Privacy Policy

This privacy policy explains how VIVAJO Invest SRL (“VIVAJO”, “we”, “us”) processes personal data when you visit our website https://vivajo.staging.dg-ag.com/ and when you contact us through it. It applies to this website only.

In short: we do not sell your data, we show no advertising and there are no user accounts. Google Analytics only runs if you allow it in the cookie banner. Messages from the contact form are emailed to us and are not stored in a database.

Last updated: October 2026

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

VIVAJO Invest SRL
Calea Dorobantilor 14-16, Et.2, Office 62, Cluj-Napoca, Romania
Registration number: J12/3782/2008, VAT ID: RO24471552
Email: contact@vivajo.com

For any question about this policy or about your data, write to us atcontact@vivajo.com or by post to the address above.

We have not appointed a data protection officer; please use the contact details above.

What we process and why

Below, each part of the website is described with the data involved, the purpose, the legal basis under Article 6(1) GDPR, who receives the data and how long it is kept.

Where a technology stores information on your device or reads it from there (for example a cookie), Article 4(5) of Romanian Law no. 506/2004 on electronic communications, which implements Article 5(3) of the EU ePrivacy Directive, also applies. This requires your consent unless the storage is strictly necessary for a service you have asked for. For each case we say which applies.

Visiting the website

Our website is hosted on Microsoft Azure in the West Europe region (Netherlands). Each time your browser requests a page or file, our web server automatically writes an entry to its access log.

  • Data: your IP address, the date and time of the request, the address (URL) requested, the page you came from (referrer) and your browser’s user agent, which names your browser and operating system.
  • Purpose: to deliver the website, keep it secure and stable, and investigate errors and attacks.
  • Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).
  • Recipients: Microsoft, as our hosting provider (processor).
  • Retention: 14 days, then the logs are deleted automatically.

Fonts

The fonts Montserrat and Work Sans are loaded from our own content delivery network, cdn-mcgrundriss.azureedge.net, which runs on Microsoft Azure Front Door. It sets no cookies.

  • Data: your IP address, the date and time, the font file requested, the referrer and your browser’s user agent.
  • Purpose: to display our pages in our typefaces and deliver the files quickly.
  • Legal basis: our legitimate interest in a consistent, fast website (Art. 6(1)(f) GDPR).
  • Recipients: Microsoft (processor). Azure Front Door delivers files from the Microsoft server nearest to you, which can be outside the EU (see Transfers outside the EU).
  • Retention: we do not keep access logs for the font delivery network.

Contact form

When you send a message through the form on our contact page, your browser sends it to our website. A server-side function checks the hCaptcha result (see below), validates the fields and sends your message as one plain-text email through the email service Brevo to two VIVAJO staff members who handle enquiries. The email’s reply address is set to your email address so that we can answer you directly. You do not receive a copy, and we do not store the message in a database.

  • Data: the subject you choose, your first and last name, email address, phone number (if you give it), your message and your confirmation that you have read this policy.
  • Purpose: to answer your enquiry and handle any follow-up.
  • Legal basis: where your enquiry concerns a possible contract with us, such as a partnership or a product request, the steps you ask for before entering into a contract (Art. 6(1)(b) GDPR); otherwise our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR). The checkbox in the form confirms that you have read this policy; we do not rely on it as consent.
  • Recipients: Brevo, which delivers the email (processor), and Microsoft, which hosts our website and our email mailboxes (processor).
  • Retention: Brevo keeps a sending log, including a preview of the email content, under its own retention rules (see the Brevo privacy policy). We delete the email from our recipients’ mailboxes 12 months after our last contact with you, unless it leads to a contract or we need it to defend legal claims.
  • Is it required? No. You do not have to use the form, but we need your name, email address and message to reply. Your phone number is optional. You can also write to us directly atcontact@vivajo.com.

Spam protection (hCaptcha)

Our contact page uses hCaptcha, a service of Intuition Machines, Inc. (USA), to tell people apart from automated spam. hCaptcha is used on the contact page only.

  • Data: your IP address, browser type, internet service provider, device type and operating system, the time of access, and how you interact with the page and the check, such as mouse movements, scrolling, key presses and touch events.
  • Purpose: to protect the contact form and our inboxes from spam and abuse.
  • Legal basis: our legitimate interest in a contact form that is not misused (Art. 6(1)(f) GDPR). hCaptcha may set the cookies listed under Cookies and similar technologies. We consider them strictly necessary for using the contact form securely, so we do not ask for consent for them.
  • Recipients: Intuition Machines, Inc. (processor), which receives the data in the USA (seeTransfers outside the EU).
  • Retention: hCaptcha states that its service is designed to work without long-term retention of personal data. Data collected through cookies and similar technologies is discarded as soon as practical, but may be kept for up to one year after the cookie expires, usually in de-identified and aggregated form, and longer where abuse of the service is detected.

Google Analytics (only with your consent)

If you allow it, we use Google Analytics 4 to understand how our website is used, for example which pages are visited and how visitors find us. Google Analytics does not load until you accept “Analytics” in the cookie banner; before that, nothing is sent to Google. We use Google Consent Mode with every consent signal set to “denied” by default. The advertising signals always stay denied, so analytics data is not used for advertising.

  • Data: the random identifiers stored in the Google Analytics cookies, the pages you visit and when, the page you came from, interactions such as scrolling, clicks on links to other websites and file downloads, your browser, device, operating system, screen size and language, and your approximate location (country and city), derived from your IP address. Google states that Google Analytics does not log or store the IP addresses of users in the EU; it uses them only to look up the location and then discards them.
  • Purpose: visitor statistics to improve our website.
  • Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Law no. 506/2004). You can withdraw it at any time (see Changing or withdrawing your consent).
  • Recipients: Google Ireland Limited (processor). Data may be transferred to Google LLC in the USA (seeTransfers outside the EU).
  • Retention: the cookies last 2 years. User- and event-level data in Google Analytics is deleted automatically after 2 months.

Videos on Team Voices (Vimeo)

The videos on our Team Voices page are hosted by Vimeo. The Vimeo player only loads when you click play, and the play button tells you that the video loads from vimeo.com; until then, your browser does not contact Vimeo. We load the player in Vimeo’s “do not track” mode, in which, according to Vimeo, the player does not collect session data or analytics.

  • Data: when you click play, Vimeo receives your IP address, information about your browser and device, the page you are on and the video requested.
  • Purpose: to play the video you asked for.
  • Legal basis: our legitimate interest in introducing our team through video, at your request (Art. 6(1)(f) GDPR). In “do not track” mode, Vimeo only sets the cookies it describes as necessary for the player to work securely (see Cookies and similar technologies). They are needed to deliver the video you asked to play, so we do not ask for separate consent.
  • Recipients: Vimeo.com, Inc. in the USA, which processes this data under its own responsibility (seeTransfers outside the EU).
  • Retention: decided by Vimeo; see theVimeo privacy policy.

3D floor-plan tour on Expertise

Our Expertise page shows a 3D floor-plan tour from tour.grundrisse.de. The tour only loads after you click “Start 3D tour”. In our checks it set no cookies and loaded no third-party trackers.

  • Data: when you start the tour, your IP address, the date and time, the address requested, the referrer and your browser’s user agent are sent to the server of tour.grundrisse.de.
  • Purpose: to show the tour you asked for.
  • Legal basis: our legitimate interest in showing examples of our work (Art. 6(1)(f) GDPR).
  • Recipients: McGrundriss GmbH & Co. KG in Munich, Germany, which runs tour.grundrisse.de and processes this data under its own responsibility (seeits privacy policy).
  • Retention: decided by McGrundriss; seeits privacy policy.

The brand guidelines download is a file on our own server; downloading it is recorded only in the access log described above.

The Facebook and LinkedIn icons in the footer, the LinkedIn links on our pages, the job board buttons on ourCareer page and other links to external websites are plain links. Nothing is sent to those websites until you click a link; from then on, that website’s own privacy policy applies. We do not use social media plugins, tracking pixels or embedded posts.

We do not accept job applications on this website. If you apply through a job board linked from our Career page, the privacy information on that job board applies.

Cookies and similar technologies

Our cookie banner, built with the Silktide Consent Manager, lets you choose which optional categories you allow: Necessary (always on) and Analytics. Optional technologies only run after you allow them.

Your choices are saved in your browser’s local storage, not in a cookie. This information stays on your device and is not sent to us or to Silktide.

Necessary

These do not need consent because they are strictly necessary for a service you use.

  • silktideCookieBanner_InitialChoice (VIVAJO, local storage, kept until you clear your browser’s site data): records that you have made a choice, so the banner is not shown again.
  • silktideCookieChoice_necessary and silktideCookieChoice_analytics (VIVAJO, local storage, kept until you clear your browser’s site data): store your choice for each category.
  • hCaptcha cookies, set by hcaptcha.com on the contact page only: hmt_id (up to 30 days; service statistics and technical purposes such as accessibility support), __cf_bm (up to 1 day; security), INGRESSCOOKIE, __cfduid, __cflb,session and sessionid (up to 30 days; load balancing and routing) andhc_accessibility (up to 30 days; only for people who use hCaptcha’s accessibility option).
  • Vimeo cookies, set by vimeo.com on the Team Voices page only after you click play: player_clearance(7 days; bot protection), cf_clearance (1 year; Cloudflare bot protection),__cf_bm (30 minutes; Cloudflare bot management) and _cfuvid (until you close your browser; Cloudflare rate limiting).

Analytics

These are only set if you accept “Analytics”.

  • _ga (Google Analytics, 2 years): distinguishes visitors.
  • _ga_YZ1K2TZL1D (Google Analytics, 2 years): keeps the state of your visit.

You can change your choice or withdraw your consent at any time with the “Cookie settings” button at the bottom of every page. Withdrawing consent does not affect processing that took place before. If you withdraw your consent to Analytics, Google Analytics stops and the existing _ga cookies are deleted. You can also delete cookies and local storage in your browser settings; the banner then appears again on your next visit.

Service providers

We work with the following providers. Processors handle personal data only on our instructions, under a data processing agreement (Art. 28 GDPR).

  • Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland: website hosting (Azure), content delivery (Azure Front Door) and email (Microsoft 365). Processor.Privacy statement.
  • Brevo SAS, 17 rue Salneuve, 75017 Paris, France: delivery of contact form emails, with data stored in the EU (France, Germany and Belgium). Processor.Privacy policy.
  • Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA: hCaptcha spam protection. Processor.Privacy policy.
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: Google Analytics, only with your consent. Processor. Privacy policy.
  • Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA: video player, only after you click play. Independent controller. Vimeo’s representative in the EU is Bending Spoons S.p.A., Via Nino Bonnet 10, 20154 Milan, Italy. Privacy policy.
  • McGrundriss GmbH & Co. KG, Luise-Ullrich-Straße 14, 80636 Munich, Germany: 3D tour on tour.grundrisse.de, only after you start it. Independent controller.Privacy policy.

Within VIVAJO, contact form messages are read only by the staff members who handle enquiries.

Transfers outside the EU

Our website is hosted in the EU. Some data is transferred to the USA or may be processed outside the European Economic Area (EEA):

  • Google Analytics (only with your consent): to Google LLC in the USA.
  • hCaptcha: to Intuition Machines, Inc. in the USA.
  • Vimeo (only when you play a video): to Vimeo.com, Inc. in the USA.
  • Microsoft: Azure Front Door delivers files from Microsoft servers worldwide, and Microsoft Corporation in the USA may process data, for example for support and security.

The European Commission has decided that the USA ensures an adequate level of protection for companies certified under the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795, Art. 45 GDPR). Google LLC, Intuition Machines, Inc., Vimeo.com, Inc. and Microsoft Corporation are certified; you can check this ondataprivacyframework.gov. Where a provider processes data in another country without an adequacy decision, it uses the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can ask us for more information about these safeguards.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and receive a copy (Art. 15);
  • have inaccurate data corrected or incomplete data completed (Art. 16);
  • have your data erased (Art. 17);
  • have the processing restricted (Art. 18);
  • receive data you gave us on the basis of your consent or a contract in a structured, machine-readable format, or have it sent to another controller (Art. 20);
  • withdraw your consent at any time, with effect for the future (Art. 7(3)), using the “Cookie settings” button at the bottom of every page.

Right to object: where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21). We will then stop, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

To use any of these rights, write to contact@vivajo.com or to our postal address. It is free of charge. We answer within one month; for complex or numerous requests, this can be extended by two further months, and we will tell you if it is. If we cannot tell who is asking, we may ask you for information to confirm your identity.

Right to complain

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live, work or where the alleged infringement took place. The authority responsible for us is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania
anspdcp@dataprotection.ro,www.dataprotection.ro

Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR). hCaptcha automatically checks whether a contact form submission is likely to come from a bot; if the check fails, you can try again or email us directly.

Children

Our website is aimed at business customers, partners and job seekers, not at children. We do not knowingly collect personal data from children.

Changes to this policy

We update this policy when our website, our service providers or the law change. The date at the top of this page shows when it was last updated.