Your GDPR Rights

This page is a practical guide: it shows you what rights you have over your personal data and, above all, how to exercise them in concrete terms in Arvis Loft. It complements the Privacy Policy, which describes in detail what data we process and why. The two documents are consistent with each other.

1. Who is responsible for your data

The controller of your personal data is COMEXIM ELECTRONIX SRL (office: Suceava, Str. Tineretului nr. 2, bl. 33, sc. A, ap. 4, Suceava County; VAT/Tax ID (CUI) RO41380985; Trade Register J2019001287330).

The data protection contact person is available at privacy@arvis.ro.

2. Your rights, in brief

Under the GDPR, you have the following nine rights:

1. The right to be informed (Art. 13-14): to know what data we process and why. This is explained in the Privacy Policy.
2. The right of access (Art. 15): to receive a copy of your data.
3. The right to rectification (Art. 16): to correct inaccurate or incomplete data.
4. The right to erasure / "the right to be forgotten" (Art. 17): to ask for your data to be deleted, except for the data we must keep due to a legal obligation.
5. The right to restriction of processing (Art. 18): to ask for the processing to be temporarily limited in certain situations.
6. The right to portability (Art. 20): to receive your data in a structured, commonly used and machine-readable format.
7. The right to object (Art. 21): to object to processing based on our legitimate interest.
8. The right not to be subject to an automated decision / profiling (Art. 22): in Arvis Loft we do not make automated decisions with legal effects and we do not carry out profiling. Plan limits - for example how many birds fit on the free plan - are not decisions about you: they are the same for everyone and written into the Terms. If we ever do make such a decision, or if you are affected by one made automatically by one of our suppliers (for example a payment declined by Stripe's fraud checks), you have the right to contest it, to ask for a human from our team to intervene, and to state your point of view before the decision stands. Write to us at office@arvis.ro with the subject "Automated decision appeal"; we reply within 30 days at the latest.
9. The right to lodge a complaint (Art. 77): with the supervisory authority (see section 5).

In addition, you can withdraw your consent at any time, where processing is based on consent (for example PostHog analytics or the OCR scanning feature), without this affecting processing carried out before the withdrawal.

3. How to exercise your rights

You have two ways, depending on what you want to do:

Directly in the app (where the feature exists):

• You can edit your profile and account data at any time in Settings.
• You can manage your consent for cookies / analytics in Settings → Privacy or from the cookie banner.
• You can download all your data from Settings → Privacy, as a JSON file (Art. 20).
• You can delete your account from Settings → Privacy. Deletion is scheduled rather than immediate: a grace period follows, during which the account keeps working and you can cancel with one click. When it expires, your data is deleted permanently, including the files you uploaded.

Through a request to us:

• Write to privacy@arvis.ro for any right: access, a copy of your data / export, rectification, erasure, restriction, objection or withdrawal of consent.
• We respond within at most 30 days of receiving the request (Art. 12 GDPR). If a request is complex, we may notify you of a reasonable extension.
• For export, the fastest route is the in-app download (Settings → Privacy). If you prefer, we will prepare the data and make it available to you in a common format.

Requests are generally free of charge. For manifestly unfounded or excessive requests (for example repeated ones), the law allows us to charge a reasonable cost or to refuse the request.

The right to object, in concrete terms. Where we process on the basis of legitimate interest (security, audit, fraud prevention, service improvement), you can object by writing to privacy@arvis.ro. We assess the request and stop the processing, unless we demonstrate compelling legitimate grounds that override your interests. On request we send you a summary of the balancing assessment between our interest and your rights.

If you are a professional user. When you enter data about other people into the app in the course of your professional activity, you are the controller of that data and we are the processor. Data subject requests go to you, not to us; if they come to us directly, we point them to you and let you know. The full rules are in the Data Processing Agreement (DPA).

4. The legal bases, in brief

5. Complaint to the supervisory authority

If you consider that we process your data incorrectly, you may contact the supervisory authority:

ANSPDCP (the Romanian Data Protection Authority): Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest anspdcp.ro / dataprotection.ro

It would help us if you contacted us first at privacy@arvis.ro, so that we can try to resolve things quickly.

6. Who we share your data with

We work with a small number of sub-processors, each with a clear role. Most of them operate in the EU; a single transfer may take place in the USA (Anthropic), only if you use the optional pedigree scanning feature, on the basis of the Standard Contractual Clauses (SCCs).

Full details about each category of data, retention and transfers can be found in the Privacy Policy.

Questions about your data? Write to us at privacy@arvis.ro or on WhatsApp at +40 741 250 134.