Skip to content
en

Privacy policy

How we use and protect personal data.

Last updated: 30 October 2026.

This policy applies to everyone who uses GenieUs (visitors, clients, learners) and complies with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 and Law no. 506/2004 (for cookies).

1. Who we are and how to contact us

The operator of the GenieUs platform is the provider whose identification details (name, tax ID, registered office) appear in the site footer and on the Contact page. For any question about your personal data, write to the email address on the Contact page, with the subject "Personal data".

2. Our role: controller or processor

  • For clients (companies, sole traders, individuals buying the course) and for site visitors, we are the controller.
  • For learners enrolled by an employer, the employer is the controller and we act as processor, under the Data Processing Agreement (DPA) accepted by the employer when creating the account. Your employer can give you more information about the processing.
  • For individuals who pay for the course themselves, we are also the controller of their learner data.

For learners enrolled by an employer, the processing is not based on consent: in an employment relationship consent cannot be considered freely given, so the legal basis is the legal obligation and the contract (see section 4). On their first login to the app, every learner reads a summary of this policy and confirms they have understood it; the confirmation is kept in the consent register.

3. What data we process

Site visitors: the data sent through the Request a quote, Book a demo and Contact forms (name, company, email, phone, message, the day and time slot chosen for the demo), the IP address and technical browser data in the server logs.

Clients and client account users: name, email, phone, role (legal representative or contact person), company details (name, tax ID, trade register number, registered office, VAT status, also retrieved from the public ANAF register), for individual clients the personal numeric code (CNP) and home address, which appear on the invoice, documents uploaded for account verification (registration certificate, identity document), orders, invoices and payments, security settings (2FA, passkeys), the consents given and the activity log.

Learners: name, email and/or phone (for login), preferred language, optionally identity document data (personal numeric code, passport, date of birth), employer and workplace, study time (sessions, hours per week), progress, answers to exercises and tests, certificates issued, IP address and device used in study sessions, the confirmation that they have read this policy. Only when you use the "Speak" exercise: the recording of your voice, to check pronunciation (we do not keep it). Only if you turn them on: your phone's subscription to notifications.

Support messages (sent from the client account under "Support" or from the app under "Help"): the message text, attached photos or files, the name and account role of the sender, the date and time.

Sensitive data (personal numeric code, passport, phone, date of birth, PIN) is stored encrypted.

4. Why we process data and on what legal basis

Purpose Legal basis (Art. 6 GDPR)
Creating and managing the account, providing the course, support performance of a contract — Art. 6(1)(b)
Measuring study hours and issuing the documents required by GEO 32/2026 (hours statement, certificate) legal obligation — (c) and, for the employer, performance of a contract
Invoicing, payments, accounting records legal obligation — (c)
Verifying clients before purchase, preventing fraud and fake accounts legitimate interest — (f)
Platform security: two-step authentication, access and audit logs, backups legitimate interest — (f) and Art. 32 GDPR
Answering quote requests and messages steps at your request before a contract — (b)
Scheduling and holding online demos (Zoom or Teams) steps at your request before a contract — (b)
The GenieUs newsletter consent — (a), optional, withdrawable at any time from your profile or from the unsubscribe link in every email
Pronunciation check (the "Speak" exercise) performance of a contract — (b)
Phone notifications consent — (a), given in the browser; you can turn them off at any time from your profile or your phone settings
Answering support tickets and notifying you of the answer (email, phone notification if enabled) performance of a contract — (b)
Automatic translation of a support message, only when you press "Translate" performance of a contract — (b)
Statistics about how the site is used (Google Analytics), only if enabled consent — (a), from the cookie banner, withdrawable at any time from "Cookie settings"

We do not take decisions based solely on automated processing that produce legal effects concerning you. The status of study weeks is calculated automatically according to the contract rule, but can be checked and corrected by our team.

5. Who we share data with

Data is not sold and not used for advertising. We only share it with:

  • the employer (for learners they enrolled): progress, study hours, attendance documents;

  • providers that help us operate (processors, under contract): server hosting and email delivery (Heart Internet Ltd, United Kingdom), the Netopia payment processor and the SmartBill invoicing service (once online payments are enabled), off-site storage of encrypted backups (when used);

  • Cloudflare, through which the site's traffic passes, for protection against attacks and for speed: IP address and technical browser data;

  • Cloudflare (Turnstile), if the "I am not a robot" check is enabled at registration: IP address and technical browser data;

  • authorities, when the law requires it (for example, the tax authority or labour inspectorates).

  • Google Cloud Speech-to-Text, only when you use the "Speak" exercise: the recording of your voice, to check pronunciation. We do not keep the recording and it is not used for any other purpose;

  • the browser's notification services (Google, Apple, Mozilla, depending on your phone), only if you turn notifications on: the technical subscription address and the text of the notification;

  • Google Analytics, only with your consent to statistics cookies (see the Cookies page);

  • translation of support messages, only when you press "Translate": if your browser has built-in translation (for example, Chrome), the message is translated on your device and is not sent anywhere; otherwise the message text is sent to the free translation service MyMemory (Translated S.r.l., Italy), which returns the translation. If you choose the "Google Translate" link, the text opens on the Google Translate page. Unless you press "Translate", messages are not sent to any translation service;

  • WhatsApp (Meta), only if you choose to message us on WhatsApp from the client account;

  • Zoom (Zoom Communications, USA) or Microsoft Teams (Microsoft), only if you join an online demo: the name and email you use to join the meeting, under the rules of the chosen platform.

For lesson texts we use speech synthesis (Google Cloud) and machine translation (Anthropic, Google). We send them only lesson and interface content, never data about learners or clients.

5.1. Your data stays with us

  • We do not sell, rent or give your data to anyone for advertising or marketing.
  • Data is kept in our database, on our server hosted in the United Kingdom (a country recognised by the European Commission as providing a level of data protection equivalent to the EU), and in backups encrypted with a key that only we hold.
  • The providers above receive only the data strictly needed for their service, process it only on our instructions and cannot use it for their own purposes (processing agreement, Art. 28 GDPR).
  • An employer only sees the data of the learners they enrolled; one client's data is never visible to other clients.
  • At the end of the retention period (section 7), data is deleted or irreversibly anonymised.

6. Transfers outside the European Economic Area

The platform's server is hosted in the United Kingdom, under the European Commission's adequacy decision for the United Kingdom. Some providers (for example, Cloudflare and Google) may process data outside the European Economic Area; in such cases the transfer relies on a European Commission adequacy decision (including the EU–US Data Privacy Framework) or on standard contractual clauses.

7. How long we keep data

  • Learner data: for the duration of the programme and then 60 months after it ends, as proof of the study hours required by law; afterwards it is anonymised.
  • Quote requests, demo requests and contact messages: 24 months.
  • A company's support messages: for as long as the company account exists; a learner's support messages: deleted, together with their attachments, when the learner's data is anonymised.
  • Technical logs (access, errors): 365 days.
  • Accounting documents (invoices, payments): as long as financial and accounting law requires.
  • Client account data: for the duration of the contract and afterwards as long as needed to defend legal claims or as required by law.
  • Consents (terms, privacy, DPA, newsletter): while the account exists and then for the limitation period, as evidence.
  • Backups rotate every 7 days.

The periods can be adjusted in the platform settings; any change is reflected in this policy.

8. How we protect data

Encrypted connection (HTTPS), encryption of sensitive data in the database, mandatory two-step authentication for our team and for clients, strict separation of data between client accounts, a tamper-proof audit log, encrypted backups, role- and permission-based access.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, to object (including to processing based on legitimate interest) and to withdraw consent at any time (for example, for the newsletter, from your profile or from the unsubscribe link in the email), without affecting the lawfulness of processing before the withdrawal.

Learners can download their data directly from the app. If you were enrolled by an employer, requests can also be addressed to them, as controller.

We answer within one month of receiving the request (extendable by two further months for complex requests, in which case we inform you).

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, sector 1, Bucharest, www.dataprotection.ro.

10. Cookies

We use strictly necessary cookies and, only with your consent, statistics cookies (Google Analytics). We do not use advertising cookies. The full list, durations and settings are on the Cookies page; you can change your consent at any time from "Cookie settings" in the site footer.

11. Minors

The platform is not intended for persons under 16.

12. Changes to this policy

Every significant change is published as a new version. Client account users accept it at their next login, learners confirm it the next time they open the app, and the accepted version is kept in the consent register (with the date, version, IP address and browser).