This policy explains what personal data EPIC DIGITAL HUB S.R.L. collects through the website epicdigitalhub.ro, for what purpose, on what legal basis, how long we keep it, who we share it with and what rights you have. The policy applies to visitors to the website, to people who complete the forms on the website and to people who contact us by email or telephone.
We process personal data in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (the "GDPR"), Romanian Law no. 190/2018 on measures implementing the GDPR, and Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.
1. Who we are
The controller of your personal data is:
| Company name | EPIC DIGITAL HUB S.R.L. |
| Unique registration code (CUI) | 51214505 |
| Trade Register number | J2025006853005 |
| Registered office | Piața Nucetului nr. 24, bl. DE4, et. 3, ap. 308, Oradea, Bihor County, Romania |
| contact@epicdigitalhub.ro | |
| Telephone | 0755 473 154 |
| Website | https://epicdigitalhub.ro |
In this policy, "Epic Digital Hub", "we", "us" and "our" refer to EPIC DIGITAL HUB S.R.L.
We have not appointed a Data Protection Officer (DPO), as our activities do not fall within the cases in which an appointment is mandatory under Article 37 GDPR. For any question about your personal data, you can write to us at contact@epicdigitalhub.ro.
2. What personal data we collect
2.1. Data you provide to us directly
The "Generate My Free Report" form (Audit page):
- name;
- email address;
- the address of the website you would like us to analyse.
The "Check Availability" form (Apply page):
- name;
- business name;
- city;
- field of activity (niche);
- business website;
- estimated budget;
- stated objective.
The "Send Enquiry" form (available in the footer of the pages):
- name;
- email address.
Direct correspondence: when you email us, call us or contact us through social media, we process the data you include in your message (for example, name, email address, telephone number, job title, company name and the content of the message).
Please do not send us special categories of data through the forms (for example, health data, religious or political beliefs, biometric data). We do not need such data for our services.
2.2. Data collected automatically
Technical data and server logs: when you access the website, our hosting provider automatically records technical data necessary for the operation and security of the website: IP address, date and time of access, the page requested, browser type and version, operating system and the page from which you arrived on the website.
Browsing and measurement data (only with your consent): if you accept analytics and marketing cookies, we collect, through Google Analytics 4 and Meta Pixel, information about how you use the website: pages visited, visit duration, traffic source (for example, Google search, an advertisement, a social network), device type, approximate region and actions taken on the website, such as submitting a form. Details are set out in the Cookie Policy.
If you decline cookies, Google Analytics may receive, through the Consent Mode feature, signals without cookies and without persistent identifiers, used exclusively for aggregated statistical estimates. Meta Pixel does not load at all without your consent.
Information about form submissions: when you submit a form, we record as a measurement event only the type of form (audit, application or enquiry), the page language and, for the application form, the selected niche and budget. Your name, email address, telephone number and website are not sent to Google Analytics or Meta.
2.3. Data received from other sources
To prepare the audit report you request, we analyse public information about the website and business you indicate (the public content of the website, search engine results, the business's public profiles). This information relates mainly to the business, not to natural persons.
3. Purposes and legal bases of processing
| Purpose | Data processed | Legal basis (GDPR) |
|---|---|---|
| Preparing and sending the audit report you request | name, email, website | Art. 6(1)(b) — steps taken at your request prior to entering into a contract |
| Assessing the collaboration request and checking availability for the niche and city | data from the "Check Availability" form | Art. 6(1)(b) — pre-contractual steps |
| Replying to requests and questions | name, email, message content | Art. 6(1)(b) or (f) — our legitimate interest in replying to people who contact us |
| Following up with information about the request submitted | name, email, form data | Art. 6(1)(f) — legitimate interest, within the limits of the initial request |
| Entering into and performing service contracts | identification and contact data of the client's representatives | Art. 6(1)(b) — performance of the contract |
| Complying with legal obligations (accounting, tax, archiving) | data from contracts, invoices and supporting documents | Art. 6(1)(c) — legal obligation |
| Operation and security of the website, prevention of abuse | technical data, server logs | Art. 6(1)(f) — legitimate interest |
| Website usage statistics | browsing data (Google Analytics 4) | Art. 6(1)(a) — consent |
| Campaign measurement and personalised advertising | browsing data and events (Meta Pixel, Google advertising signals) | Art. 6(1)(a) — consent |
| Establishing, exercising or defending legal claims | data relevant to the dispute | Art. 6(1)(f) — legitimate interest |
Where we rely on legitimate interest, we have assessed that it is not overridden by your rights and freedoms. You can obtain details of this assessment by writing to us at contact@epicdigitalhub.ro.
We do not use form data to send you newsletters or unsolicited commercial communications. If we introduce a newsletter, we will ask for your consent separately.
4. Is providing the data mandatory?
Providing the data marked as mandatory in the forms is necessary for us to reply to you and to assess your request. Without this data, we cannot prepare the audit report or review the collaboration request. Accepting analytics and marketing cookies is optional and is not a condition for accessing the website.
5. Automated decision-making
We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR. The audit report may be generated with the help of automated website analysis tools, but it concerns the website and online presence of the business, and any decision regarding a possible collaboration is always taken by a member of our team.
6. Who we share the data with
We do not sell or rent your personal data. The data can be accessed only by members of the Epic Digital Hub team who need it for the purposes above and who are bound by confidentiality.
We use the following providers (processors or independent controllers), with whom we have or accept data processing agreements:
| Provider | Role | Data |
|---|---|---|
| Vercel Inc. (USA) | website hosting, server logs | technical data, content of forms submitted through the website |
| Google Ireland Limited / Google LLC | Google Analytics 4, Google Tag Manager, Google Search Console | browsing data (with consent), technical data |
| Meta Platforms Ireland Limited / Meta Platforms, Inc. | Meta Pixel, measurement of Facebook and Instagram campaigns | browsing data and events (with consent) |
| Cloudflare, Inc. (USA) | routing of incoming email for contact@epicdigitalhub.ro | correspondence (email addresses, message content) |
| Google Ireland Limited / Google LLC (Gmail) | receiving, storing and sending email | correspondence |
| Upstash (USA) — Redis database, Frankfurt region | storage of requests submitted through the forms | form data |
| Resend (USA) | sending the email notification when a request arrives | form data |
Data may also be disclosed to:
- our advisers (accountant, lawyer), to the extent necessary to comply with legal obligations or to defend our rights, who are bound by confidentiality;
- public authorities (for example, the National Agency for Fiscal Administration — ANAF, courts, criminal investigation bodies), where the law requires us to do so;
- a possible successor, in the event of a reorganisation, merger or sale of the business, after informing you in advance.
7. Transfers outside the European Economic Area
Some of the providers above (Google, Meta, Vercel, Cloudflare) may process data in the United States of America or in other countries outside the European Economic Area. These transfers are made on the basis of:
- the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, for providers certified under it; and/or
- the standard contractual clauses adopted by the European Commission, together with supplementary safeguards where necessary.
You may request information about the applicable safeguards by writing to us at contact@epicdigitalhub.ro.
8. How long we keep the data
| Category | Retention period |
|---|---|
| Form requests and correspondence that did not lead to a collaboration | 24 months from the last communication, then deletion or anonymisation |
| Audit reports generated on request | 24 months from generation |
| Data of clients and their representatives | for the duration of the contract and 3 years after its termination (the general limitation period) |
| Financial and accounting documents (contracts, invoices) | 5 years from the end of the financial year, in accordance with Accounting Law no. 82/1991, or the longer period provided by law for certain categories of documents |
| Browsing data in Google Analytics 4 | 14 months |
| Data sent through Meta Pixel | in accordance with Meta's policies, generally no more than 2 years |
| Server logs | in accordance with the hosting provider's policy, generally a few days or weeks |
| Your cookie choice | until the data is cleared from the browser or until you change your choice |
When these periods expire, the data is deleted or anonymised, except where retention is necessary for ongoing litigation or to comply with a legal obligation.
9. How we protect the data
We apply technical and organisational measures appropriate to the risk, including:
- encrypted HTTPS connection across the entire website and an HSTS policy;
- access to data limited to the people who need it, with two-step authentication where providers allow it;
- use of providers offering recognised security guarantees;
- data minimisation: we do not send identifying data from forms to analytics or advertising tools;
- periodic deletion of data whose retention period has expired.
No method of electronic transmission or storage is completely secure. If a personal data breach occurs that poses a risk to your rights, we will notify the National Supervisory Authority for Personal Data Processing and, where applicable, the data subjects, within the time limits set by the GDPR.
10. Your rights
Under the conditions provided by the GDPR, you have the following rights:
- the right of access (Art. 15) — to find out whether we process your data and to receive a copy of it;
- the right to rectification (Art. 16) — to ask for inaccurate data to be corrected or incomplete data to be completed;
- the right to erasure (Art. 17) — to ask for the data to be erased, for example when it is no longer necessary or you withdraw your consent;
- the right to restriction of processing (Art. 18) — to ask for processing to be restricted, for example while the accuracy of the data is being verified;
- the right to data portability (Art. 20) — to receive the data you provided in a structured, commonly used and machine-readable format, or to ask for it to be transmitted to another controller;
- the right to object (Art. 21) — to object to processing based on legitimate interest, on grounds relating to your particular situation;
- the right to withdraw your consent (Art. 7(3)), at any time, without affecting the lawfulness of processing carried out before withdrawal. For cookies, use the "Cookie settings" link in the website footer;
- the right not to be subject to a decision based solely on automated processing (Art. 22);
- the right to lodge a complaint with the supervisory authority.
How to exercise your rights: send a request to contact@epicdigitalhub.ro or by post to our registered office. We will reply without undue delay and at the latest within one month of receiving the request. This period may be extended by a further two months where the request is complex or we receive a large number of requests, in which case we will inform you within the first month. Exercising your rights is free of charge. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on the request. To protect your data, we may ask you for additional information to confirm your identity.
Supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP — National Supervisory Authority for Personal Data Processing) B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, postal code 010336, Bucharest, Romania Website: www.dataprotection.ro · Email: anspdcp@dataprotection.ro
11. Children's data
The website and our services are intended for companies and professionals. We do not knowingly collect data about persons under the age of 16. If you become aware that a minor has sent us personal data, please contact us so that we can delete it.
12. Links to other websites and social networks
The website contains links to our profiles on Facebook, Instagram and LinkedIn and, in the case studies, to our clients' websites. When you follow these links, you reach websites operated by third parties, which have their own privacy policies. We are not responsible for how these third parties process data. We recommend that you read their policies.
For our Facebook and Instagram pages, Meta Platforms Ireland Limited and Epic Digital Hub may be joint controllers for page statistics (Page Insights), under the agreement made available by Meta.
13. Changes to this policy
We may update this policy when our services, the tools we use or the legislation change. The current version is always published on this page, together with the date of the last update. If the changes are significant, we will highlight them visibly on the website.
14. Contact
For any question about this policy or about your personal data:
EPIC DIGITAL HUB S.R.L. Piața Nucetului nr. 24, bl. DE4, et. 3, ap. 308, Oradea, Bihor County, Romania Email: contact@epicdigitalhub.ro · Telephone: 0755 473 154
See also the Cookie Policy and the Terms and Conditions.
