← Luna360

Privacy Policy

Last updated: 2026-10-25

This policy explains how SYSTHEMA ANALYTICS S.R.L. handles personal data on the Luna360 website (luna360.app) and when you ask us for a demo. It follows the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Romanian law.

Who we are

The controller of the personal data described here is:

SYSTHEMA ANALYTICS S.R.L.
Registered office: str. Dragoș Vodă nr. 2, bl. D5, et. 1, ap. 3, Deva, jud. Hunedoara, România
Tax ID (CUI): 45945560 · Trade Register: J20/524/2022
Email: [email protected] · Phone: +40 770 123 777

For any question about your data, or to use your rights, write to [email protected].

Two different roles

Our website and demo requests. For visitors of luna360.app and people who request a demo, we decide why and how the data is used. We are the controller, and this policy applies.
The Luna360 platform used by lenders. Microfinance institutions and other lenders use Luna360 to manage their own clients and loans. For that data, the lender is the controller and we act only as its processor, on its instructions and under a data processing agreement. If you are a borrower or an applicant of a lender, please contact that lender about your data; we will help them answer you.

What we collect and why

Data	When	Purpose	Legal basis
Name, organisation, email, phone (optional), country (optional), your message	You send the “Request a demo” form	To contact you and organise a demo of Luna360	Your consent (Art. 6(1)(a) GDPR) and steps you asked for before a possible contract (Art. 6(1)(b))
IP address and the time of the request	You send the form	To protect the form against abuse (spam, repeated sending)	Our legitimate interest in keeping the service secure (Art. 6(1)(f))
Technical data: IP address, browser type, pages requested, time	Any visit	To deliver the website, keep it secure and investigate errors	Our legitimate interest (Art. 6(1)(f))
Two technical cookies	Any visit	To keep your session and protect forms. See the Cookie Policy	Strictly necessary, no consent needed (Law 506/2004, art. 4(5))

We do not use analytics, advertising or social media tracking, we do not sell personal data and we do not make automated decisions about you.

How long we keep it

Demo requests: until the demo is no longer relevant, and at most 24 months from the request; they are then deleted automatically. You can ask us to delete them earlier at any time.
Server logs (technical data): up to 14 days.
Encrypted backups: up to 30 days, after which they are overwritten.

Who else processes the data

We only share data with service providers who need it to run the website, under contracts that oblige them to protect it:

Hosting: the website and the platform run on servers of netcup GmbH (Karlsruhe, Germany) in its data centre in Nuremberg, Germany.
Cloudflare, Inc. protects and speeds up the website (it passes on all traffic, including your IP address). Cloudflare may process data outside the EU; such transfers are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
DIGI Romania S.A. (Digi Storage) keeps a second, off-site copy of our backups, encrypted before it leaves our server, in the EU.

We may disclose data to public authorities when the law requires it.

Your rights

You have the right to:

access your data and get a copy;
have it corrected if it is wrong;
have it deleted;
restrict its processing;
receive it in a portable format (portability);
object to processing based on our legitimate interest;
withdraw your consent at any time, without affecting what was done before.

Write to [email protected]. We answer within one month. You also have the right to complain to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru nr. 28-30, București, www.dataprotection.ro, or to the authority of the EU country where you live or work.

Security

Data is sent over encrypted connections (HTTPS). Access is limited to people who need it, with two-factor authentication. Backups are encrypted.

Children

The website is meant for organisations. We do not knowingly collect data about children under 16.

Changes

We may update this policy, for example when we add a service provider. The date at the top shows the latest version.