Privacy Policy

ImpulsX

1. General Provisions

This Privacy Policy governs the processing of personal data carried out by AVALON ASISTENT IN BROKERAJ SRL (hereinafter the "Controller") in its capacity as data controller, via the mobile application ImpulsX (hereinafter the "Application").

The Controller undertakes to comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR) and with Law no. 190/2018 transposing and implementing GDPR provisions.

2. Categories of Personal Data Processed

2.1. Data processed locally

Personal data entered by the user within the Application (including, but not limited to: shopping lists, personal financial goals, usage preferences and configuration parameters) are processed and stored exclusively on the user's terminal device. The Controller does not transmit, store or access these data on its own servers or on third-party servers.

2.2. Usage and analytics data

Pursuant to the Controller's legitimate interest in optimizing the Application, anonymized data are processed via Google Analytics for Firebase, including but not limited to:

Device information (device model, operating system version, device identifiers)
Application usage information (features accessed, usage frequency, session duration)
Technical performance data (error messages, response times, operational parameters)
General geolocation data (country, city — without precise GPS coordinates)

Processing of these data is carried out in an anonymized form and aims solely to improve user experience and optimize the technical parameters of the Application.

3. Purposes and Legal Bases for Processing

Personal data are processed for the following legitimate purposes:

Analyzing aggregate user behavior to improve the interface and features
Identifying, diagnosing and remedying technical defects or malfunctions
Continual improvement of features and overall user experience
Developing new features based on statistical analysis of user behavior
Optimizing technical performance and stability of the Application

The legal bases for processing are: (a) the Controller's legitimate interest to improve the services provided (Art. 6(1)(f) GDPR); and (b) the user's consent (Art. 6(1)(a) GDPR) where applicable.

4. Recipients and Transfers to Third Parties

4.1. Google Analytics for Firebase

The Controller uses services provided by Google LLC (United States) for processing analytics via Google Analytics for Firebase. Google may process the collected data in accordance with its privacy policies available at: https://policies.google.com/privacy

Transfers to Google LLC are carried out on the basis of the European Commission's standard contractual clauses, ensuring an adequate level of protection in accordance with the GDPR.

4.2. Distribution platforms and payment processors

If premium features or paid services are purchased within the Application, payment transactions are processed exclusively by:

Google Play Store (for Android devices)
Apple App Store (for iOS devices)

The Controller does not have access to, collect or store users' financial or payment card data. Payment processing is governed by the privacy policies of the platforms listed below:

Google Play Store: https://policies.google.com/privacy
Apple App Store: https://www.apple.com/legal/privacy/

5. Data Security and Protective Measures

Important note: The Controller does not operate its own server infrastructure and does not store users' personal data on external storage media. Personal data remain stored only on the user's mobile device and are protected by the native security features of the device's operating system.

Users are required to implement appropriate security measures to protect their terminal device, including but not limited to:

Using secure authentication methods (PIN, strong password, biometric authentication)
Keeping the operating system and installed applications up to date with security patches
Avoiding installation of apps from untrusted or unofficial sources
Maintaining regular backups of essential data

6. Disclosure of Data to Third Parties

The Controller undertakes not to sell, rent or disclose users' personal data to third parties for direct marketing or profiling purposes. Exceptions are limited to:

Google Analytics — solely for processing anonymized statistical and analytical data
Payment processing platforms (Google Play Store, Apple App Store) — strictly for payment transaction processing
Public authorities — when there is a legal obligation or a valid lawful request from competent authorities

7. Data Subject Rights

In accordance with Regulation (EU) 2016/679 (GDPR) and applicable national legislation, data subjects have the following rights:

Right of access (Art. 15 GDPR) — the right to obtain confirmation of processing and access to personal data
Right to rectification (Art. 16 GDPR) — the right to obtain correction of inaccurate data or completion of incomplete data, which can be exercised directly through the Application interface
Right to erasure (Art. 17 GDPR) — the right to have data deleted, exercisable by uninstalling the Application from the terminal device
Right to data portability (Art. 20 GDPR) — since data are stored locally, the user retains direct control over portability
Right to object (Art. 21 GDPR) — the right to object to processing, including disabling Google Analytics in the Application settings
Right to lodge a complaint (Art. 77 GDPR) — the right to contact the National Supervisory Authority for Personal Data Processing (ANSPDCP)

8. Processing of Minors' Data

The Application is not intended for use by persons under the age of 16. The Controller does not knowingly collect or process personal data of minors. If personal data of a minor have been processed without parental or guardian consent, please contact the Controller so that appropriate legal measures, including deletion of such data, can be taken.

9. Changes to the Privacy Policy

The Controller reserves the right to amend or update this Privacy Policy in response to legislative changes or evolving processing practices. Users will be informed of significant changes by:

Displaying a notification within the Application interface
Updating the "Last updated" date in this document
Sending an electronic communication if the user has voluntarily provided an email address

Users are advised to check this Privacy Policy periodically to stay informed about how their personal data are protected.

10. Controller Contact Details

To exercise the rights provided by applicable law or to submit requests, questions or complaints regarding this Privacy Policy or the processing of personal data, please contact the Controller at the details below:

AVALON ASISTENT IN BROKERAJ SRL

Email address: avalonasigurari@gmail.com

The Controller will respond to requests within a maximum of 30 calendar days from receipt, in accordance with Art. 12(3) GDPR.

11. User Consent

By installing, accessing and using the ImpulsX Application, the user confirms that they have read and understood this Privacy Policy, that they understand the nature and purposes of the processing, and that they freely, specifically, informedly and unambiguously consent to the processing of their personal data as described herein, in accordance with Art. 4(11) and Art. 7 GDPR.

Last updated: 30 October 2025

Document version: 1.0