What we do with personal data

Who holds your data

ROPOTVS SRL, CUI 54341830, registered office Str. Fântânilor 43, bl. B14, ap. B39, 700337 Iași, județul Iași, Romania, is the controller of the personal data described here.

We have not appointed a data protection officer. [email protected] reaches the person who decides these things, including for any request to exercise a right.

The short version

We hold three kinds of personal data: what lets us reach you, what you publish, and what pays for the page. We publish what goes on your page, because publishing it is the service you bought. We keep the invoices Romanian law obliges us to keep. There is no account and no password on this site, so there are no credentials for us to lose. We do not sell personal data, we run no advertising, and we do not track the people who read your page.

What we collect

• Contact: your name, your email address and your phone number, including the WhatsApp number you write to us from, because that is where an order starts and where changes are asked for.
• The conversation: the messages you send us on WhatsApp or by email about your page, kept as the record of what you asked for and what we agreed.
• Your materials and your page: what you send us to build the page from, and everything published on it, which is public by design.
• Payments: the amount, date, currency and the provider’s reference, plus the billing details an invoice has to carry. Full card details go to the payment provider and never reach us.
• Technical: server and delivery logs, which include IP addresses, kept briefly for security and troubleshooting.

The site sets no cookies, runs no analytics and carries no advertising or tracking of any kind.

Why we process it, and on what legal basis

• To give you what you bought, the page built, the address, the hosting, the changes you ask for: performing our contract with you.
• To issue invoices, report them to the tax authority, and keep accounting records: a legal obligation under Romanian law.
• To investigate reports about a page and apply our terms: our legitimate interest, and the interest of the people reading the page.
• To keep the service secure and prevent abuse: our legitimate interest.
• To write to you about your own page, renewals, the grace month, decisions that affect you: performing the contract. We do not send marketing without asking first.

What is public, and for how long

Your page is published on the open internet and is meant to be found. Search engines index it, the link unfurls into a preview when somebody shares it, and the page carries structured data describing you, your work and your contact details so that machines can read it as well as people. Everything on it is public for as long as the page is live, and may survive for a while afterwards in caches and search results we do not control.

We add nothing of our own except the line that closes the page: a copyright notice naming you.

Choose what goes on the page accordingly. Nothing obliges you to publish a street address, a phone number, or a photograph of yourself.

The people who read your page

A page is static files. It loads its text, images, video and fonts from our own hosting, and embeds no player, no social widget, no advertising and no analytics script, so reading a page hands nobody a record of the visit. Nobody is asked to accept cookies because none are set.

The message form never sends anything through us: it composes the message in the visitor’s own mail application, addressed to you, and what happens next is an ordinary email between the two of you. We store none of it and never see it.

Links leave. Directions open in a map service, and your action button, your products, your files and your social channels go wherever you point them. Once a visitor follows one, they are on somebody else’s site under somebody else’s notice, not this one.

What remains is the delivery log described above: the ordinary record a web server keeps of requests, held briefly for security.

Who else sees it

We use suppliers who process data on our behalf, under contracts that bind them to it:

• Cloudflare: hosting, storage and delivery of the site and its media.
• Revolut Business Merchant: collecting fees and holding card details.
• Our accountants and invoicing software, for issuing and reporting invoices.

Orders and change requests arrive over WhatsApp, which is Meta’s service, not ours. Anything you send us there passes through Meta under Meta’s own terms and privacy notice. If you would rather not use it, [email protected] does the same job.

We also give data to public authorities where the law requires it: invoices go to the Romanian tax authority because electronic invoicing rules oblige us to send them. We do not sell personal data and we do not share it for anybody else’s marketing.

Transfers outside the EEA

Some suppliers process data outside the European Economic Area. Where that happens we rely on the European Commission’s standard contractual clauses, or on an adequacy decision for the country concerned. Ask us and we will tell you which supplier processes what, and where.

How long we keep it

• Your page and its media: while the page is live, and after it comes down so that paying restores it. Ask us to delete them and they go.
• The order and change conversation: while the subscription runs, and a short period after it ends.
• Invoices and accounting records: ten years, as Romanian law requires, whatever else you delete.
• Server logs: a short period, measured in weeks.

Your rights

You may ask us for a copy of your data, ask us to correct it, delete it, or restrict what we do with it, ask us to hand it to somebody else, object to processing we base on legitimate interest, and withdraw consent wherever we rely on it.

Ask us and we will send you everything we hold about you: your page’s content as a file, plus your media.

Some rights have limits. We cannot delete an invoice the law obliges us to keep.

Write to [email protected] and we will answer within one month. If you believe we have handled your data badly, you may complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or to the authority where you live.

Security

Data travels encrypted, sits with suppliers contractually bound to protect it, and is reachable by as few people as possible. We hold no identity documents, no card numbers and no passwords, which is the simplest protection there is against losing them.

No system is perfect. If a breach ever puts you at risk we will tell you and the supervisory authority, as the law requires.

Changes, and how to reach us

If we change this notice we will publish the new version here under a new date, and tell members by email where the change matters to them. Any question about any of it goes to [email protected].