Legal
Privacy policy
Last updated: 5 November 2026
Short version: we do not sell data, we do not pass it on for advertising, and analytics stay off until you say otherwise. The long version, with legal bases and retention periods, is below.
Who is responsible for your data
The data controller under Regulation (EU) 2016/679 (GDPR) is:
| Legal name | CÎMPIAN RADU GHEORGHE PERSOANĂ FIZICĂ AUTORIZATĂ |
| VAT identification number | RO45316713 |
| Trade register number | F01/1568/2021 |
| Registered address | Str. Avram Iancu nr. 54, Teiuș, jud. Alba, România |
| Trading as | Digital U (digitalu.io) |
| contact@digitalu.io | |
| Phone | +40 751 547 174 |
We are not required to appoint a data protection officer. Write to contact@digitalu.io with any question about your data and we answer you ourselves, not an automated form.
What we collect, why, and for how long
| What | Data | Legal basis | Retention |
|---|---|---|---|
| Contact form | Name, email, phone (optional), company, the service you are interested in, what you want to achieve | Art. 6(1)(b) GDPR, steps taken at your request before a contract | 3 years after our last exchange, then deleted |
| Free audit form | Your website address, email, phone (optional), your goal, one competitor (optional) | Art. 6(1)(a) GDPR, the consent you tick in the form | Until you withdraw consent, otherwise 2 years from the request |
| Emails you send us | Your address and whatever you write | Art. 6(1)(f) GDPR, our legitimate interest in corresponding with you | 3 years after the last message |
| Server logs | IP address, browser type, page requested, time of request | Art. 6(1)(f) GDPR, our legitimate interest in keeping the site up and secure | At most 30 days, at the hosting provider |
| Usage statistics | Pages opened, buttons clicked, a random identifier stored in your browser | Art. 6(1)(a) GDPR, the consent you give in the cookie bar | 12 months |
We do not collect special categories of data (health, beliefs, biometrics) and we make no automated decisions with legal effects on you. If you send us such data in a form, we delete it.
Who else sees it
We do not sell or rent data. It is seen only by the providers we need to keep the site running, each under its own processing agreement:
| Provider | What it does | Where |
|---|---|---|
| Vercel Inc. | Hosting and page delivery. Sees your IP address and request headers, in server logs. | USA, with EU servers |
| Web3Forms (Web3Creative) | Delivers the contact and audit forms to our inbox. Sees what you typed into the form. For spam filtering, your IP address and email also pass through CleanTalk and Akismet. | India, on AWS, Cloudflare and Hetzner infrastructure |
| PostHog | Product analytics: pages viewed, buttons clicked. Only runs if you accept. | EU |
| Calendly | Booking the 30-minute calls. Sees your name, email and what you write when booking, but only if you open the link. | USA |
We may also disclose data where the law requires it: on a request from a competent authority, in the form and within the limits the law sets.
Transfers outside the European Union
Vercel and Calendly are United States companies, and Web3Forms is operated from India. Transfers rely on the standard contractual clauses adopted by the European Commission and, where the provider is certified, on the EU–US Data Privacy Framework. Write to contact@digitalu.io for a copy of the safeguards.
What you can ask us to do
GDPR gives you the following rights, and we will not ask you for a reason:
- Access: have us tell you what data we hold about you, and give you a copy.
- Rectification: have us correct what is wrong or incomplete.
- Erasure: have us delete it, once we have no lawful reason left to keep it.
- Restriction: have us keep it but stop using it while we check a dispute.
- Portability: get your data in a format another provider can read.
- Objection: object to processing based on legitimate interest, including commercial messages.
- Withdrawing consent: at any time, without affecting what we lawfully did before.
Write to contact@digitalu.io and you get an answer within 30 days at the latest. If the request is complex we will tell you and may extend by two more months, but we will say why.
If our answer does not satisfy you
You can complain to The Romanian Data Protection Authority (ANSPDCP), www.dataprotection.ro, or to the supervisory authority in the country where you live. Please write to us first: it is faster, and it is usually a misunderstanding.
Cookies
What we put in your browser, how long it stays and how to change your mind are covered separately, in the cookie policy.
Security and children
The site is served over HTTPS only, and access to our inbox and provider dashboards is protected with two-factor authentication. No measure is perfect; if a breach puts your data at risk we will notify you and the authority within the deadlines GDPR sets.
Our services are aimed at businesses, not children. We do not knowingly collect data from anyone under 16. If you learn that a child sent us data, write to us and we will delete it.
Changes
When we change something here we change the date at the top of the page. If the change is material, we ask for consent again in the cookie bar.