Privacy Policy

This privacy policy describes how Hosu Paul, self-employed sole trader ("PFA") (hereinafter the "Operator" or "we"), processes the personal data of users of the tigidal.ro website and of individuals who contact us.

Operator's identification details:

• Name: Hosu Paul PFA

• Registered office: Brașov, Romania

• GDPR contact email: office@tigidal.ro

• Phone: +40 774 820 272

We are not legally required to appoint a Data Protection Officer (DPO) under Art. 37 GDPR. For any request regarding your personal data, you may contact the Operator directly using the details above.

We collect and process only the data strictly necessary to respond to your requests and to provide our services. Each category is detailed below:

a) Identification and contact details (Contact form and Wizard form)

• Data collected: name, email address, phone number (optional).

• Source: provided directly by you when filling in the forms on the site.

• Legal basis: Art. 6(1)(b) GDPR — processing necessary for pre-contractual steps taken at your request (responding to your inquiry, service proposal). For optional fields (phone), the legal basis is Art. 6(1)(a) GDPR — your consent, expressed by filling in the field.

b) Content of your communication and wizard answers

• Data collected: the message sent through the contact form, the answers to the estimate wizard questions (project type, desired features, stage, urgency), and the automatically generated estimate.

• Source: provided directly by you.

• Legal basis: Art. 6(1)(b) GDPR — necessary to be able to formulate a response or a personalized offer.

c) Technical usage data

• Data collected: IP address, user agent (browser type), request timestamp — used exclusively for rate limiting and abuse protection (spam, automated attacks).

• Source: collected automatically by our server on every request.

• Legal basis: Art. 6(1)(f) GDPR — the Operator's legitimate interest in ensuring the security and availability of the service. This interest has been assessed and considered proportionate given the minimal impact on you.

d) Traffic analytics data (first-party, self-hosted analytics)

• Data collected: pages visited, scroll depth, viewed sections, interactions with elements (clicks), time spent on page, a random session identifier, user agent, and referrer. We do NOT use ads, retargeting, or cross-site third-party tracking.

• Source: collected through our own analytics script, sent to our own server (see section 5).

• Legal basis: Art. 6(1)(a) GDPR — your consent, expressed by clicking "Accept all" in the cookie banner. If you choose "Essential only", this data is NOT collected.

We process your data exclusively for the following purposes:

• Responding to requests submitted through the contact form;

• Generating a rough cost and time estimate based on your wizard answers;

• Notifying the Operator by email (using the Resend service) when we receive a new lead or a new estimate, so we can respond quickly;

• Establishing a subsequent business conversation (phone, email) with a view to concluding a services agreement;

• Ensuring the security of the site and preventing abuse;

• Understanding how the site is used (only with explicit consent for analytics) to improve content and UX.

We do NOT use your data for automated profiling with legal effects, direct marketing without consent, or sale to third parties. EVER.

We keep your data only for as long as necessary for the purposes for which it was collected:

• Leads and estimates (contact form, wizard): kept for a maximum of 24 months from the last interaction with you, with periodic review and deletion upon request or upon expiry of that term. If we are legally required to keep it longer (e.g. tax obligations related to a concluded contract), the terms set out in Romanian tax law apply.

• Technical data (rate limiting): kept for as long as necessary for abuse protection; not used for profiling.

• Analytics events (random session identifier): analytics events, associated with a random session identifier, are kept for a maximum of 180 days and are then automatically deleted from the server.

You have the right to request deletion of your data earlier than these terms at any time (see section 6).

Your data is not sold, rented, or shared with third parties for marketing purposes. We only share it with the following service providers (processors), who process the data exclusively on our behalf and under processing agreements compliant with Art. 28 GDPR:

a) Hetzner Online GmbH (server / VPS hosting)

• Processing location: data centers in Germany / Finland (European Union).

• Purpose: hosting the SQLite database with leads and estimates, and hosting the web application.

• Transfer outside the EU: NO.

b) Resend (transactional email delivery service)

• Processing location: Resend, Inc. — infrastructure on Amazon Web Services, possibly processed in the United States.

• Purpose: sending email notifications to the Operator when we receive a new lead or estimate.

• Transfer outside the EU: YES, to the US. The transfer relies on Standard Contractual Clauses (SCC) approved by the European Commission (Decision 2021/914) and/or the EU-US Data Privacy Framework, where the provider is certified.

c) First-party analytics (self-hosted, tigidal.ro server)

• Processing location: our server on Hetzner infrastructure (data centers in Germany / Finland, European Union).

• Purpose: understanding how the site is used (pages visited, scroll, interactions) to improve content and UX.

• Data: events with a random session identifier; we do NOT share this data with third parties and do NOT correlate it with form leads without a separate process.

• Transfer outside the EU: NO.

We may also disclose your data to public authorities when legally required (e.g. criminal investigation bodies, tax authorities, ANSPDCP as part of an investigation).

As a data subject, you have the following rights regarding your personal data:

• Right of access (Art. 15) — to obtain confirmation of whether we process data about you and a copy of it.

• Right to rectification (Art. 16) — to correct inaccurate or incomplete data.

• Right to erasure / "right to be forgotten" (Art. 17) — to request deletion of your data under the conditions set out in the regulation.

• Right to restriction of processing (Art. 18) — in certain situations (e.g. you contest the accuracy of the data).

• Right to data portability (Art. 20) — to receive your data in a structured, commonly used format (JSON or CSV).

• Right to object (Art. 21) — to object to processing based on legitimate interest.

• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, withdrawal can be made at any time, without affecting the lawfulness of prior processing.

• Right not to be subject to automated decision-making (Art. 22) — we do not use automated profiling with legal effects. The estimate generated by the wizard is indicative and does not constitute a firm offer.

How to exercise your rights: send a request to office@tigidal.ro or to the Operator's registered office. We will respond within a maximum of 30 days (which may be extended by a further 60 days for complex requests, with prior notice).

Right to lodge a complaint with the supervisory authority: if you believe your rights have been violated, you may contact the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Address: B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, Bucharest, Romania

• Phone: +40.318.059.211 / +40.318.059.212

• Email: anspdcp@dataprotection.ro

• Website: www.dataprotection.ro

The tigidal.ro website uses strictly necessary cookies and local storage required for functionality (e.g. cookie consent preference, keeping the admin session active). These do NOT require consent under ePrivacy legislation.

We do NOT use marketing, retargeting, or cross-site tracking cookies (Facebook Pixel, Google Ads, etc.).

For traffic analysis we use our own (first-party) system, enabled only if you click "Accept all" in the banner. We collect events such as pages visited, scroll depth, and interactions with elements; the data is sent to our own server and is not shared with third parties.

You can always configure your browser to block cookies and local storage; this may affect some functionality (including re-displaying the consent banner).

We apply reasonable technical and organizational measures to protect your data:

• Encrypted HTTPS (TLS) connection across the entire site;

• Access to the admin area protected by JWT token authentication and hashed passwords (bcrypt);

• Reasonable technical and organizational measures for data protection and recovery;

• Restricted access to personal data — only the Operator has access to the database;

• Regularly updated server with security patches;

• Rate limiting to prevent automated attacks;

• Strict input validation to prevent injection attacks (SQL injection, XSS).

In the unlikely event of a security breach that poses risks to your rights, we will notify ANSPDCP within 72 hours and inform you directly if the risk is high, in accordance with Art. 33-34 GDPR.

This policy may be updated occasionally to reflect changes in our practices, legal requirements, or the service providers used.

The current version is always displayed on this page, together with the date of the last change (see header).

Significant changes will be announced via a banner on the homepage for at least 30 days.

We recommend that you periodically re-read this policy.

For any question, request, or exercise of your rights regarding your personal data, you can contact us:

• Email: office@tigidal.ro

• Phone / WhatsApp: +40 774 820 272

• Mail: Hosu Paul PFA, Brașov, Romania

We will respond within a maximum of 30 calendar days from receiving the request.