Privacy Policy

The rest of this page is the detail. It is written to be read, not to be skipped.

The controller is:

IELLO TECH S.R.L.
Str. Argentina nr. 25, Bucharest, Sector 1, 011753, Romania
Trade register J40/12189/2021 · Fiscal code (CUI) 44593082
Email: [email protected]

"Controller" means we decide why and how your data is processed.

We have not appointed a Data Protection Officer. We are not a public authority, we do not monitor people on a large scale, and we do not process special categories of data on a large scale, so Article 37 GDPR does not require one. For any data-protection question, write to [email protected]. That address reaches a person, not a queue.

We are established in Romania, so no EU representative under Article 27 GDPR is needed.

We process personal data for four purposes. Each has its own basis. We do not use a blanket "you consented" for everything, because that would not be true.

What we collect — the fields of the contact form: your name, your work email address, your organisation, your role (optional), your country, which deployment interests you, which regime you are working to (optional), and your message. Plus the date and time you sent it.

Why — to read your enquiry and reply to it, and to prepare for a walkthrough if you ask for one.

Legal basis — Article 6(1)(f) GDPR, our legitimate interest in responding to a business enquiry that you chose to send us.

We explain the balancing behind that basis, because you are entitled to see the reasoning:

Where the person is themselves the prospective customer — for example a sole trader or an independent consultant asking about a licence — the basis is Article 6(1)(b) GDPR instead: steps taken at your request before entering a contract.

A note about the tick box — the contact form asks you to confirm that you have read how we handle your enquiry. That confirmation is an acknowledgement that you have read this policy. It is not the legal basis for the processing, and un-ticking it later does not change anything, because the basis is legitimate interest. What does work is objecting or asking us to delete: see section 7.

What we collect — technical data that is generated automatically when your browser requests a page: your IP address, the time of the request, the page requested, the response code, the user-agent string your browser sends, and rough location derived from the IP (country level). Our hosting provider produces these records.

We also apply a rate limit to the contact form, so one sender cannot flood it.

Why — to deliver the pages, to keep the site up, to detect and block attacks, and to stop automated spam through the form.

Legal basis — Article 6(1)(f) GDPR, our legitimate interest in the security and availability of our own website. Keeping a site online and free of abuse is a legitimate interest that Recital 49 GDPR names explicitly.

We do not use these logs to build a profile of you, and we do not connect them to your enquiry.

What we keep — your enquiry and our reply.

Why — so that we can find the thread again if you come back to us, and so we have a record if a dispute ever arises about what was promised.

Legal basis — Article 6(1)(f) GDPR, our legitimate interest in keeping a short record of our own business correspondence and in being able to establish, exercise or defend a legal claim.

What — if a law requires us to keep or produce something, we do.

Legal basis — Article 6(1)(c) GDPR, compliance with a legal obligation.

Today this affects the website almost not at all, because the site sells nothing. If you become a customer, invoicing and accounting records fall under Romanian accounting law, and we will give you a separate privacy notice at that point.

These statements are specific on purpose. Vague promises are worthless.

If we ever add measurement, it will be cookieless and first-party: aggregate counts only, no identifier stored on your device, no third-party recipient. We will update this page and the cookie page before it goes live, and we will say so plainly.

We use a small number of service providers. They process data on our instructions only, under a written data-processing agreement that meets Article 28 GDPR. They are not allowed to use your data for their own purposes.

The full list, with purpose, location and transfer mechanism, is in Annex A: Processors at the end of this page.

In summary:

Beyond those, we disclose personal data only:

We keep data inside the EEA where we can, and we tell you honestly where we cannot.

The enquiry itself is stored in a Cloudflare D1 database created in Cloudflare’s eu jurisdiction. That setting makes the database run and store data inside the European Union, and it cannot be changed after the database is created.

Cloudflare is a US company and its group operates worldwide. For transfers to the United States, Cloudflare is certified under the EU–US Data Privacy Framework, the Swiss–US framework and the UK extension. Its Data Processing Addendum also incorporates the European Commission’s Standard Contractual Clauses, which apply if the certification ever lapses. So there are two mechanisms in place, one behind the other.

Resend is a US company. Even when email is sent from its European sending region, Resend states that account data, email metadata and logs are stored in the United States. That is a transfer outside the EEA. It is covered by Resend’s Data Processing Addendum, which includes the Standard Contractual Clauses, and Resend is certified under the EU–US Data Privacy Framework and the UK extension.

We limit what crosses that border. The notification we receive is designed to tell us that an enquiry arrived, not to carry the enquiry: it contains no name, no address and no message text. We read the enquiry itself in the database, which is in the EU.

You can ask us for a copy of the transfer safeguards. Write to [email protected].

Under the GDPR you have the following rights. They are free to use.

About portability. The right to data portability (Article 20 GDPR) applies only where processing is based on consent or on a contract and is automated. Our processing is based on legitimate interest, so portability does not normally apply here. We say this rather than listing a right you cannot actually use.

How to exercise a right. Write to [email protected]. Say what you want. You do not need a form and you do not need to give a reason, except when objecting on grounds specific to your situation.

What happens next.

If you think we have handled your data wrongly, tell us first — we would rather fix it. But you may go straight to the supervisory authority at any time.

Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28–30, Sector 1, 010336 Bucharest, Romania
Telephone: +40 31 805 9211
Email: [email protected]
Website: https://www.dataprotection.ro

Complaints can be sent by post or email, or handed in at the authority’s headquarters. The authority publishes complaint forms on its website.

You may also complain to the supervisory authority in the EU country where you live or work, or where you think the problem happened. You can also go to court.

The periods are in Annex B: Retention at the end of this page. They are numbers, not "as long as necessary".

Two rules sit behind the table:

Short version: the site sets no analytics cookies and no advertising cookies. The full inventory and the rules are on the Cookie and Storage Policy page.

This site is for people doing their job at an organisation. It is not directed at children and we do not knowingly collect data from them.

Under Romanian Law no. 190/2018, the age at which a child can consent for themselves to an information society service is 16. If you are under 16, please do not use the contact form. If you believe a child has sent us data, write to [email protected] and we will delete it.

No system is perfectly secure. If a breach happens and it is likely to put your rights at risk, we notify ANSPDCP within 72 hours of becoming aware, and we tell you directly when the risk to you is high, as Articles 33 and 34 GDPR require.

No. Nothing on this site requires you to identify yourself.

The contact form is voluntary. If you fill it in, the required fields really are required — without a name, an address to reply to, an organisation, a country, a deployment interest and a message, we cannot give you a useful answer. The optional fields are optional, and leaving them blank costs you nothing.

You can always write to [email protected] instead and share less.

We may update this policy. When we do:

Email: [email protected]
Post: IELLO TECH S.R.L., Str. Argentina nr. 25, Bucharest, Sector 1, 011753, Romania

Annex A (processors) and Annex B (retention) are published as part of this page. They are below.

Not processors, listed so the picture is complete: the registrar and DNS provider for noveam.net is Cloudflare, already named above as the processor that hosts the site, so it is not a separate recipient; our accountant and our lawyers, who act as separate controllers or under professional secrecy, and only if a specific matter requires it.

Article 28 obligations. Each processor is engaged under a written data-processing agreement that binds it to process only on our documented instructions, to keep the data confidential, to apply appropriate security, to help us answer data-subject requests, to tell us about breaches, to seek our authorisation for sub-processors, and to delete or return data at the end.

Deletion means deletion. At the end of a period the record is removed from the live database and from the mailbox. Backups are overwritten on their own cycle, and a record that survives briefly in a backup is not restored into use. We run no backup of the enquiry database ourselves; Cloudflare operates its own recovery window for the database.