Privacy Policy

Last updated: 31 July 2026

This policy explains how Digital Craft Agency SRL collects and processes the personal data of people who access this website, in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018.

1. The data controller

Digital Craft Agency SRL, with its registered office at Str. Verigei nr. 3, sector 5, București, registered with the Trade Register under number J40/5330/2017, sole registration code RO37403193, is the controller of your personal data.

For any matter regarding the processing of your data you can contact us at contact@cc.digitalcraft.marketing.

2. What data we process

2.1. Data you provide directly

When you complete a contact form or write to us by email, we process the data you choose to share with us: your name, email address, phone number, the name of the company you represent and the content of your message.

We do not ask for and do not need special-category data — concerning health, religious beliefs, sexual orientation, trade-union membership or ethnic origin. Please do not include such information in the messages you send us.

2.2. Data collected automatically

When you access the site, the following categories of information are collected automatically, by technical means:

• IP address — in full in the hosting server logs, and truncated or anonymised in the analytics tools;
• online identifiers — values stored in cookies and similar technologies, which allow the device to be recognised on later visits;
• device and browser data — browser type and version, operating system, screen resolution, language setting, device type;
• usage data — the pages visited, the time and duration of the visit, the browsing order, the referring source, the events triggered (clicking a button, submitting a form, scrolling);
• approximate location data — the country and sometimes the city, inferred from the IP address. We do not collect GPS coordinates.

This data is not linked to your civil identity except to the extent that you communicate it to us yourself through a form.

3. Purposes of processing and legal bases

3.1. Responding to your requests

We process form data in order to review your request and respond. Legal basis: Art. 6(1)(b) GDPR — pre-contractual steps taken at your request; in the alternative, Art. 6(1)(f) — our legitimate interest in responding to people who contact us.

3.2. Technical operation of the site

We process technical data to display pages correctly, maintain the session, remember your cookie choice and secure the infrastructure. Legal basis: Art. 6(1)(f) GDPR — the legitimate interest in maintaining a functional and secure site.

3.3. Traffic measurement — two distinct regimes

To understand how the site is used we employ Google Tag Manager and Google Analytics 4. These tools operate in two different regimes, depending on your choice in the cookie banner.

a) Before consent is given — restricted regime. The tools load, but with all consent signals set to denied (analytics_storage, ad_storage, ad_user_data, ad_personalization), under Google’s Consent Mode v2 mechanism. In this regime:

• no analytics cookie is stored for the refused purposes and no persistent analytics identifier is set — so, for these purposes, the consent requirement in Art. 4(5) of Law no. 506/2004 is not engaged;
• depending on the tag configuration, limited signals without a persistent identifier may be sent to Google — including the IP address and browser data — for country determination and statistical aggregation;
• this data is not used to build a profile or to recognise your device across visits;
• the resulting reports are modelled estimates, not individual measurements.

Legal basis for this regime: Art. 6(1)(f) GDPR — our legitimate interest in knowing, in aggregate form, the volume and structure of traffic. We have weighed this interest against your rights and found the interference minimal: no storage on the device, no identification and no profiling.

b) After consent is given — full regime. If you accept the relevant category, the signals switch to granted, analytics cookies are stored, and measurement becomes individual: sessions, returning users, the full journey between pages.

Legal basis for this regime: Art. 6(1)(a) GDPR — your consent, which you can withdraw at any time, with immediate effect on future processing.

3.4. Advertising and conversion measurement

For marketing tools the rule is stricter: the scripts do not load at all without your explicit acceptance. Until that point, no connection is made with the respective platforms’ servers.

If you give consent for the marketing category, the following are activated:

• Google Ads — conversion measurement and ad display across the Google network, including remarketing to people who have visited the site;
• Meta Pixel — campaign-result measurement and ad display on Facebook and Instagram;
• TikTok Pixel — campaign measurement and ad display on TikTok.

In this regime, these platforms may recognise your device on other sites and apps and may build interest profiles used to target advertising.

Legal basis: Art. 6(1)(a) GDPR — your consent. Withdrawing consent prevents the scripts from loading thereafter.

Joint controller. With regard to the Meta pixel, Digital Craft Agency SRL and Meta Platforms Ireland Limited act as joint controllers for the collection of data and its transmission to Meta, under a joint-controller arrangement. The processing that Meta carries out afterwards, for its own purposes, is Meta’s sole responsibility. This classification follows the reasoning of the Court of Justice of the European Union in Case C-40/17 (Fashion ID).

3.5. Compliance with legal obligations

Where the law requires it, we process and retain data to meet tax and accounting obligations or to respond to requests from competent authorities. Legal basis: Art. 6(1)(c) GDPR.

3.6. Defending our rights

In the event of a dispute, we may process data to establish, exercise or defend a legal claim. Legal basis: Art. 6(1)(f) GDPR.

4. How long we keep the data

We keep data only for as long as is necessary for the purpose for which it was collected:

• form messages and correspondence — 3 years from the last communication, matching the period in which a request may be resumed or contested;
• hosting server logs — between 30 and 90 days, depending on the provider’s configuration;
• your cookie choice — 730 days, after which the banner is shown to you again;
• data in the analytics tools — according to the retention periods configured in Google Analytics 4, between 2 and 14 months for user-level data; aggregated data is kept indefinitely, as it no longer allows identification;
• data in the marketing tools — according to the respective platforms’ policies, typically between 90 days and 13 months;
• documents of tax and accounting relevance — the periods required by law, in principle 5 or 10 years;
• proof of consent — for the duration of its validity and 3 years after withdrawal, in order to demonstrate compliance with legal obligations.

On expiry of these periods, the data is deleted or irreversibly anonymised.

5. Who we share data with

We do not sell or rent your data. We disclose it only to the following categories of recipients, to the extent strictly necessary:

• the hosting provider — for the operation of the site and email service, as a processor;
• Google Ireland Limited — for Google Tag Manager, Google Analytics 4 and Google Ads;
• Meta Platforms Ireland Limited — for the Meta pixel, under the joint-controller arrangement described above;
• TikTok Technology Limited — for the TikTok pixel;
• accounting and legal advisers — where necessary to meet legal obligations or to defend a claim;
• public authorities — at their request, under the conditions and limits provided by law.

With each processor we have concluded a processing agreement under Art. 28 GDPR, requiring it to process the data solely on our instructions and to apply appropriate security measures.

6. Transfers outside the European Economic Area

The analytics and marketing tools we use belong to groups with infrastructure in the United States. Consequently, some data may be transferred outside the EEA.

These transfers are based on:

• the European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for US entities certified under that mechanism;
• the standard contractual clauses adopted by the European Commission, accompanied by supplementary security measures, for situations not covered by the adequacy decision.

You can request information about the safeguards applied by writing to us at contact@cc.digitalcraft.marketing.

7. Your rights

As a data subject, you have the following rights:

• the right of access (Art. 15) — to find out whether we process data about you and to obtain a copy of it, together with information about purposes, recipients and periods;
• the right to rectification (Art. 16) — to have inaccurate data corrected or incomplete data completed;
• the right to erasure (Art. 17) — also known as the “right to be forgotten”, applicable where the data is no longer necessary, you withdraw consent, or the processing was unlawful;
• the right to restriction of processing (Art. 18) — to request that processing be suspended, for example while you contest the accuracy of the data;
• the right to data portability (Art. 20) — to receive the data you provided in a structured, commonly used and machine-readable format, or to have it transmitted to another controller;
• the right to object (Art. 21) — to object to processing based on our legitimate interest; for processing for direct-marketing purposes, the objection is unconditional and must be honoured immediately;
• the right to withdraw consent (Art. 7(3)) — at any time, as easily as you gave it, without affecting the lawfulness of earlier processing;
• the right not to be subject to an automated decision (Art. 22) — including profiling, where the decision produces legal effects or similarly significantly affects you.

8. How to exercise your rights

Send us a request at contact@cc.digitalcraft.marketing, indicating the right you wish to exercise. We will respond within one month of receiving the request. This period may be extended by up to two months for complex requests, in which case we will inform you within the first month of the extension and its reasons.

Exercising your rights is free of charge. For manifestly unfounded or excessive requests, particularly repetitive ones, we may charge a reasonable fee or refuse to act on the request, giving reasons for our position.

If we have reasonable doubts about the identity of the requester, we may ask you for additional information to confirm it — strictly as much as is necessary, so as not to disclose your data to another person.

9. The right to lodge a complaint

If you consider that the processing of your data breaches the law, you can turn to the National Supervisory Authority for Personal Data Processing (ANSPDCP):

B-dul G-ral. Gheorghe Magheru no. 28-30, sector 1, Bucharest, postal code 010336
Phone: +40 318 059 211
Email: anspdcp@dataprotection.ro
www.dataprotection.ro

You can also turn to the courts. Referring a matter to the supervisory authority does not condition your access to justice.

We do, however, encourage you to contact us directly first — many situations are resolved faster that way.

10. Automated decisions and profiling

We do not make decisions with legal effect on you based solely on automated processing.

The marketing tools we use — when you give consent — do, however, build interest profiles used to target advertising. These profiles produce no legal effects and do not significantly affect your rights: the consequence is that you see certain ads rather than others. You can prevent this processing by refusing or withdrawing consent for the marketing category.

11. Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure:

• encrypted transmission of data between your device and the server, via a TLS certificate;
• access to form data limited to the people who need it in order to respond to you;
• protected authentication for the site’s administration panel;
• regular updating of software components, to remedy known vulnerabilities;
• database backups, kept separately from the production environment.

No security measure offers absolute protection. In the event of a data breach likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and will inform you directly where the risk is high, in accordance with Art. 33-34 GDPR.

12. Children’s data

The site is not addressed to persons under 16 and we do not knowingly collect data concerning minors.

If you are a parent or guardian and believe that a minor in your care has sent us personal data, please write to us at contact@cc.digitalcraft.marketing. We will delete that information without delay.

13. Cookies

Details of the cookies used — the name of each, the purpose, duration and provider — are set out in the Cookie Policy, where you can also change or withdraw your consent.

14. Changes to this policy

We may update this policy when the way we process data changes, when we add or remove tools, or when legislation requires additions.

The version in force is the one published on this page, with the date of the last update indicated at the top. For substantial changes — introducing a new processing purpose or a new recipient — we will inform you through a visible notice on the site and, where processing is based on consent, we will ask you for fresh consent.

15. Contact

Digital Craft Agency SRL
Str. Verigei nr. 3, sector 5, București
CUI RO37403193 · J40/5330/2017
For personal-data matters: contact@cc.digitalcraft.marketing