Privacy policy
This is an English translation provided for convenience. If the two versions differ, the Romanian version prevails: ithit.ro/prelucrarea-datelor-cu-caracter-personal/
Protecting your data matters to us. This policy explains what personal data we process, why, on what legal basis, how long we keep it, who we share it with and what rights you have, under Regulation (EU) 2016/679 (the “GDPR”) and applicable Romanian law.
1. Who we are and how to contact us
The controller is IT HIT S.R.L., VAT ID RO33087047, Trade Register no. J2014004909407, registered office at Splaiul Independenței 319H, London Office Building, 15th floor, Sector 6, Bucharest, Romania.
- Data protection email: gdpr@ithit.ro
- Phone: +40 371 395 028
- Contact form: ithit.ro/en/contact/
We have not appointed a data protection officer (DPO), as we are not required to by law; please send all requests about personal data to gdpr@ithit.ro.
2. Who this policy applies to
This policy covers the data of:
- visitors to ithit.ro (including the English version);
- people who contact us through the form, by email or by phone;
- representatives and contact persons of our customers, prospective customers, suppliers and partners;
- job applicants.
It does not cover:
- data we process on behalf of our customers, for example in the ERP systems we implement or maintain. In those cases we act as processor under the contract and data processing agreement with the customer, who remains the controller;
- IT HIT employees, who receive a separate privacy notice;
- websites of other organisations that our site links to.
3. What data we process and where it comes from
| Situation | Data processed and its source |
|---|---|
| Visiting the website | Technical data sent automatically by the browser: IP address, browser and operating system type, pages visited, date and time (in the web server logs). If you accept analytics or marketing cookies: cookie identifiers and your interactions with the site, collected through Google Analytics and the Meta Pixel. Details in the Cookie policy: ithit.ro/en/cookie-policy/ |
| Contact form | Required: name, email address, message. Optional: company, phone, subject. We also record the page language and the date sent. The IP address is used briefly, in pseudonymised form, to limit abusive submissions. Source: you. |
| Customers, prospects, suppliers and partners | Name, job title, company, business contact details (email, phone), correspondence, information from offers, contracts and projects, support requests (by email, phone or the support portal), billing details. Source: you, the company you represent, your colleagues or public sources (company website, LinkedIn, public registers). |
| Job applicants | Contact details, CV, education, work experience, skills, interview notes and, with your consent, references. Source: you, our employees who recommended you or the recruitment firms we work with. |
| Commercial communications | Name, email address, company, date of subscribing and unsubscribing. Source: you or the existing contractual relationship with the company you represent. |
Sensitive data. We do not ask for data about health, ethnic or racial origin, religious or political beliefs, trade union membership or criminal convictions. Please do not include it in messages or CVs; if we receive it without asking, we do not use it and we delete it.
4. Why we process data and on what legal basis
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|
| Answering messages received through the form, by email or by phone | (b) – steps taken at your request before a possible contract; (f) – our legitimate interest in answering enquiries |
| Preparing offers, concluding and performing contracts, including implementation, support and maintenance | (b) – performance of the contract, if you are a party to it; (f) – legitimate interest in working with the company you represent |
| Invoicing, accounting, archiving and other tax or legal obligations | (c) – legal obligation |
| Recruitment | (b) – steps before concluding an employment contract; (a) – your consent, for keeping your CV for future positions |
| Running and securing the website (server logs, protection against spam and abuse) | (f) – legitimate interest in keeping the site secure and working |
| Website usage statistics (Google Analytics) | (a) – your consent, given in the cookie banner |
| Measuring advertising campaigns (Meta Pixel, Google advertising features) | (a) – your consent, given in the cookie banner |
| Commercial communications (e.g. news, event invitations) | (a) – your consent; for existing customers, (f) – legitimate interest in informing them about similar services. You can unsubscribe in every message. |
| Establishing, exercising or defending legal claims; answering requests from authorities | (f) – legitimate interest in defending our rights; (c) – legal obligation |
Do you have to give us your data? No. Without your name, email and message we cannot answer your enquiry, and without the data needed to conclude a contract we cannot conclude it. Data required by law (for example, for invoicing) is mandatory.
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
5. How long we keep data
| Data | Retention period |
|---|---|
| Form messages and correspondence that did not lead to a contract | 3 years from the last contact |
| Data of customers, suppliers and partners, contracts, project correspondence | for the duration of the contract and 3 more years after it ends (the general limitation period) |
| Financial and accounting documents (invoices, supporting documents) | the periods set by Accounting Law no. 82/1991 and tax law |
| Job applicants’ data | 6 months after the recruitment process ends; 2 years if you agreed to be considered for future positions |
| Commercial communications list | until you unsubscribe or withdraw consent; proof of consent or unsubscription, 3 more years |
| Web server logs | 30 days |
| Pseudonymised IP address used against abusive form submissions | at most one hour |
| Google Analytics data | 2 months |
| Your cookie choice | 12 months |
At the end of the period, data is deleted or anonymised, unless it must be kept longer for a legal obligation or an ongoing dispute.
6. Who we share data with
- Providers that process data on our behalf, under a contract that requires them to protect it (Article 28 GDPR): CyberFolks S.R.L. (website hosting), Google Ireland Limited (email and collaboration – Google Workspace), Prime Telecom S.R.L., Data Expert Consult S.R.L. and Apply IT Experts S.R.L.
- Google Ireland Limited and Meta Platforms Ireland Limited, only if you accepted analytics or marketing cookies (details in the Cookie policy).
- Vendors of the solutions we implement (e.g. SoftOne, Microsoft, SAP, DRUID, Daktela), only when needed for offers, licensing or support.
- Recruitment firms we work with, for the candidates they introduced.
- Advisers – our lawyers (SCP Cojocaru & Asociații), auditors and tax advisers – who are bound by confidentiality.
- Public authorities and courts, when the law requires it or to defend our rights.
We do not sell your personal data.
7. Transfers outside the European Economic Area
Some providers (Google, Meta) may transfer data to group companies in the United States. These transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (10 July 2023), under which Google LLC and Meta Platforms, Inc. are certified, and on the standard contractual clauses approved by the Commission. The OpenStreetMap map on the contact page, loaded only when you ask for it, is served from the United Kingdom, which benefits from an adequacy decision. For any other transfer we will inform you and use the safeguards in Articles 44–49 GDPR.
8. How we protect data
- encrypted connections (HTTPS) for the website and the contact form;
- access to data limited to the people who need it for their work;
- two-step sign-in for email accounts and internal systems;
- backups and internal security procedures;
- training for employees who work with personal data;
- data protection clauses in our contracts with providers.
9. Your rights
Under the conditions and with the exceptions set by the GDPR, you have the following rights:
- right of access – to know whether we process data about you and to get a copy of it;
- right to rectification – to have inaccurate data corrected or incomplete data completed;
- right to erasure – to have data deleted, for example when it is no longer needed or you have withdrawn consent;
- right to restriction of processing – to have processing limited for a time, for example while we check the accuracy of the data;
- right to data portability – to receive the data you gave us in a structured, commonly used and machine-readable format, or to have us send it to another controller;
- right to object – to processing based on our legitimate interest; you can object to direct marketing at any time and we will stop;
- right to withdraw consent at any time, without affecting earlier processing; for cookies, with the “Cookie settings” link at the bottom of the site;
- right not to be subject to a decision based solely on automated processing.
To exercise your rights, write to gdpr@ithit.ro. We reply without undue delay and within one month at the latest; for complex requests this may be extended by two more months, and we will tell you if so. Exercising your rights is free. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, Bucharest, Romania, phone +40 318 059 211, anspdcp@dataprotection.ro, dataprotection.ro, or with the supervisory authority of the country where you live or work.
10. Changes to this policy
We update this policy when the way we process data or the law changes. The date of the version in force is shown at the top; we will also announce important changes on the site.