Language: English

Legal

Privacy Policy

Last updated: 2026-09-25

1. Who is the data controller

The data controller is Bytecraft Media SRL, registered office Șos. Alexandria Nr. 86, Bl. L24, Sc. 1, Ap. 34, Sector 5, București, Romania, CUI 54481523, J2026024670003. Contact for privacy matters: contact@bytecraftmedia.eu.

2. What personal data we collect

We collect personal data in these situations:

  • When you use the contact form: your name, email address, company name (optional), your message, and the IP address the form was sent from. The IP address is included in the enquiry email we receive and is used to limit abuse. The email also notes the page or button that led you to the form, and an automatic confirmation is sent to the email address you enter. The form's spam check (Cloudflare Turnstile) also processes technical signals from your browser, such as your IP address and browser type; it does not read what you type.
  • When you request an audit: your name, email address, website address, the markets you sell to, the page or button that led you to the form, and the IP address the request was sent from. We use them to prepare the audit, send it to you and, if you wish, discuss it with you. An automatic confirmation is sent to the email address you enter, and the same spam check applies.
  • When you email us or message us on WhatsApp: your email address or phone number, the name you use, and the content of the conversation.
  • When you book a call: the booking calendar on the Contact page is provided by Cal.com and loads only when you ask for it. Loading it sends your IP address to Cal.com; booking sends the details you enter (name, email, notes and the time you choose).
  • When you become a client: the above plus billing details (company name, registered address, VAT or fiscal ID, bank account) needed to issue invoices in compliance with Romanian fiscal law.
  • When you visit the website: only if you accept analytics in the cookie banner, Vercel Web Analytics records page views (page, referrer, country, device, operating system and browser) without cookies. See the Cookie Policy.

3. Lawful basis for processing

We process personal data on the following lawful bases under Article 6 of the GDPR:

  • Article 6(1)(b), performance of a contract: client billing data, project communications, and steps you ask for before a contract, such as preparing an audit you request or booking a call.
  • Article 6(1)(f), legitimate interest: replying to enquiries by form, email or WhatsApp, and protecting the contact form from spam and abuse.
  • Article 6(1)(c), legal obligation: retaining invoices and fiscal records as required by Romanian tax law.
  • Article 6(1)(a), consent: web analytics, only after you accept them in the cookie banner. You can withdraw consent at any time with Cookie settings at the bottom of every page.

4. How long we keep your data

  • Enquiries and audit requests (messages and requests sent through our forms, including the IP address sent with them, emails and WhatsApp conversations): kept for 12 months from the last contact, then deleted, unless the contact became a client engagement.
  • Client engagement records: kept for the duration of the engagement plus the period required by Romanian fiscal law for accounting documents (currently 10 years for invoices).
  • Analytics: Vercel recognises a visit only through a hash that resets every day, and discards sessions after 24 hours; what remains are aggregated statistics without personal identifiers.

5. Who we share data with

We use the following service providers:

  • Vercel Inc. (USA): hosts this website and, if you accept analytics, provides Vercel Web Analytics.
  • Cloudflare, Inc. (USA): DNS, the Turnstile spam check on the contact form, and email routing. Messages to contact@bytecraftmedia.eu pass through Cloudflare on their way to our mailbox; Cloudflare says it does not store their content, and it keeps a log of sender, recipient and subject for 31 days.
  • Resend (Plus Five Five, Inc., USA): delivers the enquiries and audit requests sent through our forms to us by email, and the automatic confirmations to you.
  • Google (Gmail): hosts the mailbox where enquiries and emails to us arrive.
  • Cal.com, Inc. (USA): the booking calendar, loaded only at your request. Inside the calendar, Cal.com also sends error reports to Sentry (Functional Software, Inc., USA) and loads the host's profile photo from Google.
  • WhatsApp (WhatsApp Ireland Limited): only if you choose to contact us on WhatsApp, under WhatsApp's own terms and privacy policy.

We do not sell or rent personal data to anyone. We do not use personal data for advertising profiling.

6. Your rights under the GDPR

You have the following rights regarding your personal data:

  • Access (Art. 15), request a copy of the data we hold.
  • Rectification (Art. 16), correct inaccurate data.
  • Erasure (Art. 17), request deletion, subject to legal-retention obligations.
  • Restriction (Art. 18), restrict processing in specific circumstances.
  • Portability (Art. 20), receive data in a machine-readable format.
  • Objection (Art. 21), object to processing based on legitimate interest.
  • Withdrawal of consent (Art. 7(3)), where processing is based on consent, withdraw at any time without affecting prior lawful processing.

To exercise any right, contact contact@bytecraftmedia.eu. We respond within 30 days as required by Article 12(3) GDPR.

7. Right to complain

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Romanian supervisory authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București
Web: www.dataprotection.ro

8. International transfers

Several of these providers process data in the United States. Vercel, Cloudflare, Resend, Google and Sentry are certified under the EU-US Data Privacy Framework, so transfers to them rely on the European Commission's adequacy decision (Article 45 GDPR). Cal.com, Inc. is not certified; it states that it relies on Standard Contractual Clauses (Article 46 GDPR). WhatsApp Ireland Limited transfers data to WhatsApp LLC and Meta Platforms, Inc. under the Data Privacy Framework.

9. Security

We apply technical and organizational measures appropriate to the risk: TLS for all network traffic, encrypted at rest where the processor supports it, role-based access to client data limited to Bytecraft Media personnel actively working on the engagement.

10. Changes to this policy

Material changes to this policy will be communicated by email to active clients at least 30 days before taking effect, and reflected in the Last updated date at the top of this page.

11. Contact

Questions about this policy: contact@bytecraftmedia.eu.