Privacy Notice – Website and Business Contacts

Last updated: 5 November 2026

1. Data Controller

DCS Fast Link SRL (brand: dcs plus), with registered office at Bulevardul Nicolae Titulescu bl. 2, et. 3, ap. 7, Slatina, Olt County, Romania, Trade Register no. J28/303/2002, fiscal code 14849015, with a secondary place of business at 206-218 Calea Șerban Vodă, U-Center 1, 4th Floor, 4th District, 040215, Bucharest, Romania (“dcs plus”, the “Company”), is the Controller of the personal data described in this notice.

You can reach our Data Protection Officer (DPO) for any question or request regarding your personal data at dpo@dcsplus.net.


2. Who This Notice Covers

This notice applies to:

  • visitors of our website dcsplus.net, including people who submit our contact or request-a-demo forms or use the developers portal;
  • business contacts: employees and representatives of our clients, suppliers, and business partners whose professional contact details we process in the course of the business relationship;
  • prospects: professionals we contact for business-to-business marketing and sales purposes, whose data we may obtain from sources other than themselves (see section 4).

This notice does not cover job candidates (see PN-01 Candidate Privacy Notice), employees (see PN-02 Employee Privacy Notice), or traveller data processed in dcs plus products. Product instances are operated by our customers, who act as controllers of their travellers' data; where dcs plus accesses such data to provide support, it does so as a processor on the customer's documented instructions.


3. Personal Data We Process

Data you provide directly (Art. 13 GDPR): first and last name, company, role, business email address, business phone number, the content of your message or request, event or webinar registration details.

Technical data collected when you visit our website: IP address, browser and device information, and cookie data, as described in the website cookie mechanism.

Data obtained from other sources (Art. 14 GDPR): professional contact details of prospects - name, role, employer, business email address, business phone number, and links to public professional profiles - obtained from publicly available professional sources and from licensed business contact data providers (e.g., Apollo).

We do not collect special categories of personal data through the website or for marketing purposes, and we ask you not to include such data in messages sent to us.


4. Purposes and Legal Bases

  • Responding to your enquiries and demo requests, and taking steps prior to entering into a contract - Art. 6(1)(b) GDPR (steps at your request) and Art. 6(1)(f) GDPR (our legitimate interest in responding to business enquiries);
  • Managing business relationships and our CRM records - Art. 6(1)(f) GDPR (legitimate interest in maintaining commercial relationships);
  • Business-to-business direct marketing and outbound prospecting, including email campaigns - Art. 6(1)(f) GDPR (legitimate interest in promoting our products to relevant travel-industry professionals). This interest is documented in a Legitimate Interest Assessment. Every such message identifies dcs plus as the sender and contains a simple way to opt out;
  • Compliance with our legal obligations - Art. 6(1)(c) GDPR.

We do not use your data for automated decision-making producing legal or similarly significant effects, and we do not sell personal data.


5. Recipients

Your data may be shared with service providers acting as our processors: HubSpot (CRM and marketing platform), Apollo (business contact data), Instantly (email outreach), Microsoft 365 (email and documents), Vigilant Sec (IT security monitoring - email metadata only, no content), and website hosting providers. Within dcs plus, access is limited to the Marketing, Sales, and Key Account Management teams on a need-to-know basis. All recipients are bound by data protection obligations.


6. International Transfers

Some of our providers are located in the United States. Transfers to them take place under Art. 46 GDPR safeguards - the European Commission's Standard Contractual Clauses - or, where the provider is certified, under the EU-U.S. Data Privacy Framework. Limited business reporting may be shared within our corporate group in the United Kingdom, which benefits from a European Commission adequacy decision.


7. Retention

Enquiries and related correspondence are kept for the time needed to handle them and up to 2 years thereafter. Prospect and CRM contact data is kept for up to 24 months from the last meaningful interaction, or until you object or opt out, whichever comes first; a minimal suppression record is kept afterwards to honour your opt-out. Retention follows our Data Retention Policy (DP-02).


8. Your Rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object. In particular, you may object at any time to the processing of your data for direct marketing (Art. 21(2) GDPR) - this right is absolute and we will stop such processing immediately. You can exercise it through the unsubscribe option in any of our messages or by writing to dpo@dcsplus.net.

To exercise any right, contact dpo@dcsplus.net. If you consider that your rights have been infringed, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.anspdcp.ro).


9. ARIA and the WhatsApp Business Platform

ARIA is a workspace where travel agencies handle customer requests. Agencies connect their own WhatsApp Business Account through Meta’s Embedded Signup. ARIA then sends and receives WhatsApp messages on the agency’s behalf via the WhatsApp Business Platform, operated by Meta Platforms Ireland Ltd.

Our role

For messages exchanged between an agency and its customers, the agency is the data controller. DCS Fast Link SRL (dcs plus), as the provider of ARIA, is the data processor, acting on the agency’s documented instructions under the agreement with the agency.

Data we receive from Meta

  • WhatsApp Business Account ID, phone number ID and business profile details
  • Approved message templates (name, language, content)
  • Customers’ phone numbers and WhatsApp profile names
  • Message content, including media and files
  • Delivery and read statuses with timestamps

How we use it

Only to provide ARIA to the agency: showing incoming messages, sending replies and templates, routing conversations to the agency’s human or AI agents, and keeping a conversation record. We do not use this data for advertising, we do not sell it, and we do not profile the agency’s customers.

Sharing and hosting

Messages pass through Meta’s platform under Meta’s own terms. Within ARIA, data is hosted with our hosting provider on Microsoft Azure in the European Union, in an isolated environment per agency, and is visible only to the agency’s authorised users. Where the agency has enabled AI features, message content may be processed by the AI provider the agency has configured, under the agency’s own account and API key, solely to generate drafts and responses for the agency.

Retention

Data is kept for as long as the agency uses ARIA. After the agency disconnects WhatsApp or its contract ends, the data is deleted within the period set in the agreement with the agency, unless the law requires us to keep it longer.

Disconnecting and deletion

The agency can disconnect its WhatsApp Business Account at any time, in ARIA or in Meta Business Manager. Deletion requests can be sent to dpo@dcsplus.net and are confirmed within one month. Customers of an agency should contact that agency first; they can also write to dpo@dcsplus.net and we will pass the request on and help the agency respond.

Security

Data is encrypted in transit (TLS) and at rest (AES-256 encryption of the Azure storage it lives on). Credentials such as access tokens and API keys are additionally encrypted at the application level with a per-instance key. Access is limited to the agency’s authorised users and to dcs plus staff who need it to provide support.


10. Changes to This Notice

The current version of this notice is published on dcsplus.net. If we materially change our practices or this notice, we will publish the revised version and, where appropriate, signal the change on the website.