Privacy Policy
This Privacy Policy explains how TopManager (the "Platform", "we", "us") collects, uses, stores, shares and protects personal data when you visit our website https://topmanager.ro, when you use the TopManager web applications (the back-office, the online shops built on the Platform and the public API) and when you connect a third-party account, such as a Google account, to TopManager.
In short: we only process the data needed to provide the services you or your organization asked for, we never sell personal data, we do not use it for advertising, and data you allow us to access from Google is used only to provide the features you turned on, under the Google API Services User Data Policy, including its Limited Use requirements (see section 6).
1. Who we are
TopManager is a cloud ERP and business-management platform (SaaS) developed and operated by TopDev Systems, a company registered in Romania, together with its partner Allbim.
Contact for any privacy question or request: office@topdev.ro.
2. Our role: controller and processor
- As a controller, we process the data of the visitors of our public website, the data sent through the "Request an offer" form and the data of the people who hold a TopManager user account (identification, authentication and security data).
- As a processor, we process the business data that our customers (companies using the Platform, "tenants") store in TopManager: their clients, contacts, invoices, orders, products, employees, calendars and so on. For this data, the tenant is the controller and decides why and how it is processed; we act only on the tenant's instructions, under our Terms of Service and the applicable data processing agreement. If you are a client of one of our tenants (for example a buyer in an online shop built on TopManager), please contact that company first for any request about your data.
3. What data we collect
3.1 Data you give us
- Account data: name, email address, user name, password (stored only as a one-way hash), the company you work for, your role and permissions, language and interface preferences.
- Contact and offer requests: name, company, email, phone and the message you send us through the website.
- Business content entered by tenants and their users: data about clients and partners (names, contact details, addresses, tax identifiers), invoices, orders, payments, products, stock, documents and files, tasks and projects, calendar events, chat messages, emails and SMS messages sent through the Platform.
3.2 Data collected automatically
- Technical and security data: IP address, browser type, device and operating system, date and time of access, pages requested, error logs and audit logs of important actions (for example sign-ins and changes of data).
- Cookies and similar technologies: see section 9.
3.3 Data from third-party services you connect
Only when you or your organization explicitly connect them: Google (see section 6), online payment processors, courier services, the Romanian tax authority (ANAF e-Factura / e-Transport), SMS and email providers, and the AI provider chosen by your organization.
4. How we use the data and on what legal basis
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Providing the Platform: creating and securing accounts, signing in, storing and displaying your organization's data, running the features you use (invoicing, orders, calendars, integrations, notifications). | Performance of the contract (art. 6(1)(b)); for tenant data, on the tenant's instructions. |
| Answering offer requests and support questions. | Steps prior to a contract / legitimate interest (art. 6(1)(b) and (f)). |
| Security, fraud and abuse prevention, troubleshooting, backups. | Legitimate interest (art. 6(1)(f)). |
| Fiscal and legal obligations (for example e-invoicing, accounting records). | Legal obligation (art. 6(1)(c)). |
| Website statistics (Google Analytics on the public pages) and non-essential cookies. | Consent (art. 6(1)(a)), which you can withdraw at any time. |
We do not sell personal data, we do not use it for advertising or profiling for marketing purposes, and we do not make decisions producing legal effects based solely on automated processing.
5. AI features
Some features of TopManager (for example the AI assistant or content generation) can send data to an artificial-intelligence provider (such as Anthropic, OpenAI or a self-hosted model). These features are turned on only by your organization, with its own provider account and API key, and they run only when a user asks for them. Only the data needed to answer that request is sent, it is used only to produce the answer shown to the user, and the assistant can read only the data that user is already allowed to see. We do not use your data, and we do not allow it to be used, to train or improve generalized AI or machine-learning models.
6. Google user data
TopManager lets users connect their Google account, for example to sign in with Google or to synchronize their TopManager calendars with Google Calendar. Connecting a Google account is always optional and is started by the user, who sees Google's consent screen listing exactly what is requested and can refuse.
6.1 What Google data we access
- Basic profile (scopes
openid,email,profile): your name, email address and profile picture, used to identify you and link the Google account to your TopManager account. - Google Calendar, only if you turn on calendar synchronization:
https://www.googleapis.com/auth/calendar.calendarlist.readonly- the list of your calendars (names, colours, time zones), so you can choose which ones to synchronize;https://www.googleapis.com/auth/calendar.events- the events of the calendars you chose (title, description, start and end, location, recurrence, reminders, attendees), to show them in TopManager and to create, update or delete in Google the events you change in TopManager;https://www.googleapis.com/auth/calendar.app.created- to create and manage only the calendars that TopManager itself creates in your Google account.
We do not request access to Gmail, Google Drive, contacts or any other Google data.
6.2 How we use Google data
- Exclusively to provide the user-facing features you turned on: signing in, and the two-way synchronization between your TopManager calendars and your Google calendars (showing your Google events in TopManager, writing to Google the events you add, edit or delete in TopManager, reminders).
- Google data is not used for advertising, is not sold, is not used to build user profiles, and is not used to develop, improve or train generalized AI or machine-learning models.
- Our staff do not read your Google data, except with your explicit permission for a support request, when needed for security purposes (for example investigating abuse), or to comply with the law.
6.3 How we store and protect Google data
- The OAuth tokens (access and refresh tokens) are stored in the database of your organization, on our servers, are never shown in the interface and are used only by the Platform to call the Google APIs on your behalf.
- Synchronized events are stored in your organization's TopManager calendars, under the same protection as the rest of its data: encrypted connections (HTTPS / TLS), access restricted by user roles and permissions, separate databases per organization, backups and access logs.
6.4 Who we share Google data with
Google data is shown only to you and to the people your organization has given access to the calendars concerned in TopManager. We do not transfer Google data to third parties, except: (a) to the infrastructure providers that host the Platform, acting on our instructions; (b) when a user of your organization explicitly asks the AI assistant a question about their calendar, in which case only the events needed for the answer are sent to the AI provider chosen by your organization, solely to produce that answer (see section 5); (c) when required by law; or (d) as part of a merger or acquisition, with notice to users.
6.5 Retention and deletion of Google data
Google data is kept only while the connection is active. You can disconnect your Google account at any time from TopManager or from your Google account settings at https://myaccount.google.com/permissions. When you disconnect, we delete the stored tokens and stop all synchronization; events already copied into your TopManager calendars stay there as part of your organization's calendar data, you can delete them at any time, and they are deleted when your organization's account is closed. You can also ask us to delete your Google data at office@topdev.ro; we act on such requests within 30 days.
6.6 Limited Use
TopManager's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Who we share data with
We share personal data only as needed to provide the Platform, with:
- Infrastructure and hosting providers (servers, databases, backups, email delivery), bound by confidentiality and data-processing agreements;
- Services connected by your organization, only for the purpose of that integration: payment processors, courier companies, SMS and email providers, the AI provider it chose, Google, ANAF (the Romanian tax authority) for e-invoicing and e-transport;
- Google for website statistics (Google Analytics, only with consent) and anti-spam protection of our forms (Google reCAPTCHA);
- Public authorities, when we are legally required to.
When data is transferred outside the European Economic Area, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.
8. How long we keep data
- Tenant business data: for as long as the organization's subscription is active; after it ends, it is deleted or returned according to the contract, except what the law requires us to keep.
- User accounts: until the account is deleted by the organization or at your request.
- Offer requests and correspondence: up to 3 years from the last contact.
- Security and audit logs: as long as necessary for security, usually no more than 12 months.
- Fiscal and accounting documents: for the periods required by Romanian law.
9. Cookies
We use strictly necessary cookies (session, authentication, protection against request forgery, the cookie-consent choice), preference cookies (language, theme, interface settings) and, on the public pages and only with your consent, analytics cookies (Google Analytics). Google reCAPTCHA protects our forms against spam. You can manage cookies from the consent banner and from your browser settings.
10. Security
We protect data with encrypted connections (HTTPS / TLS), hashed passwords, a separate database for each organization, role-based access control, rate limiting, logs of important actions, regular backups and limited, need-to-know access for our staff. No system is perfectly secure, but we take reasonable measures and, where the law requires, we notify the authority and the people affected by a data breach.
11. Your rights
Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability and to withdraw your consent at any time. To exercise these rights write to office@topdev.ro; we answer within one month. For data that an organization stores in TopManager about you, we forward your request to that organization, which is the controller. You also have the right to lodge a complaint with the Romanian data-protection authority, ANSPDCP (www.dataprotection.ro).
12. Children
TopManager is a business platform, not intended for children under 16, and we do not knowingly collect their personal data.
13. Changes to this policy
We may update this policy when the Platform or the law changes. The current version is always published at https://topmanager.ro/en/privacy-policy, with the date of the last update at the top; significant changes are announced to users in the Platform or by email.
14. Contact
TopDev Systems - email: office@topdev.ro - website: https://topmanager.ro.