Privacy Notice — Avencyx Academy programs
This notice explains what data we process when you apply to an Avencyx Academy program, attend it, receive a certificate or ask us to notify you about future editions; why we process it; how long we keep it; and what your rights are. It is drafted in accordance with Article 13 of Regulation (EU) 2016/679 (GDPR) and supplements the privacy policy of avencyx.com.
Version: 1.0 · Updated on: 11 October 2026 · This English text is a courtesy translation of the Romanian „Notă de informare privind prelucrarea datelor"; in case of divergence, the Romanian text prevails.
1. The controller
TOP CYBER TECH S.R.L. (Avencyx), registered office at Intrarea Constantin Simionescu 19, Sector 1, Bucuresti, Romania, 012255, Trade Register no. J40/14086/2020, tax ID RO43233123. We have appointed a data protection officer, whom you can contact at gdpr@avencyx.com with any question or request about your data.
2. What data we process and where it comes from
All data comes directly from you or from the organization enrolling you, except data we generate during the program (assessment result, certificate number).
| Category | Examples | When |
|---|---|---|
| Identification and contact | First and last name, email, phone | Application |
| Professional | Profession/role, organization, types of activities or devices and services used, stated learning objectives | Application |
| Preferences and needs | Preferred edition, dietary restrictions, access or material-adaptation needs (only if you tell us) | Application, preparation |
| Invoicing and payment | Invoicing details of the natural or legal person, confirmation of payment by bank transfer | Confirmation, payment |
| Attendance and assessment | Attendance, the work produced (dossier, plan), assessment result, feedback, appeals | During and after the course |
| Certificate | Certificate number, program, date, result | Issuance |
| Communications | Correspondence with us, including complaints | Throughout |
| Feedback | Answers to the end-of-course questionnaire — anonymous; we do not link them to you | End of course |
We do not collect special categories of data. Information about dietary restrictions or access needs may indirectly reveal health data; we process it only because you give it to us for this purpose, use it exclusively to organize the course, and delete it after the edition.
We do not ask for and do not want to receive data about your clients, patients or sources. The exercises use synthetic data.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Assessing the application and communicating the answer | (b) — steps at your request prior to entering into a contract |
| Organizing and delivering the course, materials, assessment, certificate, appeals | (b) — performance of the contract |
| Invoicing, collection, accounting, archiving | (c) — legal obligations under tax and accounting law |
| Adapting examples and checklists to your profession | (b) — performance of the contract |
| Confirming the authenticity of a certificate at the request of a third party who provides its number | (f) — your and our legitimate interest in certificates being verifiable; we confirm only that the number corresponds to a valid certificate, the program and the date, nothing else |
| Handling complaints; establishing, exercising or defending legal claims | (f) — legitimate interest |
| Security of our systems and prevention of abuse | (f) — legitimate interest |
| "Notify me" about future editions | (a) — consent; one email per announced edition; withdraw at any time via the link in the email |
| Using your name, image or organization in promotional material or as a testimonial | (a) — separate written consent, requested after the course; not a condition of participation |
| Informing former participants about updates to the materials during the 12-month access period | (b) — part of the contracted service |
We do not make decisions based solely on automated processing and we do not profile. Applications are read and decided by a person.
4. Who receives the data
Data is accessible to Avencyx staff involved in organizing the programs and to the trainers, on a need-to-know basis. We pass it to the following categories of recipients, who process it on our behalf or as independent controllers:
| Recipient | Role | What they receive |
|---|---|---|
| Email, cloud storage and productivity services provider | Processor | The application (received by email), correspondence, the enrollment records, materials, participants' work |
| The bank | Independent controller | Payment-order data, on receipt of the bank transfer |
| Accounting services provider | Processor | Invoicing data |
| Course venue | Independent controller, if it requires an access list | First and last name, only where needed for access |
| The organization that enrolled you and paid | Independent controller | Confirmation of attendance and of the assessment result (pass/fail); not the work or the detailed feedback, unless you agree otherwise |
| Public authorities | Independent controller | Only on a lawful request |
Some of these providers may process data outside the European Economic Area; in that case we ensure the transfer relies on an adequacy decision or on the standard contractual clauses adopted by the European Commission, with supplementary measures where needed; you may request a copy of the safeguards and the current list of providers at gdpr@avencyx.com.
We do not enter your data into external artificial intelligence services to assess your application or your work.
5. How long we keep the data
| Data | Period |
|---|---|
| Applications not followed by participation (declined, withdrawn, unpaid) | 24 months after the end of the edition applied for, so that we can answer questions and honor a possible postponement; then deletion |
| Attendance data, work, individual feedback | 24 months after the end of the edition (the materials access period plus the appeal and resubmission window); then deletion or anonymization |
| Certificate register (name, program, date, number, result) | 10 years from issuance, so that we can confirm the authenticity of certificates |
| Invoicing and payment documents | 5 years, counted from 1 July of the year following the end of the financial year in which they were drawn up (Romanian Accounting Law no. 82/1991, Art. 25) |
| Correspondence and complaints | 3 years from closure of the case, for the defense of legal claims |
| Dietary restrictions, access needs | Deleted at the end of the edition |
| "Notify me" | Until consent is withdrawn or until the announcement you subscribed to is sent; at most 24 months |
| Consent for promotional use | For as long as the material is used and 3 years afterwards, as proof |
6. Your rights
You have the right of access to your data, to rectification, to erasure, to restriction of processing, to data portability (for data processed on the basis of a contract or consent), the right to object to processing based on legitimate interest, and the right to withdraw your consent at any time, without affecting earlier processing. You exercise them by writing to gdpr@avencyx.com; we reply within one month, which may be extended by two months in complex cases, with notice to you.
You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, Bucharest, www.dataprotection.ro, or to bring the matter before the courts.
7. Do you have to give us your data?
The data marked as required in the form (and transmitted in the application email) is needed to assess the application and conclude the contract; without it we cannot process your enrollment. Phone, organization, dietary restrictions and access needs are optional. Consent for "Notify me" and for promotional use is always optional and does not affect participation.
8. Changes
We update this notice when the processing changes. The current version and its date appear at the top; significant changes are communicated to active participants by email.