This English version is provided for convenience. In case of discrepancy, the French version prevails.
CONTENTS
- 1. Who is the controller
- 2. Two situations to distinguish
- 3. What we process, and why
- 4. We do not sell your data
- 5. Our service providers
- 6. What the plugin sends to our servers
- 7. Transfers outside the European Union
- 8. Your rights
- 9. Security
- 10. Your members’ data stays with you
- 11. Cookies
- 12. Minors
- 13. Complaints
- 14. Changes
- 15. Contact
This policy explains which personal data we process, why, for how long, and what your rights are. It applies to the fcpulse.pro website, to the store and customer area operated on sdravobiz.com, and to the FC Pulse WordPress plugin.
It is drawn up pursuant to Regulation (EU) 2016/679 (“GDPR”), Legea nr. 190/2018 and Legea nr. 506/2004.
1. Who is the controller
Sdravobiz S.R.L.
Strada Trandafirilor 51, 307220 Giroc, Romania
CUI: RO51472367, EU VAT number: RO51472369
Registrul Comerțului: J2025016522009
Email: contact@sdravobiz.com
Sdravobiz is not required to appoint a data protection officer within the meaning of Article 37 of the GDPR: its activity involves neither large-scale processing of sensitive data nor large-scale systematic monitoring of individuals.
Any request may be sent to contact@sdravobiz.com, with “GDPR” in the subject line.
2. Two situations to distinguish
This is the most important point of this policy, and it is also the main difference between FC Pulse and an online service.
Your own data, as a customer or visitor of our website. We are the controller for this data: account, order, invoice, license, support, newsletter. This is covered by articles 3 to 9.
The data of your community’s members. It is stored in the database of your WordPress site, on your hosting. It does not pass through any of our servers, is never sent to us and is not accessible to us. You alone are the controller for this data, and we are neither a controller nor a processor. This is covered by article 10.
3. What we process, and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Orders, licensing and invoicing: account creation, performance of the contract, invoices, accounting obligations | Last name, first name, company, address, email, VAT number, order and invoice history, license key | Performance of the contract (Art. 6.1.b) and legal obligation (Art. 6.1.c) | Term of the contract, then 10 years under Legea nr. 82/1991 |
| Activation management: checking license validity, counting sites, distributing updates | License key, address of activated sites, product identifier, installed version, activation and check dates | Performance of the contract (Art. 6.1.b); legitimate interest in protection against unauthorized use (Art. 6.1.f) | Term of the license, then 3 years |
| Payments: collection, fraud prevention, disputes and refunds | Billing details, transaction history and identifiers | Performance of the contract (Art. 6.1.b); legitimate interest in fraud prevention (Art. 6.1.f) | 10 years (accounting obligations) |
| Service emails: confirmation, invoice, license key, update availability, renewal date, security incident | Name, email, account identifier | Performance of the contract (Art. 6.1.b) | Term of the contract, then statutory archiving |
| Support and customer relations | Name, email, content of exchanges, screenshots and environment reports you send us | Performance of the contract (Art. 6.1.b); legitimate interest for prospects (Art. 6.1.f) | 3 years after the last exchange (customers); 13 months (prospects) |
| FC Pulse community: access to the mutual help space, posts and replies | Display name, email, content of published messages | Performance of the contract (Art. 6.1.b); consent for publication (Art. 6.1.a) | Duration of participation, then 12 months |
| Newsletter and product information | Name, email, language, opens and clicks | Consent (Art. 6.1.a); legitimate interest for customers regarding a similar product | Until consent is withdrawn, and at the latest 3 years after the last interaction |
| Website audience measurement | Anonymized IP address, pages viewed, duration, traffic source, device and browser | Consent (Art. 6.1.a) for non-essential cookies; legitimate interest for anonymized measurement | 14 months |
| Legal obligations and litigation | Invoices, supporting documents, connection data | Legal obligation (Art. 6.1.c); legitimate interest in legal defense | Applicable statutory period |
We do not make any decision based solely on automated processing that produces legal effects concerning you, and we do not carry out advertising profiling.
4. We do not sell your data
Sdravobiz does not sell, rent or transfer your personal data to third parties for commercial purposes.
Your data is disclosed only to the service providers listed in article 5, to the competent administrative or judicial authorities upon lawful request, and to our advisers in the event of legal proceedings.
5. Our service providers
We use processors within the meaning of Article 28 of the GDPR, selected for the guarantees they provide. This list may change.
| Provider | Role | Location | Transfer safeguards |
|---|---|---|---|
| Stripe Payments Europe, Ltd | Online payment, fraud prevention | Ireland (EU), servers in the United States for the group | Standard contractual clauses + EU-US Data Privacy Framework |
| o2switch | Hosting of the website, store, customer area and license server | France (EU) | No transfer outside the EU |
| Store, licensing and customer area (self-hosted) | Orders, subscriptions, license keys, activations, invoices | France (EU) | Not applicable, self-hosted |
| Contact and email management (self-hosted) | Service emails, newsletter | France (EU) | Not applicable, self-hosted |
| Support and community (self-hosted) | Support tickets, mutual help space between users | France (EU) | Not applicable, self-hosted |
| Google Ireland Ltd (Analytics, Search Console) | Audience measurement and search performance tracking | Ireland (EU), servers in the United States | Standard contractual clauses + EU-US Data Privacy Framework |
| Chartered accountant and legal advisers | Accounting and legal obligations | Romania | Service agreement, confidentiality clause |
None of these providers has access to the data you collect with the plugin on your own site.
6. What the plugin sends to our servers
The plugin installed on your site communicates with our license server in three situations: when you activate a key, when you deactivate it, and during periodic checks or update checks.
On each of these occasions, and only on these occasions, your site sends exactly the following items:
- the product identifier;
- your license key;
- your site’s address;
- the version number of the installed plugin;
- a single-use random value, intended to prevent the response from being replayed.
And nothing else. In particular, the following are never sent: your members’ data, their email addresses, their posts, their messages, their IP addresses, your statistics, your settings, your site’s content, your administrator email address, your PHP or WordPress version, the list of your plugins.
The plugin contains no telemetry, no usage statistics reporting and no installation reporting. The diagnostics screen displays a description of your technical environment: this description stays on your site and is sent only if you copy it yourself into a message to support.
Notifications and exchanges with the services you connect to the plugin go from your server to the destinations you have chosen yourself. They do not pass through any of the publisher’s servers.
7. Transfers outside the European Union
Our customer data is hosted in the European Union. The only transfers that may take place outside the European Economic Area concern our payment provider and our audience measurement tools, whose groups have infrastructure in the United States.
These transfers are governed by the safeguards of Chapter V of the GDPR: an adequacy decision where one exists (in particular the EU-US Data Privacy Framework) and standard contractual clauses adopted by the European Commission. A copy of these safeguards can be obtained on request from contact@sdravobiz.com.
The data you collect with the plugin is not subject to any transfer on our part, since it never reaches us.
8. Your rights
You have the following rights (Articles 15 to 22 of the GDPR):
- access: find out whether we process data concerning you and obtain a copy of it;
- rectification: have inaccurate or incomplete data corrected;
- erasure: have it deleted, within the limits of our statutory retention obligations;
- restriction: temporarily restrict processing;
- portability: receive your data in a structured, machine-readable format;
- objection: object to processing based on legitimate interest, and unconditionally to direct marketing;
- withdrawal of consent at any time, without affecting the lawfulness of prior processing;
- post-mortem instructions regarding what happens to your data;
- complaint to a supervisory authority (article 13).
How to exercise them. By email to contact@sdravobiz.com (subject “GDPR”) or by post to our registered office. To prevent any fraudulent disclosure, we may ask for proof of identity. We reply within one (1) month, which may be extended by two months depending on the complexity or number of requests (Article 12.3 of the GDPR).
If you are a member of a community that uses FC Pulse and wish to exercise your rights over that information, please contact the publisher of that community directly: it alone is the controller, and it alone holds that data. We have no access to it and therefore can neither provide it to you nor erase it.
9. Security
We implement the appropriate technical and organizational measures provided for by Article 32 of the GDPR, in particular: encrypted connections (HTTPS/TLS), payments processed by a PCI-DSS Level 1 certified provider, strict access control and strong authentication for administrator accounts, access logging, regular backups, continuous security updates, and contractual confidentiality commitments with our processors.
The update packages served by our server are sealed and cryptographically signed, and their signature is verified by your site before installation.
No system can guarantee absolute security. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the ANSPDCP within seventy-two (72) hours and inform you directly when the risk is high (Articles 33 and 34 of the GDPR).
10. Your members’ data stays with you
This article is addressed to you, the customer, regarding the members of your community who use the app.
10.1 You alone are the controller
Your community’s data is stored in your own WordPress database, on your hosting, by Fluent Community and by the plugin. We do not receive it, host it or view it, and we cannot restore it.
You alone determine the purposes and means of the processing. It is up to you to inform your members, define your legal bases and retention periods, publish your own privacy policy and respond to their requests.
10.2 What the plugin stores on your site
The app displays the data that Fluent Community already manages: profiles, spaces, posts, comments, messages and courses. The plugin adds the following to your WordPress database:
- the history of notifications sent and their statistics;
- the unique certificate number of a member for each completed course, kept in their WordPress profile;
- your app settings: theme, menus, blocks and texts.
10.3 What is up to you
- Describe in your privacy policy your community’s data, its purposes, its legal bases and its retention periods.
- Check that the notifications you send comply with the applicable rules.
- Check what the services you connect to the plugin, such as a Maymoune app or an advertising plugin, do with your members’ data.
10.4 The only case in which we see your data
If, as part of support, you send us a screenshot, an export or access to your site, we may be exposed to your members’ data. In that case we act as a processor, on your instructions and solely for the purposes of support.
We recommend that you anonymize your screenshots before sending them to us.
11. Cookies
11.1 On our website
| Category | Tool | Purpose | Duration | Legal basis |
|---|---|---|---|---|
| Strictly necessary | WordPress session (wordpress_*) | Customer area authentication, security | Session / 30 days | Legitimate interest, no consent required |
| Strictly necessary | Cart and order | Keep the current order | Session | Legitimate interest, no consent required |
| Strictly necessary | Language preference (pll_language) | Display language | 12 months | Legitimate interest, no consent required |
| Audience measurement | Google Analytics (_ga, _ga_*) | Anonymized statistics | 13 months | Consent |
| Functional / marketing | Email tracking (fcrm_*) | Opens and clicks on our emails | 12 months | Consent |
On your first visit, a banner lets you accept, refuse or customize cookies that are not strictly necessary. You can change your preferences at any time via the “Manage my cookies” link at the bottom of each page. Refusing non-essential cookies does not prevent you from accessing the website or viewing its content.
11.2 What the plugin places on your members’ devices
On our customers’ sites, the plugin places the following item in members’ browsers. It is set by your site, under your domain name. Member login relies on the standard WordPress cookies.
| Name | Type | Purpose | Duration |
|---|---|---|---|
apcm_classic | Session cookie | Remember that a member has chosen the classic version of the site instead of the app | Until the browser is closed |
This item is used for the operation of the app. It is not used for any audience measurement or advertising.
12. Minors
Our website and our product are not intended for minors under sixteen (16) years of age. We do not knowingly collect their data without the consent of the holder of parental responsibility (Article 8 of the GDPR). If we discover such data, we delete it without delay.
If your community is aimed at minors, it is up to you, as the controller, to implement the required age verification and parental consent measures.
13. Complaints
If you believe that the processing of your data does not comply with the rules, you can lodge a complaint with the Romanian supervisory authority:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București, 010336, Romania
https://www.dataprotection.ro, anspdcp@dataprotection.ro, +40 318 059 211
If you reside in another Member State, you can also contact your national authority (CNIL in France, AEPD in Spain, Garante in Italy, CNPD in Portugal, BfDI in Germany, etc.).
14. Changes
We may amend this policy to reflect legal, regulatory, technical or contractual developments. The applicable version is the one published on the date you consult it. In the event of a substantial change, we will inform you via a banner on the website or by email if you are a customer.
15. Contact
Sdravobiz S.R.L.
Strada Trandafirilor 51
307220 Giroc, Romania
contact@sdravobiz.com (legal and GDPR), contact@sdravobiz.com (service and support)
https://fcpulse.pro
Last updated: 5 October 2026