CRYPTOITDATACRYPTOITDATA

Data Protection

GDPR Policy

Last updated: 25 October 2026

CRYPTOITDATA S.R.L., registered with the Romanian Trade Register under no. J35/5771/2022, VAT 47353025 (hereinafter "CRYPTOITDATA", "we"), respects the confidentiality of your personal data and is committed to processing it in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian legislation.

1. Data Controller

CRYPTOITDATA S.R.L. is the data controller for all personal data collected through the cryptoitdata.eu website.

Contact for data protection matters: hello@cryptoitdata.eu

2. What data we collect

2.1 Data you provide directly

  • Contact form: name, email, phone (optional), company (optional), service of interest (optional), message content.
  • Consultation booking (Cal.com): name, email, selected date/time, any questions you provide.
  • Newsletter (if subscribed): email address.
  • Forms in our Facebook, Instagram and TikTok ads: name, phone, email, type and name of your business, the time window you prefer for a call, and your consent to be called.

2.2 The call from our virtual assistant

If you leave your details in one of our ad forms and give your consent, our virtual assistant (Ioana for restaurants, Ana for clinics and practices) calls you in the time window you chose. She says at the start that she is an AI assistant. The call has one purpose: to understand your business and what you need, so that we can prepare a demo. The assistant takes no decisions about you.

  • What we keep from the call: the audio recording, the transcript and a summary (type and size of your business, how calls are answered today, your role, when you would like to start, and any specific requirements you mention).
  • If you do not answer: at most two more attempts in the same window, then a single text message with our demo number.
  • You can stop at any time: tell the assistant you do not want to continue, or write to hello@cryptoitdata.eu. We will not call you again.

2.3 Automatically collected data

  • Technical data: IP address (anonymised), browser type, operating system, pages visited, visit duration.
  • We use privacy-friendly analytics (Plausible) which doesn't use cookies and doesn't collect personally identifiable data.
  • Only if you accept in the cookie banner: Google Analytics 4 (pages visited, visit source, device, an identifier in the _ga cookie) and Meta Pixel (pages visited, an identifier in the _fbp cookie, possibly the click on a Meta ad). Details in the cookie policy.

3. Processing purposes and legal basis

  • Response to commercial enquiries — basis: pre-contractual measures at your request (Art. 6.1.b GDPR).
  • Sending offers and technical information — basis: explicit consent (Art. 6.1.a GDPR).
  • The virtual assistant's call after an ad form, including its recording and transcription — basis: the consent you gave in the form (Art. 6.1.a GDPR), which you can withdraw at any time.
  • Newsletter — basis: consent (Art. 6.1.a GDPR).
  • Visit statistics (Google Analytics) and ad measurement (Meta Pixel) — basis: the consent you gave in the cookie banner (Art. 6.1.a GDPR and the ePrivacy rules), which you can withdraw at any time from “Cookie settings”.
  • Legal obligations (invoicing, accounting, audit) — basis: Art. 6.1.c GDPR.
  • System security and fraud prevention — basis: legitimate interest (Art. 6.1.f GDPR).

4. Who we share data with

We use the following providers (processors) to operate the site and commercial relationships:

  • Hostinger (site hosting) — EU.
  • Brevo (transactional email and newsletter) — EU.
  • HubSpot (CRM) — EU/US, under standard contractual clauses.
  • Cal.com (consultation booking) — EU.
  • Plausible Analytics (cookieless analytics) — EU.
  • Google Ireland Limited (Google Analytics 4, consent only) — EU/US, under the EU-U.S. Data Privacy Framework.
  • Meta Platforms Ireland (Meta Pixel, consent only) — joint controller with us for collecting and transmitting the data (Art. 26 GDPR); EU/US, under the EU-U.S. Data Privacy Framework.
  • Meta Platforms Ireland (forms in Facebook and Instagram ads) — EU/US, under standard contractual clauses.
  • TikTok Technology Limited (forms in TikTok ads) — EU, with transfers under standard contractual clauses.
  • ElevenLabs (the virtual assistant's voice, speech recognition, call recording and transcription) — US/EU, under standard contractual clauses.
  • Twilio (phone call and text message) — US/EU, under standard contractual clauses.
  • Google (Google Workspace, internal record of enquiries) — EU/US, under standard contractual clauses.

All these providers are contractually obligated to process data exclusively per our instructions and to maintain appropriate technical and organisational measures.

5. International transfers

Where our providers process data outside the European Economic Area (e.g., HubSpot, Meta, ElevenLabs, Twilio or Google in the US), the transfer takes place under standard contractual clauses approved by the European Commission or other safeguards recognised by GDPR.

6. How long we keep data

  • Contact requests without contractual relationship: 12 months.
  • Ad forms, call transcript and summary: 12 months, unless we start working together.
  • Call audio recording: 90 days.
  • Data from contractual relationships: contract duration + 10 years (tax requirements).
  • Newsletter: until unsubscription.
  • Technical logs: max. 12 months.

7. Your GDPR rights

You have the following rights regarding your data:

  • Access — to know what data we hold about you.
  • Rectification — to correct inaccurate data.
  • Erasure ("right to be forgotten") — to request deletion of your data.
  • Restriction — to limit processing in certain situations.
  • Portability — to receive your data in a structured format.
  • Objection — to processing based on legitimate interest.
  • Consent withdrawal — at any time, without affecting the legality of prior processing.

To exercise any of these rights, write to hello@cryptoitdata.eu. We respond within 30 days.

8. Complaints to the supervisory authority

If you believe the processing of your data violates GDPR, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro.

9. Policy changes

This policy may be updated. The current version will always be available on this page, with the last update date at the top.