Privacy Policy

SC CGM Software Romania SRL (hereinafter referred to as CGM) appreciates your visit to our website and your interest in our company, our products, and services. The protection of your personal data is important to us, and we want you to feel safe when visiting our website. Below, we explain what information we at CGM collect during your visit to our website and how it is used.

Scope

This privacy policy applies to the websites of CGM Software Romania and its affiliated companies, as well as the associated online services. It does not apply to any links to third-party companies. 

Personal data

Personal data is information about the personal or factual circumstances of an identified or identifiable natural person. This includes information such as your name, address, and telephone number. Information that is not directly linked to your true identity — such as preferred websites or the number of users of a site—is not personal data.

Collection and processing of personal data

When you visit our website, our web servers temporarily store the connection data of the requesting computer, the web pages you visit, the date and duration of your visit, the identification data of the browser and operating system type used, and the website from which you visited us for system security purposes. Additional personal information such as your name, address, telephone number, or email address will not be collected unless you provide this information voluntarily, e.g., as part of a registration, a survey, to process a contract, or an information request.

Use and sharing of personal data

We use the personal data you provide exclusively for the technical administration of the website and to fulfill your wishes and requirements, i.e., generally to process the contract concluded with you or to respond to your inquiry. We will only use this data for product-related surveys and marketing purposes if you have given us your consent or, where required by law, if you have not objected.

The retention period for this data depends on its intended use. We only retain contract data for as long as it is necessary to fulfill the contractual relationship (we will always inform you of details upon conclusion of the contract) or as long as we are legally obligated to do so. We only retain data collected and processed based on your consent for as long as your consent remains valid.

Your personal data will not be shared, sold, or otherwise transferred to third parties unless this is necessary for the purpose of contract execution or you have expressly consented. For example, when ordering products, it may be necessary for us to share your address and order details with our sales partners. The recipients of this data will be stated in the order confirmation.

Information from the Group

The CGM companies would like to contact you to inform you about offers and other news about our products and services. When you register on our website, we will therefore ask you to indicate whether you would like to receive direct marketing communications from us. Of course, as a CGM customer, you will continue to receive the necessary information about important changes related to existing contracts (e.g., software releases).

Use of cookies and other device access

Our website uses cookies for providing core functions and for web tracking. Cookies are small files that enable us to store specific user-related information on your device when you visit one of our websites. Cookies help us determine how often our websites are used and how many users we have. They also help us make our offers more convenient and efficient for you.

Cookies and other tags, such as local storage on your end device, are necessary to provide the services you require. Session cookies are a necessary part of enabling you to log in and navigate the site in a user-friendly manner. According to para. 25 II No. 2 of the New German Telecommunications-Telemedia Data Protection Act (TDDDG) we set such cookies without your consent. This also applies to a so-called “consent cookie”, which we use to record your selection in the cookie banner displayed at the beginning. For all other cookies and tags we will ask for your consent (para. 25 I TDDDG in conjunction with Art. 7 GDPR). We will inform you which cookies these are, for what purpose they are used, and for how long we process which information. You can access this information via our website in the cookie banner.

You can also withdraw your consent in whole or in part at any time via the cookie banner. It is also possible to use our offers without non-required cookies. You can deactivate the storage of cookies in your browser, restrict it to certain websites or set your browser so that it notifies you as soon as a cookie is sent. You can also delete cookies from your end device at any time. Please be aware that in this case, you will have to accept a limited display of the page and limited user guidance.

In the table below, we have listed the different categories of cookies that we use on our website:

Essential cookies

Cloudflare

We use the Content Delivery Network (CDN) of Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich Germany (Cloudflare) on our website to increase the security and speed of our website.

This corresponds to our legitimate interest (Art. 6 para. 1 lit. f GDPR).

A CDN is a network of distributed servers which delivers optimized content to the website user. Cloudflare stores your information mainly in the European Economic Area and is based on the current location of the website visitor. By using SSL certificates, the protection of the data is guaranteed along the entire transport route. 

Cloudflare gains access to the data traffic between our company and the website visitors. The following data is collected:

·         the IP address

·         the website accessed

·         the type of browser used

·         the operating system

·         the referrer URL

·         the requesting provider

Cloudflare does not store any personal data and does not pass on any user data to third parties. The necessary data logs are deleted after 24 hours in most cases.

The functionality of the website is not guaranteed without the processing operations by Cloudflare.

Cloudflare has implemented compliance safeguards for international data transfers. These apply to all global activities where Cloudflare processes personal data in the EU. These safeguards include the EU Standard Contractual Clauses (SCCs). Further information can be found at: https://www.cloudflare.com/trust-hub/gdpr/
 

Google Tag Manager

We use the “Google Tag Manager (GTM)” tag management system from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on our website. 

The Google Tag Manager collects data on the website and forwards it to the connected analysis tools listed below. This may result in the IP address being processed. 

The Google Tag Manager is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the fast and uncomplicated integration and management of various tools on its website.

Details on the terms of use of Google Tag Manager can be found here: https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/

Further information on the privacy policy and terms of use of Google services, such as Google Tag Manager, can be found here: https://policies.google.com/privacy?hl=en

Any transfer by the service provider to the USA is carried out on the basis of suitable compliance safeguards in accordance with Art. 46 para. 2 GDPR or by an adequacy decision in accordance with Art. 45 GDPR.

Details on the legal framework for data transfers to third countries can be found here: https://policies.google.com/privacy/frameworks?hl=en  

Cookies for analytics and marketing: web tracking services

The web tracking services are generally provided by service providers who process the data in accordance with the controller's instructions as so-called processors. This is ensured by means of data processing contracts. If the service providers process your data outside the European Union or the European Economic Area (hereinafter referred to as “EU or EEA”), a so-called third country transfer takes place. This is permitted if you have consented to this and the service provider has created guarantees for a level of data protection appropriate to the European standard or the EU Commission has classified the respective third country as a safe third country. The third country transfer of the respective service is indicated below.

In the following text you will find an overview of the services used, what these are, for what purpose they are used, what information they process and what legal basis we rely on.

Analytics cookies
 

Matomo

This website uses the self-hosted web analysis service Matomo from InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand. 

Matomo enables the evaluation of user behavior on our website and thus the optimization of our Internet presence. The following data may be processed for this purpose: Anonymized IP address, date and time, title, URL and referrer of the page, device and browser information, pseudo-anonymized location data. 

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner. You can find further information at https://matomo.org/privacy-policy

The processing of personal data in our self-hosted version takes place exclusively in a member state of the EU or in another state party to the Agreement on the EEA.
 

Marketing cookies

Meta Pixel

Our website uses the conversion tool Meta Pixel from Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

This is a tracking technology offered by Meta and used by other Meta services. It is used to track visitors' interactions with websites (“events”) after they have clicked on an ad placed on Facebook or other services provided by Meta (“conversion”).

The following data may be processed: Viewed Ads, Viewed Content, Device Information, Geographic Location, HTTP Header, Interactions with Ads, Services and Products, IP Address, Clicked Elements, Marketing Information, Pages Visited, Pixel ID, Referrer URL, Usage Data, User Behavior, Facebook Cookie Information, Facebook User ID, Usage/Click Behavior, Browser Information, Device Operating System, Device ID, User Agent and Browser Type.

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner. Click here to read the data processor's privacy policy: https://www.facebook.com/privacy/explanation

Click here to read the data processor's cookie policy: https://www.facebook.com/policies/cookies

If you do not have a Facebook account, you can deactivate usage-based advertising from Facebook on the website of the European Interactive Digital Advertising Alliance: https://www.youronlinechoices.com/

According to Meta, the data collected is also transferred to the USA and other third countries. The data transfer is based on compliance safeguards such as the standard contractual clauses of the EU Commission; data transfers to the Meta Platforms Inc in the US is based on the EU-US Data Privacy Framework. You can find details here: https://www.facebook.com/legal/EU_data_transfer_addendum  and https://www.facebook.com/help/566994660333381?locale=en_US&cms_id=566994660333381

Facebook Custom Audiences

We use a remarketing tag from Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

It is used to record and analyze website visitors in order to display interest-based advertising on Facebook, or to display ads to users who have also shown an interest in our website or who have certain characteristics (e.g. interests in certain products determined on the basis of the websites visited), which we transmit to Meta (so-called “Custom Audiences”). In addition, we can track the effectiveness of the advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook/Instagram advertisement (so-called “conversion”). The following data may be processed: IP address, pages visited (pseudonymized), device and browser information.

Other customer data such as name, telephone number or email can be transmitted in hashed form as hash values. No clear data is transmitted.

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner..

The user can deactivate the remarketing function “Custom Audiences” on Facebook under “Settings”. Further information: https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0

Personal data may be processed by this provider in third countries outside the European Union, e.g. by subcontractors. Any transfer by the service provider takes place on the basis of suitable guarantees in accordance with Art. 46 para. 2 GDPR or an adequacy decision in accordance with Art. 45 GDPR.

Google Ads

We use the “Google AdWords Conversion” function of Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Dublin (Google). 

This is a conversion tracking service. This service records what happens after a click on an ad placed by us via Google Ads when users subsequently visit the website. With conversions, we measure whether users perform a specific action on the website specified by us (e.g. whether services are ordered) after clicking on an ad placed by us via Google Ads. This allows the user to understand which keywords, ads, ad groups or campaigns lead to the desired user interaction.

The following personal data is collected: Advertisements viewed, cookie ID, date and time of visit, device information, geographic location, IP address, search terms, advertisements displayed, customer ID, impressions, online identifiers and browser information.

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner..

Further information and the data protection provisions can be found in Google's privacy policy at https://policies.google.com/technologies/ads?hl=en

Personal data may be processed by this provider in third countries outside the EU, e.g. by subcontractors, may take place. Any transfer by the service provider takes place on the basis of suitable guarantees in accordance with Art. 46 para. 2 GDPR or an adequacy decision in accordance with Art. 45 GDPR.

 

Google Ads Remarketing

This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads Remarketing, we can assign people who interact with our online offer to specific target groups in order to subsequently display interest-based advertising in the Google advertising network (remarketing or retargeting).

The data collected and used for targeting includes, for example, URLs and referral URLs for websites that trigger a tag, as well as the user-defined parameters of your tracking tag and the resulting affiliations to data segments. Furthermore, the advertising target groups created with Google Ads Remarketing can be linked to Google's cross-device functions. In this way, interest-based, personalized advertising messages that have been adapted to you depending on your previous usage and surfing behavior on one device (e.g. cell phone) can also be displayed on another of your devices (e.g. tablet or PC).

If you have a Google account, you can object to personalized advertising by clicking on the following link: https://www.google.com/settings/ads/onweb/

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner.

Further information and the data protection provisions can be found in Google's privacy policy at https://policies.google.com/technologies/ads?hl=en

Personal data may be processed by this provider in third countries outside the European Union, e.g. by subcontractors, may take place. Any transfer by the service provider takes place on the basis of suitable guarantees in accordance with Art. 46 para. 2 GDPR or an adequacy decision in accordance with Art. 45 GDPR.

Microsoft Ads

We use the Microsoft Advertising service of the provider Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18 D18 P521.

Microsoft Advertising is an online marketing service that uses the Universal Event Tracking (UET) tool to help us display targeted advertisements via the Microsoft Bing search engine.

Personal data is processed in the form of online identifiers (including cookie identifiers), IP addresses, device identifiers and information about device and browser settings.

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner.

 Further information on data protection at Microsoft can be found in Microsoft's privacy policy at https://privacy.microsoft.com/

For Microsoft services, the transfer of data to Microsoft Corp. in the USA cannot be ruled out. Personal data may be processed by this provider in third countries outside the EU, e.g. by subcontractors. Any transfer by the service provider is carried out on the basis of suitable guarantees in accordance with Art. 46 para. 2 GDPR or by an adequacy decision in accordance with Art. 45 GDPR.

LinkedIn Insight Tag

This website uses the Insight tag from LinkedIn. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

With the help of the LinkedIn Insight Tag, we receive information about visitors and their interactions on our website. This allows our advertising measures to be analyzed and played out in a targeted manner. In addition, LinkedIn offers the possibility of retargeting via the Insight Tag.

The following personal data is processed for this purpose Log files (URL, referrer URL, IP address, device and browser properties and time of access). The IP addresses are shortened or (if they are used to reach LinkedIn members across devices) hashed (pseudonymized). 

Details can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy#choices-oblig

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time via our cookie banner..

You can object to the analysis of usage behavior and targeted advertising by LinkedIn at the following link: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.linkedin.com/legal/l/dpa  and https://www.linkedin.com/legal/l/eu-sccs

Data Protection Officer

If you have any questions regarding the processing of your personal data, you can contact CGM’s Data Protection Officer, who will be available to answer any requests for information or complaints:

Adrian Breabăn
dpo.buro.gss@cgm.com

Chimiei Boulevard, no. 2 bis
700291 Iasi
Romania

(Status: May 2025)