Privacy policy

The data controller is BITUP TECHNOLOGY S.R.L., a Romanian company with its registered office in Câmpia Turzii, Cluj County, registered with the Trade Register under no. J12/1556/2020, tax identification no. RO42613248, e-mail [email protected], phone +40 757 150 894. We have not appointed a data protection officer, as this obligation does not apply to us; for any question or request about your data, write to the e-mail address above.

We process data in accordance with Regulation (EU) 2016/679 (“GDPR”), Romanian Law no. 190/2018 and Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

• We collect only the data needed for the purpose for which you request or send it.
• We do not sell, rent or hand over your data to third parties for their own purposes.
• We do not use form data for unsolicited marketing and we do not add you to newsletter lists.
• Usage statistics are collected only if you agree; without consent, no measurement tool is loaded.
• The tools on the site work without an account and without us storing the results in association with you.

The processing operations are the following:

• The booking form: your name, company, e-mail address, phone (if you leave it), the stage you are at, the message, the language and the page you sent it from. Purpose: to reply to you and prepare the call or, if you want it, the contract. Basis: steps taken at your request prior to entering into a contract (art. 6(1)(b) GDPR) and our legitimate interest in communicating with those who contact us (art. 6(1)(f)). Without this data we cannot reply.
• Booking via Calendly: the data you enter in the calendar (name, e-mail, possibly phone and notes) is processed by Calendly, LLC (USA) on our behalf to create the invitation, under its privacy policy. Basis: art. 6(1)(b) GDPR.
• The “Does NIS2 apply to me?” tool: the fiscal identification code you enter is sent, through our server, to ANAF’s public services, which return public data about the company (name, registered office, NACE code, financial indicators). We do not associate it with you, do not store it in logs and do not keep the result in association with the visitor; the server keeps a temporary copy of ANAF’s response (at most 24 hours), for speed only. Company data is not, as a rule, personal data; for sole traders it may be, and the basis is our legitimate interest in providing the tool you requested (art. 6(1)(f)), the data being public. Your answers to the tool’s questions and the result stay in your browser and are not sent to us.
• Technical data: IP address, browser type, pages accessed, date and time, in the logs of the hosting server and of the service behind the tools. Purpose: security, abuse prevention (including rate limiting) and troubleshooting. Basis: legitimate interest (art. 6(1)(f)). Retention: at most 30 days.
• Usage statistics: if you choose “Accept” in the banner, Google Analytics 4 and, on nis2.cyberxscore.ro only, Meta Pixel load and use cookies and identifiers to measure the use of the site and the results of our campaigns. The IP address is truncated in Google Analytics; we do not enable Google advertising signals and we do not use the data for personalised advertising. Basis: your consent (art. 6(1)(a) GDPR and art. 4 of Law no. 506/2004), which you can withdraw at any time from “Cookie settings”.
• Anti-spam protection of the form (Cloudflare Turnstile): to tell humans from bots, Cloudflare, Inc. processes technical signals from your browser, without identifying you and without advertising profiling. Basis: our legitimate interest in protecting the form and our services (art. 6(1)(f)).
• The theme preference (light or dark) and your choice regarding statistics are kept in your browser (local storage and a first-party cookie respectively) and are not sent to us.

Data is accessible to the people at BitUp who handle replies. We transfer it only to the providers we need for the site to work, as processors or independent controllers, under contract:

• the hosting provider of the site and of the service behind the tools, with servers located in the European Union;
• Resend, Inc. (USA), for delivering form messages to us, and the provider of our e-mail service;
• Calendly, LLC (USA), for booking calls;
• Cloudflare, Inc. (USA), through which the site’s traffic passes (protection against attacks and delivery of the pages, so it sees your IP address and requests), for anti-spam protection of the form and for domain name services;
• Google Ireland Limited (Google Analytics 4) and Meta Platforms Ireland Limited (Meta Pixel), only if you have consented to statistics; these providers also process data for their own purposes, under their policies.

We may also disclose data when required by law or when necessary to establish, exercise or defend a legal claim.

Some of the providers listed above are established or process data in the United States of America. Transfers take place under Commission Implementing Decision (EU) 2023/1795 on the EU-U.S. Data Privacy Framework, for certified providers, or under the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. Copies of the safeguards may be requested at the contact address.

• Form messages and subsequent correspondence: 12 months from the last exchange, if no contract follows; if one follows, for the duration of the contractual relationship and then per statutory archiving periods.
• Technical logs: at most 30 days.
• The temporary copy of ANAF responses: at most 24 hours, unrelated to the visitor.
• Statistics data: per the settings of Google Analytics 4 (at most 14 months) and of Meta; cookies have the durations in the Cookie policy.
• Your choice regarding statistics: 6 months, in the first-party cookie; after expiry, the banner appears again.

Under the GDPR you have the right of access to your data, to rectification, to erasure, to restriction of processing, to data portability, the right to object to processing based on legitimate interest and the right to withdraw your consent at any time, without affecting the lawfulness of prior processing. We do not take decisions based solely on automated processing that produce legal effects on you.

To exercise your rights, write to [email protected]. We reply within one month; in complex cases the period may be extended by two months, with notice to you. We may ask for information to confirm your identity.

If you consider that the processing breaches the law, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Blvd., Sector 1, Bucharest, [email protected], www.dataprotection.ro, or with the competent court.

The site is served exclusively over encrypted connections (HTTPS), with security headers and rate limiting on the tools; access to received messages is restricted to the people who handle replies; we do not store tool data. We apply technical and organisational measures reasonable in relation to the risks, although no system can be considered infallible; in the event of a personal data breach likely to result in a risk to you, we will inform you as required by law.

The site is aimed at professionals and people representing entities. We do not knowingly process data of persons under 16; if we learn that we have received such data, we delete it.

We update this policy when processing operations or legislation change. The version in force is the one published on this page, with its date. In case of discrepancy between the Romanian and the English version, the Romanian version prevails.

For any question about your data: [email protected] or the registered office address in article 1.