Privacy Policy

Last updated: 27/07/2026

This Privacy Policy explains how WORLD PERFORMANCE GROUP S.R.L. (“WPG”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you visit our website, submit an enquiry, download a free resource, purchase a Digital Product, or engage our services. It applies to processing carried out by WPG as a data controller. Where WPG processes personal data on behalf of a Client, we act as a data processor and processing is governed by a separate Data Processing Agreement (see our Terms and Conditions, section 7).

This Policy is written to comply with Regulation (EU) 2016/679 (the “GDPR”) and Romanian data protection law.

1. Who we are

The data controller is WORLD PERFORMANCE GROUP S.R.L., a company registered in Romania under Trade Registry number J40/4055/2018 and Unique Registration Code RO39076241, with its registered office at Strada Delea Veche, nr. 24, Corp A, Modul 2, Etaj 4, sector 2, Bucharest, Romania.

Full company details are set out in our Legal Notice.

2. Data Protection Officer

WPG has appointed Battlegroup Romania (Data Privacy & Security) as its Data Protection Officer (“DPO”). If you have any question about how we handle your personal data, or if you wish to exercise your rights under the GDPR, please contact our DPO directly at dpo@worldpg.net.

3. What personal data we collect

3.1 When you visit our website

When you browse our website, we may collect limited technical data through server logs and analytics tools: your IP address, browser type, device type, pages viewed, referring website, and time of visit. This data is aggregated and used to understand how the website is used and to keep it secure.

3.2 When you submit an enquiry form

Our Contact form and Support Solutions enquiry form ask for information you provide voluntarily. This typically includes your name, work email address, company name, and details about your enquiry (for example, team size, channels used, or a description of what you are looking for). Submitting a form is optional; we only receive the data you choose to enter.

3.3 When you request a free download

When you request a free Digital Product (for example, the 12-Point Health Check), we ask for your name, work email address, and role. We use this data to deliver the download and to contact you about the product itself. We do not automatically add you to a marketing list.

3.4 When you purchase a paid Digital Product

Paid Digital Products are sold through Lemon Squeezy, which acts as the Merchant of Record for the purchase (see our Terms and Conditions, section 4). Lemon Squeezy collects your name, email address, billing address, VAT identification number (where applicable) and payment method details directly. WPG receives from Lemon Squeezy only the information needed to fulfil the order and administer your licence.

3.5 When you engage our Support Solutions service

When you become a Support Solutions Client, we collect the contact details of your designated points of contact and any operational information you provide in the course of the engagement. During service delivery, we may also process personal data relating to your own customers (End-Customer Data). Where this occurs, WPG acts as a data processor on your behalf under a separate Data Processing Agreement.

3.6 When you purchase the Chat Tool

The Chat Tool (planned for launch in September 2026) is sold through Lemon Squeezy and provided under a separate signed service agreement (see our Terms and Conditions, section 6). Data protection roles and specific processing arrangements for the Chat Tool are set out in the Chat Tool Service Agreement executed with each Client.

4. Why we process your data (legal bases)

We only process personal data where we have a lawful basis to do so under Article 6 of the GDPR:

• Performance of a contract (Article 6(1)(b)) — to deliver a Digital Product you have purchased, to perform a Support Solutions engagement, or to provide the Chat Tool service.
• Legitimate interests (Article 6(1)(f)) — to respond to enquiries you have submitted through our website, to keep our website secure, to administer our business, and to understand at an aggregate level how our website is used. When relying on legitimate interests, we balance these against your rights and freedoms.
• Legal obligation (Article 6(1)(c)) — to keep accounting and tax records for the periods required by Romanian law.
• Consent (Article 6(1)(a)) — where you have expressly consented, for example when accepting non-essential cookies or, in future, subscribing to marketing communications. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

5. Who we share your data with

We do not sell your personal data. We share personal data only with the service providers listed below, each acting as a data processor or independent controller, and only to the extent necessary for the purposes described.

Service provider	Role	Location
Magnetic IT Services	Website and email hosting infrastructure	Romania (EU)
Battlegroup Romania (Data Privacy & Security)	Data Protection Officer service	Romania (EU)
Microsoft (Office 365)	Email hosting and delivery	European Union / United States
Cloudflare, Inc.	Domain Name System (DNS) resolution and bot-protection services (Turnstile)	United States (global network)
Lemon Squeezy	Merchant of Record for paid Digital Products and the Chat Tool	United States
Google (via Site Kit)	Website analytics (Google Analytics)	United States

We may also share personal data with our professional advisers (such as lawyers or accountants) where necessary, and with public authorities where we are required to do so by law.

6. International transfers

Where personal data is transferred outside the European Economic Area, we put in place an appropriate safeguard recognised under Chapter V of the GDPR. In practice, transfers to the United States (to Lemon Squeezy, Google, Cloudflare and, where applicable, Microsoft) rely on the European Commission’s Standard Contractual Clauses and, where the recipient has certified to it, on the EU–U.S. Data Privacy Framework. Data hosted with Magnetic IT Services and processed by Battlegroup Romania remains within the European Union.

7. How long we keep your data

We keep personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required by law.

• Enquiry form submissions — up to 24 months after our last contact with you, unless the enquiry leads to an engagement or purchase.
• Free-download subscribers — up to 24 months, or until you ask us to remove your details.
• Paid Digital Product buyers — up to 10 years, in line with the Romanian Accounting Law (Law 82/1991) requirement to retain accounting records.
• Support Solutions and Chat Tool Client records — for the duration of the engagement plus five years after termination, or longer where required by applicable law.
• Website analytics data — up to 26 months (the default retention setting used by Google Analytics 4).
• Server logs — up to 12 months, after which they are aggregated or deleted.

Data-subject requests, DPO communications and records of your rights we have honoured are retained for the periods required to demonstrate compliance under GDPR Article 5(2).

8. Cookies and tracking

Our website uses cookies and similar technologies. Cookies are small text files stored in your browser that help websites function and understand how they are used.

8.1 Strictly necessary cookies

These are needed for the website to work and do not require your consent. They include WordPress session cookies (for users signed in to the administration area), Fluent Forms cookies (short-lived, to prevent duplicate submissions), and Cloudflare Turnstile cookies (short-lived, to verify that form submissions are not from automated bots).

8.2 Analytics cookies

We use Google Analytics 4 to understand at an aggregate level how visitors use our website. Google Analytics sets cookies (typically named _ga and _ga_G-ZJVPR4R6S5) that assign a random identifier to your browser and record page views. IP addresses are truncated before being processed. Analytics cookies are set only where you have accepted them.

8.3 Managing your cookie preferences

You can manage cookies in your browser settings — for example, by refusing new cookies or deleting existing ones. Some parts of the website may not function correctly if you refuse strictly necessary cookies.

9. Your rights

Under the GDPR, you have the following rights in relation to your personal data:

• Access — you can ask us for a copy of the personal data we hold about you.
• Rectification — you can ask us to correct data that is inaccurate or incomplete.
• Erasure — you can ask us to delete your personal data, where one of the grounds in Article 17 GDPR applies.
• Restriction — you can ask us to limit how we use your personal data in certain circumstances.
• Portability — where we process your data on the basis of consent or contract by automated means, you can ask for a copy in a structured, commonly used, machine-readable format.
• Objection — you can object to processing based on our legitimate interests. Where you object, we will stop processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Withdraw consent — where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
• Automated decision-making — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. WPG does not currently make any such decisions about you.

To exercise any of these rights, please contact our DPO at dpo@worldpg.net. We will respond within one calendar month (extendable by two further months in complex cases, as permitted by Article 12(3) GDPR).

10. How to lodge a complaint

If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Romanian Data Protection Authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro

You may also lodge a complaint with the supervisory authority in your country of residence or place of work.

11. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, encryption in transit (HTTPS), regular backups, staff confidentiality obligations, and vendor due diligence. No system is entirely immune to security incidents; if a personal data breach affects your rights, we will notify you in line with our GDPR obligations.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or how we handle personal data. The revised Policy takes effect from the date shown at the top of the page. Where changes are material and affect the rights of individuals whose data we hold, we will take reasonable steps to notify them directly.

13. Contact

For any question about this Privacy Policy or about how we handle personal data:

Data Protection Officer: dpo@worldpg.net
General enquiries: info@worldpg.net
Postal address: WORLD PERFORMANCE GROUP S.R.L., Strada Delea Veche, nr. 24, Corp A, Modul 2, Etaj 4, sector 2, Bucharest, Romania