Version vE1.1
Data Controller: Class RDA Impex SRL · Jurisdiction: RO
VAT / Registration No.: 29867320 · Address: Str. Pridvorului, nr.5, bl.6, Ap.1, Sector 4, București, RO
Version: vE1.1 · Effective from: 23 September 2026
This Privacy Policy describes how Class RDA Impex SRL collects, uses, stores, and protects your personal data within the eTutor application, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.
Please read this document carefully. If you have questions, you may contact our Data Protection Officer (DPO) at dpo@4pro.io.
Class RDA Impex SRL is the controller of the personal data collected through eTutor.
| | |
|---|---|
| Name | Class RDA Impex SRL |
| Registered office | Str. Pridvorului, nr.5, bl.6, Ap.1, Sector 4, București, RO |
| VAT / Reg. No. | 29867320 |
| Jurisdiction | RO |
| DPO | dpo@4pro.io |
Depending on your country of residence or on the application you use, your effective controller may differ. In that case, you will be notified at registration of the entity that controls your data, in accordance with our system's entity routing rules.
We have appointed an internal DPO to ensure GDPR compliance. You may contact the DPO at any time at dpo@4pro.io for:
When creating an account we collect: first and last name, email address, phone number (optional), password (stored in hashed form, never in plain text). If you authenticate via SSO (Single Sign-On) from another application in the 4PRO ecosystem, we receive the session token and the associated profile data.
We collect automatically: access logs (IP address, User-Agent, timestamp), in-app navigation events (pages visited, features used), the preferences set in your account, and the history of actions performed.
Account presence. While an eTutor page is open in the foreground, the app sends a discreet signal once a minute, from which we keep only the moments when the account was on the site (start and end of each visit; a break of more than 30 minutes counts as a new visit) and, at sign-in, the date of the last sign-in. We do not record what you type, where you click or what is on your screen. Only the platform's administration team can see this data — not parents, not teachers, not other users.
If you opt in to notifications via WhatsApp, SMS, or email: WhatsApp/SMS phone number and notification preferences.
Payments are processed by certified third-party providers (Stripe, Revolut Business, etc.). We do not store bank card data. We receive only the transaction confirmation and a subscription identifier.
IP address, browser type, operating system, screen resolution, session data and cookies — as described in the Cookie Policy.
| Purpose | Data categories | Legal basis (GDPR) |
|---|---|---|
| Account creation and management | Identification data | Art. 6(1)(b) — contract performance |
| Providing the core features of eTutor | Usage data, account data | Art. 6(1)(b) — contract performance |
| Sending notifications (push, WhatsApp, email) | Contact data, preferences | Art. 6(1)(a) — consent; or Art. 6(1)(b) for essential account-related notifications |
| Payment processing and subscription management | Transaction data | Art. 6(1)(b) — contract performance |
| Security, fraud and abuse prevention | Technical data, logs | Art. 6(1)(f) — legitimate interests |
| Running the platform: seeing whether and how much accounts are used, so we can support families who stop signing in and size the service | Account presence (visit times, last sign-in) | Art. 6(1)(f) — legitimate interests |
| Product improvement and usage analysis | Usage data (anonymised or pseudonymised) | Art. 6(1)(f) — legitimate interests; or Art. 6(1)(a) — consent, for personalised data |
| Compliance with legal obligations (accounting, audit) | Identification data, transaction data | Art. 6(1)(c) — legal obligation |
| Dispute resolution and defence of our rights | Data relevant to the dispute | Art. 6(1)(f) — legitimate interests |
Our legitimate interests (Art. 6(1)(f)) are assessed through a proportionality (balancing) test and do not override your fundamental rights. You may request a copy of the relevant balancing test by contacting the DPO.
We may share your data with third parties exclusively in the contexts below:
| Processor | Role | Location | Transfer safeguard |
|---|---|---|---|
| Hosting provider (VPS / cloud) | Server infrastructure | EU/EEA | Not applicable (processing within the EEA) |
| Stripe / Revolut Business | Payment processing | EU/EEA and USA | USA: Standard Contractual Clauses, Decision (EU) 2021/914; EU-US Data Privacy Framework where the provider is certified |
| Meta Platforms (WhatsApp Business API) | WhatsApp notifications | USA | Standard Contractual Clauses, Decision (EU) 2021/914; EU-US Data Privacy Framework where Meta is certified |
| AI providers (e.g. Google Gemini, Anthropic, Groq) | Automated processing within the service | EU/EEA and USA | USA: Standard Contractual Clauses, Decision (EU) 2021/914; EU-US Data Privacy Framework where the provider is certified |
| Transactional email service | Sending system emails | EU/EEA and, as applicable, USA | USA: Standard Contractual Clauses, Decision (EU) 2021/914; EU-US Data Privacy Framework where the provider is certified |
All processors are contractually bound to comply with GDPR through Data Processing Agreements (DPAs).
We share data with public authorities exclusively where we are under a legal obligation to do so (e.g. the tax authority ANAF, courts of law), strictly within the limits of the request.
If you use several applications in the 4PRO ecosystem (e.g. 4PRO Client, 4PRO Pro), account data may be shared via the SSO mechanism for unified authentication. Each application operates its own features as a distinct controller.
Where two or more applications jointly determine the purposes and means of a given processing, they act as joint controllers within the meaning of Art. 26 GDPR. In that case, the essence of the arrangement between the joint controllers (the allocation of responsibilities for meeting GDPR obligations, in particular the exercise of your rights, and a single point of contact for exercising those rights) is made available to you, and you may exercise your rights against any of the joint controllers.
We do not sell your personal data.
Your data controller is an entity established in Romania/the EU; there is no international transfer at controller level. However, certain recipients and sub-processors do process data outside the European Economic Area (EEA) — in particular the AI and communications providers listed below. We ensure that these transfers are carried out exclusively on the basis of a valid legal mechanism under Art. 46 GDPR:
For recipients in countries covered by a European Commission adequacy decision, the transfer relies on that adequacy decision. You may request a copy of the applicable safeguards by contacting the DPO at dpo@4pro.io.
| Data category | Retention period |
|---|---|
| Account data (active) | Duration of the active account + 90 days after deletion |
| Access and security logs | 12 months |
| Account presence (visit times, last sign-in) | 12 months from the visit; last sign-in — for the life of the account |
| Transaction and billing data | 10 years (legal obligation — tax law) |
| Communications with the DPO | 5 years (defence of legal rights) |
| Marketing data (with consent) | Until withdrawal of consent |
| Inactive accounts | 24 months of inactivity → notification → 30 days → deletion |
Upon expiry of the retention period, data is permanently deleted or irreversibly anonymised.
Under GDPR, you have the following rights, which you may exercise by contacting dpo@4pro.io:
Right of access (Art. 15): You may request a copy of the personal data we process about you and information about how it is processed.
Right to rectification (Art. 16): You may request the correction of inaccurate data or the completion of incomplete data.
Right to erasure — "the right to be forgotten" (Art. 17): You may request the erasure of your data when: the purpose of processing has ceased, you have withdrawn your consent, you have objected to the processing and there are no overriding legitimate grounds, the processing was unlawful, or there is a legal obligation to erase. Exceptions: data necessary for legal obligations or for the defence of rights in legal proceedings.
Right to restriction of processing (Art. 18): You may request the restriction of processing in certain situations (e.g. where you contest the accuracy of the data).
Right to data portability (Art. 20): You may receive the data you have provided in a structured, commonly used, machine-readable format (JSON/CSV), and transmit it to another controller, where the processing is based on consent or on a contract and is carried out by automated means.
Right to object (Art. 21): You may object at any time to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds which override your rights. You have an unconditional right to object to processing for direct marketing purposes.
Right to withdraw consent (Art. 7(3)): Consent may be withdrawn at any time, as easily as it was given, without affecting the lawfulness of processing carried out beforehand. Withdrawal can be done from Settings → My Account or by contacting the DPO.
Right not to be subject to an automated decision (Art. 22): We do not apply automated decisions producing significant legal effects based solely on automated processing without human involvement. AI recommendations are advisory and produce no legal effects.
Response time: We will respond to your request within 30 calendar days of receipt. This period may be extended by 60 days in complex cases, with prior notice to you.
We implement appropriate technical and organisational measures to protect your data:
We use cookies as described in the Cookie Policy, which forms an integral part of this Privacy Policy.
eTutor is built for pupils, and its core subjects, Grade 8 Mathematics and Romanian, prepare an exam sat at the age of 14. We therefore knowingly process personal data of minors: this is the purpose of the service, not an accident. We say so plainly because the opposite statement, common in privacy policies, would be untrue in our case.
The legal basis depends on age. For pupils under 16, consent is given or authorised by the holder of parental responsibility, in accordance with Article 8 GDPR and Romanian Law no. 190/2018, and the account is opened by the parent; part of the processing is also necessary to perform the contract the parent has entered into for the child's benefit. From the age of 16, the pupil may give consent themselves. Regardless of age, we process a minimum of data to keep the account secure and to meet our legal obligations.
We collect only what a pupil's learning requires: name, e-mail address, chosen subjects, answers to exercises, scores, study sessions, progress and notification preferences. We do not ask for a national identification number, home address, biometric data or health data. We analyse answers in order to adapt exercises to the pupil's level: this is pedagogical personalisation, not an automated decision producing legal effects or similarly significant effects within the meaning of Article 22 GDPR, and the results remain indicative, subject to the judgement of the teacher and the parent. We do not run behavioural advertising towards minors, and we do not sell or otherwise make pupils' data available to third parties for marketing purposes.
The rights described in this policy, namely access, rectification, erasure, restriction, portability, objection and withdrawal of consent, are exercised for pupils under 16 by the parent or legal guardian; on request, we also explain to the child, in terms they can understand, what data we hold about them. Withdrawing consent does not affect the lawfulness of processing carried out beforehand. If you are a parent and find that your child has created an account without your agreement, write to us at dpo@4pro.io: we will look into it and, as you prefer, either give you control of the account or delete the data.
This Policy may be updated periodically. Significant changes will be communicated via an in-app banner and/or email at least 14 days before they take effect. The date of the last update is indicated in the document header.
Continued use of the Service after the changes take effect constitutes acceptance of the new Policy.
If you consider that your data is being processed in breach of GDPR, you have the right to lodge a complaint with the competent supervisory authority:
Romania — ANSPDCP (National Supervisory Authority for Personal Data Processing)
Bd. G-ral. Gheorghe Magheru, nr. 28-30, Sector 1, Bucharest, Postal code 010336
Phone: +40.318.059.211
Email: anspdcp@dataprotection.ro
Web: https://www.dataprotection.ro
You also have the right to contact the supervisory authority of the EU member state where you have your habitual residence, your place of work, or the place of the alleged infringement.
Exercising this right does not affect your right to seek judicial remedies.
Class RDA Impex SRL
Str. Pridvorului, nr.5, bl.6, Ap.1, Sector 4, București, RO
DPO Email: dpo@4pro.io
Version vE1.1 · Effective from 23 September 2026
Access, portability, correction, or deletion of your personal data.