Privacy Policy

Privacy Policy (GDPR-Compliant)

Effective date: 01 October 2025
Website: https://www.austrianeducationservice.com
Controller: ALVORA SRL, Romania

​

1) Who we are (Data Controller)

This Privacy Policy explains how ALVORA SRL (“we”, “us”, “our”) processes personal data when you use austrianeducationservice.com (the “Website”) and our related services.

• Legal form: SRL (Romania)

• Trade Register No.: J2025072187008

• Tax ID / CUI: 52552660

• VAT status: Not VAT-registered

• Registered office: Str. Nicolae Labiș, no. 32, office 25, Bl. 5, Ap. 13, Municipiul Brașov, Brașov County, Romania

• Contact email (privacy): contact@alvora.ro

• Phone: +373 688 53 823

• Data Protection Officer (if appointed): Not applicable

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Romanian and EU laws.

​

2) What data we collect

• Data you provide: name, email, phone number, country of residence, education background, application details, messages/attachments sent via forms or chat.

• Contract & billing data (if you purchase services): invoicing details, payment confirmations, service usage history.

• Automatically collected data: IP address, device identifiers, browser type/version, time zone, referrer, pages viewed, session duration, and cookies / similar technologies.

• Optional marketing data (with consent): newsletter preferences, campaign interaction.

We do not intentionally collect data from children under 16. If you believe a child has provided data, contact us to delete it.

​

3) Purposes and legal bases (Art. 6 GDPR)

1. Website operation & security — Legitimate interests (Art. 6(1)(f)).

2. Answering inquiries & providing consultations — Performance of a contract / pre-contractual steps (Art. 6(1)(b)).

3. Student advisory services (applications, documents, appointments) — Performance of a contract (Art. 6(1)(b)).

4. Invoicing & compliance (tax, accounting) — Legal obligation (Art. 6(1)(c)).

5. Service improvement & analytics (aggregated) — Legitimate interests (Art. 6(1)(f)).

6. Direct marketing (emails/newsletters, ads) — Consent (Art. 6(1)(a)); you can withdraw anytime.

7. Legal claims & defense — Legitimate interests (Art. 6(1)(f)).

If we use your data for a new incompatible purpose, we’ll inform you and explain the legal basis.

​

4) Cookies & tracking

We use necessary cookies for the site to function and (with your consent) analytics/marketing cookies.
Manage cookies via our Cookie Banner and your browser settings. Details (names, purposes, lifetimes, providers) are in our Cookie Notice at /cookie-notice.

​

5) Data sources

We obtain data directly from you (forms, email, calls) and automatically through your device. In limited cases, we may receive data from referral partners or public sources strictly to provide the requested service.

​

6) Disclosures (recipients) and processors

We share data only as necessary and with safeguards:

• IT & hosting providers: website hosting, email, CRM, analytics, cloud storage.

• Payments & invoicing: payment processor, accounting providers (where applicable).

• Professional partners: interpreters, education advisors, university application platforms only with your request/consent or when required to deliver the service.

• Public authorities: when required by law.

All third-party processors operate under GDPR-compliant data processing agreements (Art. 28 GDPR).

​

7) International transfers

If any provider is outside the EEA/UK/Switzerland, we use appropriate safeguards (e.g., EU Standard Contractual Clauses, Art. 46 GDPR) and conduct transfer risk assessments. Copies of safeguards are available upon request.

​

8) Retention periods (storage limitation)

• Enquiries (no contract): up to 12 months after last contact.

• Contractual records & invoices: 10 years (Romanian accounting rules) or as required by law.

• Marketing data: until you withdraw consent or after 24 months of inactivity.

• Security logs: typically 12 months, unless needed longer for incident investigation.

After the period ends, we delete or anonymize data securely.

​

9) Your rights (Arts. 15–22 GDPR)

You may request:

• Access, rectification, erasure, restriction, portability;

• Objection to processing based on legitimate interests or to direct marketing;

• Withdrawal of consent at any time (does not affect past processing).

• ​

To exercise rights, contact contact@alvora.ro. We respond within one month (extendable by two months for complex cases).

You can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.
You may also complain to your local authority (e.g., Datenschutzbehörde in Austria).

​

10) Security

We implement appropriate technical and organizational measures (access controls, encryption in transit/at rest where applicable, backups, least-privilege policies, staff training, incident response). No method is 100% secure, but we work continuously to protect your data.

​

11) Third-party links

Our Website may link to third-party sites or services governed by their own privacy policies.

​

12) Automated decision-making

We do not use automated decision-making producing legal or similarly significant effects (Art. 22 GDPR). If this changes, we will inform you in advance.

​

13) Changes to this Policy

We may update this Policy from time to time. The latest version is always available at /privacy-policy and shows the effective date above.

​

14) Contact us

ALVORA SRL
Str. Nicolae Labiș, no. 32, office 25, Bl. 5, Ap. 13, Municipiul Brașov, Brașov County, Romania
Email: contact@alvora.ro · Phone: +373 688 53 823
DPO: Not applicable

​

Legal Notice (Impressum)

Company name: ALVORA SRL
Registered office: Str. Nicolae Labiș, no. 32, office 25, Bl. 5, Ap. 13, Municipiul Brașov, Brașov County, Romania
Trade Register no.: J2025072187008
Tax ID (CUI): 52552660
VAT: Not VAT-registered
Main activity (CAEN): 7020 — Business and management consultancy activities
Phone: +373 688 53 823
E-mail: contact@alvora.ro