Privacy Policy
This English version is provided for convenience only. The Romanian version (Politica de confidențialitate) is the legally binding one and prevails in case of any discrepancy.
Last updated: 12 October 2026
This policy explains what personal data we process, why, how long we keep it, who we share it with and what rights you have. It applies to:
- visitors to e-gata.ro and demo.e-gata.ro;
- persons who request a demo or write to us, including individuals without a company;
- representatives of our business customers;
- our individual (natural person) customers;
- representatives of companies for which we created a demo on our own initiative.
1. Who the controller is
Secure IT Solutions SRL, tax identification number (CUI) RO20624157, Trade Register No. J2007000751400, registered office at Str. Pescărușului nr. 4, bl. D4, sc. B, et. 4, ap. 29, Sector 2, București, which operates e-gata.ro ("e-gata", "we").
Contact for personal data: contact@e-gata.ro (write "Personal data" in the subject line). We do not have a data protection officer (DPO), because the law does not require us to. All requests reach the person responsible for data protection within the company.
2. What data we process, why and on what legal basis
| Situation | What data | Why | Legal basis (GDPR) |
|---|---|---|---|
| You visit the website | IP address, browser and device type, pages accessed, technical security data | operation and security of the website, protection against bots (Cloudflare Turnstile) | legitimate interest (Art. 6(1)(f)): a secure and functional website |
| You accept analytics or marketing cookies | cookie identifiers, interactions with the website, source of the visit (gclid, fbclid, utm) | statistics (Google Analytics 4); measurement of Google Ads and Meta advertising | consent (Art. 6(1)(a) + Art. 4(5) of Law 506/2004). Details in the Cookie Policy |
| You generate a demo | the display name (company, brand or personal name), field of activity, city, email or phone number you entered; the CUI only if you enter it (and then also the company's public data from the ONRC/ANAF registers). If you are an individual, the display name may be your own name | to generate and show you the demo you requested | steps taken at your request before a possible contract (Art. 6(1)(b)) |
| You request the demo by email | email address, the associated demo | to send you the demo | performance of your request (Art. 6(1)(b)) |
| You tick that you want messages about the demo | email, date of consent | 2 messages about the demo (day 3 and day 6) | consent; you can unsubscribe from any message |
| You write to us (form, email, WhatsApp) | name, email, phone, content of the message | to reply to you | legitimate interest / steps prior to entering into a contract (Art. 6(1)(b)) |
| You talk to the AI assistant | content of the conversation, date, page; name and contact details only if you provide them and agree to them being saved | to answer questions; to have a colleague contact you, if you ask | legitimate interest for answers; consent for saving the contact details |
| You activate a subscription as a business | company data (from ANAF), name, email and phone of the contact person, IP address and time of acceptance of the Terms, the professional status declaration | conclusion and performance of the contract, pro forma invoice, payment, delivery | contract (Art. 6(1)(b)) |
| You activate a subscription as an individual | first and last name, home address, email, phone, the chosen package, IP address and time of acceptance of the Terms, the request for immediate start (if ticked). We do not ask for your personal identification number (CNP) or a copy of your ID | conclusion and performance of the contract, pro forma invoice, payment, delivery; evidence of the information provided and of the request for immediate start | contract (Art. 6(1)(b)); evidence: legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
| You sign the contract online (after payment) | the signatory's name and, for businesses, position; the email address to which we send the verification code; the date and time of signing; the IP address (partially anonymised) and browser type; the verification code (valid for 10 minutes, stored only as a cryptographic value, never in clear text); the digital fingerprint (SHA-256) of the contract | electronic signature of the contract (simple electronic signature, with a one-time code sent by email) and proof of signing | contract (Art. 6(1)(b)) |
| Configuring your domain | the domain name; the DNS access you grant us (the name servers we indicate, the DNS records you add or delegated access in your registrar account); the domain's expiry date, if you tell us. We do not ask for your registrar account password and we do not receive your CNP: you buy the domain directly from the registrar of your choice, which processes the holder's data as an independent controller, under its own policy | publishing the website, configuring email and the SSL certificate; possibly a reminder before the domain expires | contract (Art. 6(1)(b)) |
| Invoicing | invoice data (for individuals: name and address, no CNP), payments (amount, date, payer account from the bank statement) | tax and accounting obligations, e-Factura | legal obligation (Art. 6(1)(c)) |
| Support and changes | messages, requests, files sent | performance of the service | contract |
| You give us access to your social media accounts, or we create them together with you (Complete and Growth packages) | the delegated access you grant us to your Facebook page, Instagram account and TikTok account; for accounts we create in the name of the business: the business name, email and telephone number you give us for the account (the accounts are yours; we do not keep the passwords of your personal accounts); the texts, images and video clips you send us for publication | to create and configure the accounts and to publish the posts and clips on your behalf | contract (Art. 6(1)(b)). You can withdraw access at any time from the platform's settings |
| Companies for which we created a demo on our own initiative | company name, field of activity (CAEN code), city, the company's public contact details (including the public email address on the company's website); for PFA/II (sole traders and individual enterprises) these are data of a natural person | to present the company with a relevant demo | legitimate interest (Art. 6(1)(f)). See section 4 |
| Withdrawal requests, cancellations, complaints, DSA notices | form data, date and time; for refunds by bank transfer, the account to which we return the money | handling the request, the refund and keeping evidence of it | legal obligation / legitimate interest |
| Suppression list | the email address or domain that objected, date | so that we do not contact you again | legal obligation (respecting the objection) |
We do not use decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR). We automatically rank potentially interested companies according to technical criteria (for example, whether they have a website), but this does not produce legal effects. The CUI check upon activation only confirms that the company exists and is active. If activation is refused, you can write to us and a human will review it.
We do not intentionally process sensitive data (health, religion etc.) and we do not ask for it.
3. Where we obtain the data from
- From you: forms, email, chat, activation.
- From public sources, only in two situations: (1) if you enter a CUI when generating a demo or on activation: the ANAF database and the open datasets of the Trade Register (data.gov.ro, ONRC); (2) for companies for which we create a demo on our own initiative: the same registers and the company's public website (home or contact page, for the email address published by the company). We do not use data from Google Maps / Google Places.
- Automatically: from the browser (cookies, only with consent, and technical data).
4. Companies for which we created a demo on our own initiative (Art. 14 GDPR)
If your company has received from us a link to a demo, please read the Notice to Contacted Companies. In short:
- we use only the company's public data;
- the demo is deleted after 7 days;
- if you do not reply, we delete the company's data from our prospecting records;
- you can object at any time, with one click or by email, and we will then never contact you again.
We carried out a legitimate interest assessment and concluded that the processing is proportionate:
- we use company data, published by the company for commercial purposes, for a proposal relevant to its activity;
- we send a single message, with full information;
- the right to object takes effect immediately;
- deletion is prompt.
We do not use personal email addresses, personal social media profiles, personal numeric codes (CNP) or data about shareholders as individuals.
5. Who we share the data with
We do not sell data. We share it only with providers who help us deliver the service (processors, under a contract compliant with Art. 28 GDPR) and with authorities, when the law requires us to.
| Recipient | For what | Where it is processed |
|---|---|---|
| Cloudflare, Inc. | DNS, protection, the secure connection to demo.e-gata.ro, Turnstile (anti-spam) | global, including the US |
| Google (Google Ireland Ltd. / Google LLC) | Google Analytics 4, Google Tag Manager, Google Ads (only with consent) | EU and US |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Meta Pixel and Conversions API (only with consent); WhatsApp Business for messages with customers; publishing posts on customers' Facebook pages and Instagram accounts, with the access they grant | EU and US |
| TikTok Technology Limited (Ireland) | publishing clips on the customer's TikTok account, with the access the customer grants (Complete and Growth packages). For data on the platform, TikTok is an independent controller under its own policy | EU; TikTok may transfer data outside the EEA |
| Anthropic (Anthropic Ireland Ltd. / Anthropic PBC) | the Claude artificial intelligence model, for the chat assistant and for the texts of the demos and websites | US |
| SmartBill (Intelligent IT S.R.L.) | pro forma invoices, invoices, e-Factura | Romania |
| Gazduire.net (România) | hosting of customers' websites and email | România |
| ANAF | querying public company data; submitting invoices to e-Factura | Romania |
| e-gata's own infrastructure (servers in Romania) | records of requests, customers and demos | Romania |
| Public authorities, courts, advisers (lawyer, accountant) | when the law requires it or for the defence of a right | Romania |
We receive internal notifications (for example, a new request or a request to talk to a colleague) by email, at contact@e-gata.ro, through our own email server (mail.e-gata.ro), hosted by the hosting provider in the table above. We do not use third-party messaging apps for these notifications.
6. Transfers outside the European Economic Area
Some providers process data in the US. Transfers are made on the basis of the following safeguards:
- the EU–US adequacy decision (EU-US Data Privacy Framework), for certified providers: Google LLC, Meta Platforms, Inc., Cloudflare, Inc., Anthropic, PBC where applicable (the status is checked on dataprivacyframework.gov);
- the standard contractual clauses (SCCs) adopted by the European Commission (Decision 2021/914), for Anthropic and as an additional safeguard for the others.
You can request a copy of the safeguards at contact@e-gata.ro.
7. How long we keep the data
| Data | Period |
|---|---|
| Non-activated demos (the page + the data entered by the requester, including individual requesters) | 7 days, then automatic deletion |
| Data of companies for which we created a demo on our own initiative, with no reply | deleted after 7 days, together with the demo |
| The email left for the demo and the saved demo (~5 KB, so that we can regenerate it) | 12 months from the last interaction or until you unsubscribe |
| Messages received (form, email, WhatsApp) from persons who do not become customers | 12 months from the last message |
| Conversations with the AI assistant | 7 days, then automatic deletion (including at the AI provider, in accordance with our contract with it) |
| Contract data and correspondence with customers | term of the contract + 3 years |
| Evidence of acceptance of the Terms, of the professional status declaration (businesses), of the pre-contractual information and of the request for immediate start (individuals) | term of the contract + 3 years |
| The signed contract and the proof of electronic signature (the signatory's name and position, the email verified by code, date and time, partially anonymised IP address, browser, SHA-256 fingerprint) | for as long as we keep the contract: term of the contract + 3 years |
| DNS access and domain configuration data; delegated access to social media accounts | the duration of the contract; we remove our access on termination |
| Invoices and accounting documents | 10 years (Accounting Law No. 82/1991) |
| Cookie consent log (without the full IP address) | 3 years from the expiry or withdrawal of consent |
| Cookies | in accordance with the Cookie Policy |
| Analytics data in Google Analytics | 14 months |
| Server technical logs | 30 days |
| Withdrawal requests, complaints, DSA notices, GDPR requests | 3 years |
| Suppression list (persons who objected) | for as long as we carry out prospecting, so that we respect the objection; we keep only the address or domain and the date |
8. Your rights
You have the right:
- to information and access (Art. 15): to find out what data we hold and to receive a copy;
- to rectification (Art. 16);
- to erasure (Art. 17), when the data are no longer necessary, when you withdraw your consent or when you object;
- to restriction of processing (Art. 18);
- to data portability (Art. 20), for the data you provided on the basis of a contract or consent;
- to object (Art. 21), at any time, to processing based on legitimate interest. For direct marketing, including the prospecting of companies, the objection takes effect immediately, without justification;
- to withdraw your consent at any time (for example, from "Cookie settings" or via the unsubscribe link), without affecting the processing carried out until then;
- not to be subject to a decision based solely on automated processing with legal effects (Art. 22). We do not take such decisions.
How to exercise them: an email to contact@e-gata.ro. We reply within one month at the latest. In complex cases, this period may be extended by a further two months, with the reason communicated within the first month. Exercising your rights is free of charge. We may ask for information to confirm your identity.
Complaint: you may lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro, or with the competent court.
9. Data we process on behalf of customers
For messages sent by visitors via the forms of the websites we create (and via the chatbot, on the Growth package), the controller is the company that owns the website, and we are the processor, in accordance with the Data Processing Agreement. For rights concerning these data, please contact the company concerned. If you write to us, we will forward your request to it. If the website belongs to an individual, please contact the website's owner; if that does not work, write to us and we will help.
10. Security
We apply appropriate technical and organisational measures:
- encrypted connections (HTTPS);
- restricted access, with strong authentication;
- encrypted backups;
- automatic deletion when the retention period ends;
- data minimisation;
- incident procedures.
If a personal data breach occurs that poses a risk to you, we notify ANSPDCP within 72 hours and, if the risk is high, we also inform you.
11. Changes
When we update this policy, we change the date at the top. We announce significant changes to customers by email.