Privacy Policy

Last updated: September 3, 2025

This Privacy Policy applies to the processing of personal data carried out by S.C. MAVO TECH S.R.L. through the MAVO Platform (website, cloud application, mobile applications).

1. Introduction, the operator and data processing roles

The Operator: Data processing is carried out by S.C. MAVO TECH S.R.L. (hereinafter referred to as "MAVO" or "the Operator"), with registered office at [Address to be filled in], registered with the Trade Register under no. [To be filled in], Tax ID [To be filled in].
The Platform: The MAVO Platform consists of the presentation website, cloud application, and mobile applications.
MAVO's Roles: MAVO acts as:
- Data Controller (Case 1): For data collected directly from Clinic employees, website visitors, and pet owners who register themselves on the Platform (account data).
- Data Processor (Case 2): For medical data and data entered by the Veterinary Clinic (which acts as Data Controller) in patients' medical records.

2. What data we collect and how we obtain it

2.1. Automatically collected data (On website)

Technical/traffic data: IP address, browser and device type, operating system, time and duration of visit, URL references.
Method: Through necessary cookie files (for functionality) and analytical/marketing cookies (with your express consent).

2.2. Directly entered data (In cloud and mobile application)

From Clinic employees (users): Name, surname, professional email, password (for secure access).
From self-registered pet owners: Name, phone, email, CNP (Personal Numeric Code), ID card (as required by local legislation in special cases, such as dog registration).
Clinic fiscal data: Company name, Tax ID (CUI), Trade Register number, address, phone, email (for MAVO service billing).

2.3. Data entered by Veterinary Clinic (Processed as Processor)

Owner data: Contact data of clinic clients who have not self-registered.
Medical/service data: Medical records, diagnoses, test results, treatment plans, appointments (created by the veterinarian).

3. Legal basis and processing purposes

Processing is carried out on the basis of the following legal grounds, in accordance with Art. 6 of GDPR:

Contract performance (Art. 6.1.b):
- Provision of MAVO services (T&C) to Clinics and self-registered Owners.
- Administration, billing, and user account management.
Legitimate interest (Art. 6.1.f):
- Ensuring Platform security and fraud prevention.
- Conducting internal statistical analyses for service improvement.
- Defending MAVO's rights and interests in court.
Consent (Art. 6.1.a):
- For the use of non-essential cookies (analytical).
Legal obligation (Art. 6.1.c):
- Compliance with accounting and fiscal legislation (retention of invoices, transaction records).

4. Who we share data with (Recipients)

MAVO does not sell or rent personal data. In the context of providing services, data may be processed by:

Sub-processors: Essential technical service providers (e.g., secure cloud hosting, IT maintenance, email services) who process data strictly on behalf of and in accordance with MAVO's instructions, to ensure Platform operation. They do not have the right to use data for their own purposes and are bound by mandatory Confidentiality and Data Processing Agreements (DPA).
Public authorities: Courts, notaries, bailiffs, police, or other authorized bodies, only based on and within the limits of legal provisions (e.g., valid judicial requests).

5. Data storage and international transfer

Location: Data is stored on servers located in the European Economic Area (EEA).

6. Data retention period

Contractual/fiscal data (MAVO Controller): Retained for the duration of the contractual relationship and for 5 years after its termination, in accordance with Romanian legislation in force.
Self-registered owner account data (MAVO Controller): Retained until the Owner requests account deletion.
Medical data (MAVO Processor): Retained for the duration of the contract with the Clinic. Upon termination, they are irreversibly deleted from the MAVO system after a grace period of maximum 90 days.

7. Data subject rights (GDPR)

Right of access: To receive confirmation of processing and access to processed data.
Right to rectification: To request correction of inaccurate data or completion of incomplete data.
Right to erasure ("Right to be forgotten"): To request deletion of data, under certain conditions.
Right to restriction of processing: To request limitation of processing under certain conditions.
Right to data portability: To receive data in a structured format and transfer it to another controller (applies to data provided on the basis of contract or consent).
Right to object: To object to processing based on legitimate interest (including profiling) or processing for direct marketing purposes.
Right not to be subject to a decision based solely on automated processing.
Right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).
Note: Exercise of rights is done either with MAVO (if MAVO is Controller, Case 1), or with the Veterinary Clinic (if MAVO is Processor, Case 2).

8. Data security

MAVO commits to take all appropriate technical and organizational measures to protect data from unauthorized or illegal processing and from accidental loss, destruction, or damage.
These measures include encryption, access control, security audits, and ensuring system resilience.

9. Contact DPO / Data Protection Officer

For exercising rights or for any questions related to data processing, please contact:

Data Protection Officer (DPO): [DPO Name - *Fill in manually*]
Email address: [GDPR-dedicated email address - *Fill in manually*]
Postal address: S.C. MAVO TECH S.R.L., [Registered Office Address - *Fill in manually*]