a structured, machine-readable format;
• Objection — object to processing based on legitimate interests;
• Withdraw consent — at any time, without affecting prior processing.

You also have the right to lodge a complaint with the Romanian supervisory authority: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal) — www.dataprotection.ro

8.2 Under UAE PDPL (UAE customers)

• Access — obtain a copy of your personal data within 30 days of request;
• Correction — request correction of inaccurate data;
• Destruction — request deletion where retention is no longer justified;
• Objection — object to certain processing activities;
• Withdraw consent — for any processing based solely on consent.

UAE supervisory authority: UAE Data Office — www.uaedataoffice.gov.ae

9. Security

We implement appropriate technical and organizational measures including:

• TLS 1.2+ encryption in transit for all data;
• AES-256 encryption at rest for stored data in our database;
• Role-based access controls — platform admin and curator roles limit data access;
• Row-Level Security on all database tables;
• Periodic security reviews and penetration testing;
• Mandatory 2FA for all internal FreqVault staff with administrative access.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours (GDPR Art. 33/34) or as required under UAE PDPL.

10. Children's Privacy

The FreqVault Service is intended for commercial venue operators and is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact privacy@freqvault.io and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by email and an in-app notification at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact