Privacy and cookie policy

Who is responsible for your data

The data controller is ECHIPA DE TOCILARI SRL, the company that owns the echipadetocilari.ro website.

• Address: 12 Alexandru Zagoritz Street, District 2, 021998 Bucharest, Romania
• Tax identification number (CUI): 47591744
• Trade Register number: J40/2298/2023
• Email for any question about your data: contact@echipadetocilari.ro

We have no data protection officer (DPO), because Article 37 GDPR does not require one for a business like ours.

This policy covers the echipadetocilari.ro website, in Romanian and in English, and your conversations with us through the form or by email. Data we process for clients in their projects (for example, data about visitors to a website we maintain) is governed by our contracts with those clients.

What data we use

The contact form

The form appears at the end of every page. Its fields are: name, company (optional), email, phone and message. With your message we also automatically receive the address of the page you sent it from and the page language. Your email address becomes the address we reply to.

Name, email, phone and message are required: without them, the form cannot be sent. We ask for your phone number so we can call you when a quote is easier to discuss by phone. If you prefer not to give it, email us directly at contact@echipadetocilari.ro. No law or contract obliges you to give us this data.

To stop automated messages, the server also checks how much time passed between loading the page and sending the form. This information is not included in the email and is not kept.

Emails you send directly

If you write to contact@echipadetocilari.ro, we use your email address and what you write, including any attachments.

IP address and technical data

As with any website, the server receives your device’s IP address, your browser type and the page requested. Vercel, the company that hosts the website, processes them in its technical logs and in its firewall, for security.

When you send the form, we use your IP address to limit repeated submissions. The Vercel firewall limits the number of submissions from the same IP address. The form code turns the IP address into a hash code (SHA-256), which it keeps in memory only, to count submissions over 15 minutes. The website code never saves the IP address. The hash code does not make the address anonymous: it is still personal data, only harder to link to you.

Google Analytics, only with your consent

If you accept analytics cookies, Google Analytics collects data about how you use the website. The details are in the Cookies and Google Analytics section.

If you become a client

We use the contact details of the people we work with, received from you or from your company, project correspondence, the contract and billing details. The data needed for the contract and for invoicing is required: without it we cannot sign the contract or issue the invoice.

Why we use data and on what legal basis

For the data we receive, the legal basis is one of the points of Article 6(1) of Regulation (EU) 2016/679 (GDPR), given for each purpose:

• Quote requests: we reply when you ask for a quote or for information about our services. Basis: steps taken at your request before entering into a contract (point (b)).
• Other messages: we reply to partnership proposals, job applications or general questions. Basis: our legitimate interest in communicating with the people who write to us (point (f)).
• Keeping messages (24 months): when no project follows, we keep messages for 24 months after the last exchange, so we know what you asked and what we answered if you come back to us. Basis: our legitimate interest (point (f)).
• Client projects: if you become a client, we use the data to work on your project. Basis: performance of the contract (point (b)).
• Keeping client correspondence: after we stop working together, so we can prove what we agreed and defend ourselves in a dispute, within the general limitation period of 3 years. Basis: our legitimate interest (point (f)).
• Invoicing and accounting: we issue invoices and keep our accounts. Basis: our legal obligations, in particular those under Romanian Accounting Law no. 82/1991 (point (c)).
• Security and troubleshooting: we protect the website and the form against abuse and automated messages, and we fix errors. This covers the hosting technical logs, the firewall and the submission limit. Basis: our legitimate interest in a website that is secure and works correctly (point (f)).
• Google Analytics: we measure how the website is used. Basis: your consent (point (a)), which Article 4(5) of Romanian Law no. 506/2004 on privacy in electronic communications also requires. You can withdraw it at any time.
• Your cookie banner choice: the website remembers what you chose. This is strictly necessary storage, allowed without consent by Article 4(6)(b) of Law no. 506/2004. We do not receive this information: your choice stays in your browser only.

How long we keep data

• Messages that do not lead to a project, sent through the form or by email: 24 months after the last exchange. We then delete them from the contact@echipadetocilari.ro mailbox and, for form messages, also from the Gmail mailbox. We keep them so we have the context if you come back.
• Client correspondence: for as long as we work together plus 3 years after that, the general limitation period (Article 2517 of the Romanian Civil Code).
• Accounting documents, for example invoices: 5 years, counted from 1 July of the year after the end of the financial year in which they were drawn up, as required by Article 25 of Law no. 82/1991.
• The copy of the email at Resend: 30 days, the period Resend sets for sent emails and sending logs, plus up to 7 days in Resend’s backups.
• Hosting technical logs (Vercel): the periods set by Vercel. In our account, logs of the function that sends the form can be viewed for one day at most. We use them for security and troubleshooting.
• The hash code of the IP address, used for the submission limit: in server memory only. We use it for 15 minutes; it is removed at the first submission after that or, at the latest, when the server frees its memory. It is not saved.
• Google Analytics data: at most 14 months after your last visit for user-level and event-level data. Aggregated reports, for example total visits per month, may be kept longer. Google Analytics cookies expire at most 2 years after your last visit.
• Your cookie choice (ect-consent): 6 months in your browser, after which we ask you again.

Who else receives data

We do not sell your data. It is received only by the providers we need for the website and email to work and, when the law requires it, by our accountants and public authorities:

• Vercel Inc. (US): hosts the website and runs the firewall and, on servers in the US, the function that sends the form. It processes your IP address, technical browser data and the content of the form while it is being sent.
• Plus Five Five, Inc., which operates Resend (US): sends us the email with your message and keeps a copy of it for a limited time.
• Awesome Projects S.R.L., which operates Hostico (Romania): hosts the contact@echipadetocilari.ro mailbox.
• Google Ireland Limited and Google LLC (US), through Gmail: form messages also reach a team member’s personal Gmail mailbox, that is, an ordinary Google account, not a business email service. Google processes them under its own terms and its privacy policy, not under a data processing agreement with us. This processing may also take place outside the European Economic Area (EEA), including in the US.
• Google Ireland Limited and Google LLC (US), through Google Analytics: only if you accept analytics cookies.
• Accounting services and public authorities, for example ANAF (the Romanian tax authority): the client data needed for accounting and whatever the law requires us to provide.

Links to other websites

On this website you will find links to Facebook, LinkedIn and demo websites on websitedemos.net, which belong to other companies. We load nothing of theirs on our pages. If you click a link, you reach their website, where their policies apply, and your browser tells them at most that you came from echipadetocilari.ro, not the exact page.

Transfers outside the European Economic Area

Vercel, Resend and Google may process data in the US. A form message passes through a Vercel server in the US and is sent through Resend, which stores data in the US. It then reaches our mailbox hosted by Hostico in Romania and a team member’s Gmail mailbox.

Google LLC and Vercel Inc. are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognized in its adequacy decision of 10 July 2023. For transfers to them, we rely on that decision. For Resend, we rely on the European Commission’s standard contractual clauses, included in its data processing agreement.

You can check the certifications in the official Data Privacy Framework list. For information about the safeguards used and how to get a copy of them, email us at contact@echipadetocilari.ro.

Cookies and Google Analytics

Cookies are small files that a website saves in your browser. Local storage (localStorage) is a similar area of the browser. Below is everything this website saves in your browser.

We do not use advertising cookies, social media pixels or content embedded from other websites, such as videos or maps. Fonts load from our own website, not from Google servers.

How to give or withdraw consent

On your first visit, a banner asks whether you accept analytics cookies (the “Analytics” category under “Customize”). Rejecting is as easy as accepting and does not limit your access to the website. Until you choose, Google Analytics does not load and nothing is sent to Google.

You can change your choice at any time through “Cookie settings” in the footer of every page or with the button below. If you withdraw consent, Google Analytics stops and we delete the _ga and _ga_PGM4B3VM9Z cookies from your browser. Withdrawing does not affect processing lawfully carried out before. If JavaScript is turned off, Google Analytics does not load at all.

What the website saves in your browser

What Google Analytics measures

If you accept, Google Analytics records:

• the pages you view and how you reached the website, for example from a search engine or a link;
• how long the page is open and active, and whether you scrolled close to the end (90% of the page);
• clicks on links to other websites and file downloads;
• when you start filling in the form and when you send it;
• your device type, operating system, browser, language and screen resolution;
• your approximate location (city, region, country), derived from your IP address;
• a random identifier saved in the _ga cookie, so it can recognize the same browser on later visits.

Google says, on its page about EU data and privacy, that Google Analytics does not log or store the IP addresses of visitors in the EU: it uses them on servers in Europe only to work out the approximate location, then discards them immediately. We have not turned on Google Signals (the feature that associates visits with visitors’ Google accounts). Our configuration always denies advertising storage, sending data for advertising and ad personalization (ad_storage, ad_user_data and ad_personalization).

Contact details from the form, sent to Google

In our Google Analytics account, user-provided data collection is turned on, with automatic detection. After you accept analytics cookies, the Google Analytics script may automatically detect names, email addresses, phone numbers and postal addresses on the page, including the name, email and phone number you type into the form.

The script may send them to Google in hashed form (SHA-256), meaning turned into a code from which they cannot be read directly. Google says, on its page about user-provided data collection, that it matches them with data from the Google accounts of users who have given their consent. Google’s stated purposes are more accurate measurement and aggregated reports for us on the age, gender and interests of visitors.

Google keeps this data under the same setting as the rest of the data, that is, for at most 14 months after your last visit. Google also states, in its consent mode reference, that when ad_user_data is denied, as it always is on our website, the use of personal data for online advertising is disabled, including this data. If you reject analytics cookies, none of this happens.

How to delete or block cookies in your browser

You can delete cookies already saved and block cookies at any time in your browser settings. Our website works without cookies too, although the banner may ask you again on every visit. The official guides:

• Google Chrome: deleting, allowing and blocking cookies
• Mozilla Firefox: deleting cookies and blocking cookies
• Safari: deleting cookies on Mac and deleting or blocking them on iPhone
• Microsoft Edge: deleting, allowing and blocking cookies

You can turn off Google Analytics on all websites with the official Google Analytics opt-out browser add-on. To learn what Google does with the data it receives from websites, see How Google uses information from sites or apps that use its services.

Your rights

Under the conditions set by the GDPR, you have the right:

• to find out whether we use data about you and to get a copy of it (right of access);
• to have inaccurate or incomplete data corrected (right to rectification);
• to have your data erased (right to erasure);
• to ask us to limit how we use your data (right to restriction of processing);
• to receive the data you gave us in a structured, commonly used format, or to ask us to send it to another company (right to data portability);
• to object at any time, on grounds relating to your situation, to our use of data based on our legitimate interest, for example keeping messages (right to object);
• to withdraw your consent for Google Analytics at any time, through “Cookie settings” or with the button in the Cookies and Google Analytics section, without affecting processing lawfully carried out before;
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). We do not make such decisions.

How to exercise your rights

Email us at contact@echipadetocilari.ro or write to ECHIPA DE TOCILARI SRL, 12 Alexandru Zagoritz Street, District 2, 021998 Bucharest, Romania. Requests are free.

We reply within one month of receiving your request. If the request is complex or we receive many requests, this period may be extended by two more months; in that case, we tell you within the first month and explain why. So that we do not give your data to someone else, we may ask for additional information to confirm your identity.

Where to file a complaint (ANSPDCP)

If you believe we use your data without complying with the law, you can complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), the Romanian data protection authority. We recommend writing to us first so we can resolve it directly, but you do not have to.

• Address: 28-30 General Gheorghe Magheru Boulevard, District 1, 010336 Bucharest, Romania
• Phone: +40 318 059 211 or +40 318 059 212
• Email: anspdcp@dataprotection.ro
• Website: www.dataprotection.ro, which also has a complaints page

If you live or work in another country of the European Economic Area, or the alleged infringement took place there, you can also complain to the data protection authority of that country.

Children’s data

This website is aimed at businesses and adults and is not intended for people under 16. We do not knowingly ask children for data. If you find out that a child has sent us data, write to us and we will delete it.

How we protect data

• The website and the form work only over an encrypted connection (HTTPS).
• The form code does not write message contents, email addresses, phone numbers or IP addresses to logs.
• The form rejects automated messages, submissions from other websites and submissions repeated too often.

No system is completely secure, and email is not end-to-end encrypted. Please do not send passwords, card details or other sensitive information through the form.

Changes to this policy

When we change this policy, we update this page and the date at the top. If the change affects cookies, the banner asks for your consent again. If we want to use the data you gave us for a new purpose, we will tell you beforehand.

If the Romanian and English versions differ, the Romanian version prevails.