DraftClauses marked Draft are awaiting review by a lawyer and may change.
Data controllerDraft: clause awaiting legal review
The controller for personal data collected through this site is ELASTO TECHNOLOGIES S.R.L., a Romanian limited liability company.
- Registered office
- Aleea Valeriu Bologa nr. 3, Cluj-Napoca, Cluj County, Romania
- Trade register
- J12/4033/2021
- Tax code (CUI)
- RO44786830
ELASTO has not appointed a data protection officer, because the processing described here does not require one under Article 37 GDPR. Privacy questions go to the email address above.
Data collected
Through the contact form, the site receives:
- name and email address (required)
- company name, area of work and timeline (optional)
- the project details written in the form
Every request to the site also carries technical data: IP address, browser, operating system, the page requested and the time. The hosting provider processes it to deliver pages and keep them secure. The contact endpoint uses the IP address to limit repeated submissions; that counter lives in memory for at most ten minutes and is never written to storage.
With consent, Google Analytics also receives a pseudonymous identifier, the pages viewed, the referring page, device and browser data and the IP address (used only for approximate location; see Google Analytics).
The form does not ask for special categories of data (Article 9 GDPR). Health, financial or other sensitive details do not belong in it.
Purposes and legal basesDraft: clause awaiting legal review
| Purpose | Data | Legal basis |
|---|---|---|
| Answering a brief and preparing an offer | Form data | Steps taken at the sender's request before a contract, Article 6(1)(b); legitimate interest in answering business enquiries, Article 6(1)(f) |
| Protecting the form against spam and abuse | IP address, a hidden spam-trap field | Legitimate interest, Article 6(1)(f) |
| Visit statistics without cookies (Vercel Web Analytics) | Aggregated page views | Legitimate interest, Article 6(1)(f) |
| Traffic statistics with Google Analytics, only after Accept | Pseudonymous identifier, pages viewed, referrer, device and browser data, approximate location, IP address (used for approximate location, then discarded) | Consent, Article 6(1)(a), which can be withdrawn at any time |
| Delivering and securing the site | Technical request data | Legitimate interest, Article 6(1)(f) |
- Purpose
- Answering a brief and preparing an offer
- Data
- Form data
- Legal basis
- Steps taken at the sender's request before a contract, Article 6(1)(b); legitimate interest in answering business enquiries, Article 6(1)(f)
- Purpose
- Protecting the form against spam and abuse
- Data
- IP address, a hidden spam-trap field
- Legal basis
- Legitimate interest, Article 6(1)(f)
- Purpose
- Visit statistics without cookies (Vercel Web Analytics)
- Data
- Aggregated page views
- Legal basis
- Legitimate interest, Article 6(1)(f)
- Purpose
- Traffic statistics with Google Analytics, only after Accept
- Data
- Pseudonymous identifier, pages viewed, referrer, device and browser data, approximate location, IP address (used for approximate location, then discarded)
- Legal basis
- Consent, Article 6(1)(a), which can be withdrawn at any time
- Purpose
- Delivering and securing the site
- Data
- Technical request data
- Legal basis
- Legitimate interest, Article 6(1)(f)
Form data does not go into newsletters or marketing lists, and it is not sold or shared for advertising.
Visit statistics without cookies
Visit statistics come from Vercel Web Analytics. The script is served from the site's own domain, sets no cookies and stores nothing in the browser. Visitors are counted through a hash of the incoming request rather than a cookie, and Vercel discards that hash after 24 hours, so no visitor can be followed from one day to the next.
The dashboard shows totals only: pages, referrers, countries, device types, browsers and operating systems. The cookies page lists everything the site stores in a browser; Google Analytics runs only with consent.
Google AnalyticsDraft: clause awaiting legal review
With consent, the site also measures traffic with Google Analytics 4: which pages are visited, where visitors come from and how long they stay. Google Analytics loads only after Accept in the cookie banner; before that, the browser sends nothing to Google. The legal basis is consent (Article 6(1)(a) GDPR and Article 4(5) of Law 506/2004).
Google Analytics sets the _ga and _ga_75EFXYQVGC cookies and collects a pseudonymous identifier, the pages viewed, the referring page, device, browser and operating system data, and an approximate location. According to Google, Google Analytics 4 does not log or store IP addresses: for visitors in the EU, the IP address is used on EU servers to derive the approximate location and is then discarded. Google Signals, advertising features and ads personalisation are switched off, and no user ID is sent.
Google Ireland Limited processes this data as ELASTO's processor under the Google Ads Data Processing Terms, which cover Google Analytics. Sharing Analytics data with Google for Google's own purposes is switched off. Google explains its processing at How Google uses information from sites or apps that use our services.
Consent can be withdrawn at any time through Cookie settings in the footer. Withdrawal stops Google Analytics on that site (each language domain keeps its own choice) at once and deletes its cookies; data collected before it stays lawful, and event and user-level data are deleted when the 2-month retention period ends.
Processors and recipientsDraft: clause awaiting legal review
Four providers process personal data on ELASTO's behalf, each under a data processing agreement:
| Provider | Role | Data | Established in |
|---|---|---|---|
| Vercel Inc. | Hosting, the contact endpoint and visit statistics | Technical request data, form data in transit, aggregated statistics | United States |
| Resend | Delivers each brief to the ELASTO inbox | Form data | United States |
| Namecheap (Private Email) | Hosts the contact@elastoapps.com mailbox | Form data and replies | United States |
| Google Ireland Limited | Traffic statistics (Google Analytics), only with consent | Pseudonymous identifier, pages viewed, device data, approximate location, IP address (for approximate location) | Ireland (EU); Google LLC, United States, as sub-processor |
- Provider
- Vercel Inc.
- Role
- Hosting, the contact endpoint and visit statistics
- Data
- Technical request data, form data in transit, aggregated statistics
- Established in
- United States
- Provider
- Resend
- Role
- Delivers each brief to the ELASTO inbox
- Data
- Form data
- Established in
- United States
- Provider
- Namecheap (Private Email)
- Role
- Hosts the contact@elastoapps.com mailbox
- Data
- Form data and replies
- Established in
- United States
- Provider
- Google Ireland Limited
- Role
- Traffic statistics (Google Analytics), only with consent
- Data
- Pseudonymous identifier, pages viewed, device data, approximate location, IP address (for approximate location)
- Established in
- Ireland (EU); Google LLC, United States, as sub-processor
Briefs are read by George Flutur. Personal data goes to public authorities only where the law requires it.
Transfers outside the EUDraft: clause awaiting legal review
Vercel, Resend and Namecheap are established in the United States, so personal data may leave the European Economic Area. Each transfer relies on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, where the provider is certified under it, or on the Standard Contractual Clauses in the provider's data processing agreement (Article 46 GDPR).
Google Ireland Limited uses Google LLC in the United States as a sub-processor for Google Analytics. Google LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision, with the Standard Contractual Clauses in the Google Ads Data Processing Terms as a fallback.
RetentionDraft: clause awaiting legal review
- Briefs that do not lead to a project: deleted once the conversation has ended.
- Briefs that lead to a contract: kept with the contract file for as long as Romanian accounting and tax rules require.
- Rate-limit counters: at most ten minutes, in memory.
- Visit statistics: aggregated; the request hash is discarded after 24 hours.
- Google Analytics: event-level and user-level data for 2 months (the property's retention settings), then deleted; aggregated reports that identify no one are kept. The _ga cookies for up to 6 months, as long as the cookie choice (cookies page). Withdrawing consent deletes the cookies at once.
- Provider logs: delivery logs at Resend and request logs at Vercel, for the period set by each provider.
Rights under the GDPR
Anyone whose data this site processes can ask ELASTO to:
- confirm whether their data is processed and provide a copy (Article 15)
- correct inaccurate data (Article 16)
- delete the data (Article 17)
- restrict the processing (Article 18)
- hand over the data in a portable format (Article 20)
- stop processing based on legitimate interest, by objecting to it (Article 21)
Consent can also be withdrawn at any time through Cookie settings in the footer, without affecting processing that happened before the withdrawal (Article 7(3)).
Requests go to contact@elastoapps.com. The answer comes within one month, as Article 12(3) GDPR requires, free of charge.
Complaints
Complaints can go to the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, dataprotection.ro, or to the supervisory authority in the country of residence.
Automated decisions and required data
The site makes no automated decisions with legal or similarly significant effects (Article 22 GDPR). With consent, Google Analytics groups visits from one browser under a pseudonymous ID, for traffic statistics only; nothing is used for marketing or decisions about a person.
Sending data through the form is voluntary; without a name and an email address, a reply is not possible.
Changes to this policy
The policy changes when the site or its providers change. The date at the top of the page marks the current version.