Privacy Policy

Last updated: October 2026

Who we are

TIRO-ALP Advertising S.R.L. (“TIRO-ALP”, “we”, “us”, “our”) provides digital services and software products through tiro-alp.com and affiliated websites and services.

Company: TIRO-ALP Advertising S.R.L.
Registered office: Str. Știrbei Vodă 154, Bl. 26A, Bucharest, Romania
CUI: 41754591
Trade Registry: J40/13646/11.10.2019
Email: contact@tiro-alp.com
Telephone: +40 736 467 888

Scope

This Privacy Policy explains how we process personal data when you visit our websites, contact us, create or use an account, purchase a product or service, use our digital platforms, or otherwise interact with TIRO-ALP.

Certain TIRO-ALP products or affiliated services may also provide a product-specific privacy notice where additional processing activities apply. In such cases, that notice supplements this Privacy Policy for the relevant service.

Personal data we may collect

Contact and enquiry data: name, email address, company, telephone number, selected services, budget, timeline, messages, attachments and other information you voluntarily provide through our contact forms or communications.
Account data: where an account is required, we may process information such as your name, email address, account identifiers, authentication information, account status and information necessary to provide access to the relevant service.
Order and billing data: information necessary to process purchases, maintain order records, issue invoices and provide purchased services. This may include your name, company, billing address, email address, telephone number, VAT or tax information where applicable, products purchased, order value and transaction status.
Payment information: online payments are processed through Stripe. Stripe may process payment and transaction information necessary to authorize, authenticate and complete payments, prevent fraud, and comply with applicable legal obligations. TIRO-ALP does not need to receive or store your complete payment card number when payment information is handled directly by Stripe. We may receive transaction identifiers, payment status, payment method information and other information necessary to associate the payment with your order.
Service usage data: when you use a TIRO-ALP digital product, we may process information necessary to operate that service, such as account activity, service entitlements, usage limits, submitted domains or URLs, scan history, generated reports, timestamps, technical status information and related service records.
Technical and security data: IP address, user agent, timestamps, request metadata, authentication and security events, and other technical information reasonably necessary to operate, protect, troubleshoot and prevent abuse of our systems.
Analytics data: where you have provided the required consent, we may use analytics technologies such as Google Analytics 4 to understand website traffic and usage.
Marketing preferences: where applicable, we may record whether you have requested or consented to receive marketing communications and any subsequent withdrawal of that consent.
Comments and Gravatar: if comments are enabled, information entered in the comment form, together with technical anti-spam information, may be processed. An anonymised hash derived from your email address may be provided to Gravatar where that functionality is enabled.
Uploaded files: where a service allows file uploads, the uploaded content may contain personal data. Users should avoid unnecessarily including sensitive personal information or embedded location information such as EXIF/GPS metadata.

How we use personal data

To respond to enquiries and prepare offers or quotations.
To create and administer customer accounts.
To process orders, payments and invoices.
To provide purchased products, digital services and customer support.
To operate product-specific functionality, including permitted scans, reports and service history where applicable.
To authenticate users and protect accounts and systems against abuse, fraud and unauthorised access.
To diagnose technical problems and maintain the availability and security of our services.
To comply with accounting, tax and other legal obligations.
To establish, exercise or defend legal claims where necessary.
To measure website traffic and usage where the required consent has been provided.
To send marketing communications where we have an appropriate legal basis and, where required, your consent.

Legal bases under the GDPR

Depending on the circumstances, we may process personal data on one or more of the following legal bases:

Contract: processing necessary to take steps at your request before entering into a contract or to perform a contract with you.
Legal obligation: processing necessary to comply with applicable accounting, tax or other legal requirements.
Legitimate interests: where appropriate, processing necessary for operating and securing our services, preventing fraud and abuse, maintaining business records, improving reliability and establishing or defending legal claims, provided those interests are not overridden by your rights and interests.
Consent: where consent is required, including for certain optional analytics technologies or marketing communications. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Orders, WooCommerce and payments

Our website may use WooCommerce or related e-commerce functionality to process orders and maintain purchase records. Information submitted during checkout is processed as necessary to complete the transaction, provide the purchased service, maintain business records and comply with legal obligations.

Online payments are processed through Stripe and payment methods made available through Stripe, where enabled. Stripe processes payment and transaction information according to its own legal obligations and privacy notice. TIRO-ALP does not need to receive or store your complete payment card number when payment information is handled directly by Stripe. We may receive transaction identifiers, payment status, payment method information and payment confirmation necessary to associate the payment with your order and provide the purchased service.

Digital products and technical scans

Some TIRO-ALP products, including technical audit and scanning services, require users to submit a website domain, URL or other technical target. We process this information to perform the requested service, generate results or reports, maintain applicable service history and usage limits, provide support and protect the service against abuse.

Product-specific services may provide additional privacy information describing their particular technical processing, retention periods or service architecture.

Sharing and service providers

We may use service providers that support our hosting, infrastructure, email, website operation, payment processing, analytics, security and other business functions. These providers receive personal data only where necessary for the relevant service and are subject to applicable contractual and legal safeguards.

Depending on the services you use, relevant providers may include website and hosting providers, email providers, Stripe for payment processing, and analytics providers such as Google.

We may also disclose information where required by law, a competent authority or court, or where reasonably necessary to establish, exercise or defend legal claims.

We do not sell personal data.

International data transfers

Some service providers may process personal data outside the European Economic Area. Where GDPR transfer restrictions apply, we rely on an applicable lawful transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, or another mechanism permitted by applicable data protection law.

Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including contractual, security, accounting and legal purposes. Retention periods may differ depending on the service and applicable legal requirements.

Enquiries and lead information: generally up to 24 months, unless a longer period is justified by an ongoing business relationship or legal requirement.
Customer account and service records: for the duration necessary to provide the relevant service and thereafter where reasonably required for security, contractual records, dispute resolution or legal obligations.
Orders, invoices and accounting records: retained for the period required by applicable accounting and tax legislation.
Technical and security logs: retained for a period reasonably necessary for security, diagnostics and abuse prevention, with longer retention where required for investigation of a security incident or legal claim.
Product-specific scan and report records: retention may depend on the relevant product and will be described in the applicable product documentation or privacy notice where necessary.
Analytics information: retained according to the configuration of the relevant analytics service and only where the required consent has been provided.

Your GDPR rights

Subject to the conditions and limitations provided by applicable law, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete personal data;
request erasure of personal data;
request restriction of processing;
object to certain processing based on legitimate interests;
receive certain personal data in a portable format;
withdraw consent at any time where processing is based on consent; and
lodge a complaint with a competent supervisory authority.

Exercising these rights may be subject to applicable legal exceptions, including requirements to retain certain information for accounting, fraud prevention, security or the establishment, exercise or defence of legal claims.

To exercise your rights, contact contact@tiro-alp.com. We may request information reasonably necessary to verify your identity.

You may also lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP): dataprotection.ro.

Automated decision-making

Unless specifically disclosed for a particular service, TIRO-ALP does not use personal data to make solely automated decisions that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR.

Children

TIRO-ALP's business and professional services are not directed to children under 16. We do not knowingly collect personal data from children through these services.

Security

We apply reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. Measures may include access controls, authentication, software updates, backups, HTTPS encryption, security logging and infrastructure protections.

No internet-based system can be guaranteed to be completely secure. We therefore continuously review security measures appropriate to the nature of our services and the risks involved.

Cookies and consent

Our websites may use strictly necessary technologies required for security, checkout, authentication and essential functionality. Optional analytics or similar technologies are used only where the applicable consent requirements have been satisfied.

Where a cookie consent mechanism is available, you may use it to manage or withdraw consent for optional technologies. Withdrawal of consent does not affect processing already carried out lawfully before withdrawal.

Changes to this Privacy Policy

We may update this Privacy Policy when our services, providers, legal requirements or processing activities change. The current version and its effective date will be published on this page.

Contact

For privacy-related questions or requests, contact: contact@tiro-alp.com