Privacy policy

Last updated: October 2026

This is an English translation provided for convenience. In case of any discrepancy, the Romanian version prevails.

This policy explains what personal data we process, why, how long we keep it and what rights you have over it. It applies to visitors of leadflow.ro, people who write to us or fill in a form, our clients and people contacted in the outbound campaigns we run.

1. Who we are (the data controller)

The data controller is POPIRLAN CAMELIA-FLORENTINA PFA, tax ID (CUI) 55459508, Trade Register no. F2026040906009, registered office at B-dul Bucurestii Noi 136, ground floor, ap. 5, Sector 1, Bucharest, Romania (“Leadflow”, “we”). You can contact us at any time with any question about your data at contact@leadflow.ro.

2. Data we collect through the website and why

a) The form on the home page (B2B Outbound). We collect: name, company and its website, email address, phone (optional), the plan you are interested in and, optionally, a description of your clients. We use them to send you the proposal and to contact you about your request.

b) The form on the Digital agent page. We collect: name, business name, phone number and the plan you are interested in, to contact you about your request.

For both forms, the legal basis is your consent, explicitly ticked in the form, and pre-contractual steps taken at your request.

c) The website chat assistant. On some pages (e.g. the Digital agent page and demo pages) a digital chat assistant is available. If you write to it, we process your messages and the data you choose to provide, to reply and show you how the service works. Please do not share sensitive data through the chat. Legal basis: pre-contractual steps and our legitimate interest in responding to requests.

d) The onboarding form (after you become a client). We collect the information needed to set up the service: contact persons, operational details about the business, operating preferences. Legal basis: performance of the contract between us.

e) Direct communications. If you write to us by email, WhatsApp or LinkedIn, we keep the correspondence in order to reply and to keep a record of the relationship. Legal basis: our legitimate interest in managing communication with you.

f) Automatically collected data. The website does not use tracking cookies and does not run behavioural analytics tools or advertising pixels. Page fonts load from Google Fonts, which may record the IP address when delivering the font. The chat assistant may use technical browser storage strictly for the conversation to work.

3. People contacted in B2B Outbound campaigns

If you received a message on LinkedIn or by email from a campaign run by Leadflow, this section explains where we got your data and what you can do.

What data we process: name, job title, company, industry and country, professional email address, public professional profile (e.g. LinkedIn) and your replies to messages.
Where it comes from: B2B databases accessed through the prospecting platforms we use, public professional profiles and company websites.
Why: to contact you on behalf of our clients, on topics directly related to your professional role.
Legal basis: the legitimate interest (Art. 6(1)(f) GDPR) of our client and of us in developing business relationships. We do not contact personal email addresses.
On whose behalf: the message shows the company on whose behalf you are contacted. For campaigns run for clients, Leadflow processes the data under a contract with that client. If you write to us, we tell you exactly on whose behalf you were contacted.
How to stop being contacted: at any time, through the unsubscribe link in the email, by replying with something like “please do not contact me” or by emailing contact@leadflow.ro. From that moment you are permanently added to the exclusion list, across all channels.

4. Data of our clients’ customers

When a Leadflow digital agent replies to a business’s customers on Instagram, Facebook, WhatsApp or the website, Leadflow processes those conversations on behalf of that business, as a processor. The controller is the business you spoke with, and information about the processing is in its privacy policy.

5. Who we share data with

We do not sell or rent data to anyone. We share it strictly with providers that help us operate the services, acting as processors:

the form processing provider, which forwards submissions to our email;
web hosting and email service providers;
the prospecting, email sending and LinkedIn automation platforms used in campaigns;
the messaging platforms through which you choose to communicate with us or our clients (e.g. Meta, for Instagram, Messenger and WhatsApp);
the client on whose behalf you were contacted, for replies to the campaign, including through their CRM.

Some of these providers may process data outside the European Economic Area. In such cases, the transfer is based on the standard contractual clauses approved by the European Commission or other safeguards recognised by the GDPR.

6. How long we keep data

Form requests that do not become a collaboration: up to 12 months from the last contact, then deleted.
Prospects from outbound campaigns: for the duration of the campaign and up to 12 months from the last contact, then deleted.
Exclusion list: we keep only minimal data (e.g. email address or profile) for as long as needed to honour the request not to be contacted.
Client data: for the duration of the contract plus the period required by tax and accounting law for supporting documents.
Correspondence: up to 3 years from the last interaction.

7. Your rights

Under the GDPR, you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability, to object (including to processing for prospecting purposes, at any time and without justification) and the right to withdraw your consent at any time, without affecting processing carried out before withdrawal.

To exercise any of these rights, write to us at contact@leadflow.ro. We reply within 30 days at most, usually much sooner.

If you believe your rights have been infringed, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro.

8. Data security

We use encrypted connections (HTTPS) across the website, limit access to data to the people who actually need it and work through the official interfaces of the platforms used.

9. Changes to this policy

If we change this policy, we publish the new version on this page, with the update date visible at the top. For significant changes that affect you, we let you know directly.