Privacy policy

1Who we are

The data controller is Ubx Studio Consulting SRL, registered at Str. Baia de Aramă nr. 1, Sector 2, Bucharest, Romania. UBX FLOW is our software service for SMEs.

For any question about your data, you can write to us on WhatsApp, Telegram or email:

2What data we process

The website has no forms, user accounts or newsletter. We process:

• The data you send us when you contact us on WhatsApp, Telegram or email: your name, phone number or email address, your company name and what you tell us about its activity.
• Technical data recorded automatically by the server hosting the website (access logs): IP address, browser type, date and pages accessed.
• Visit statistics from Umami, a tool we host ourselves (datasite.ubx.ro): pages visited, referring source, country, device type and browser. Umami uses no cookies and doesn't store your IP address.
• Only if you accept analytics cookies: usage data collected by Google Analytics (pages visited, visit duration, device, approximate location and an identifier stored in a cookie).

Please don't send us sensitive data, such as health information, or your clients' personal data unless the conversation needs it.

3Why we use it and on what legal basis

• To reply to you and prepare a proposal at your request (Art. 6(1)(b) GDPR, steps prior to entering into a contract).
• To perform the contract, if we end up working together (Art. 6(1)(b) GDPR).
• To meet legal obligations, such as accounting requirements (Art. 6(1)(c) GDPR).
• To keep the website secure and working, based on our legitimate interest (Art. 6(1)(f) GDPR).
• To measure traffic with Umami, based on our legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR).
• To use Google Analytics, only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

We don't use your data for automated marketing and we don't make automated decisions about you.

4How long we keep it

• Conversations about a collaboration that doesn't go ahead: at most 2 years after the last contact, then we delete them.
• Data related to a contract: for the length of the contract and then as long as accounting law requires.
• Server logs: as long as the hosting provider keeps them, under its own policy.
• Google Analytics data: at most 14 months. Umami statistics are aggregated and don't identify you.

5Who we share data with

We don't sell or rent your data. It only reaches third parties to the extent that we use their services:

• WhatsApp (Meta), Telegram and our email provider, when you write to us through them. Each has its own privacy policy.
• The website's hosting provider.
• Google Analytics (Google Ireland Ltd.), only if you accept analytics cookies.
• Google Fonts: the website's fonts load from Google's servers, which therefore receive your browser's IP address.
• Public authorities, only when the law requires it.

Some of these services may transfer data outside the European Economic Area, based on the safeguards provided by the GDPR, such as standard contractual clauses.

6Cookies and local storage

The only cookies are the analytics cookies set by Google Analytics (for example _ga and _ga_<ID>), which expire after 2 years at most. They only load after you click “Accept” in the cookie banner. If you decline, no cookies are set. We use no advertising cookies.

Umami statistics use no cookies. In your browser's local storage (localStorage) we only keep your preferences: theme, language and your cookie choice. They stay on your device and are never sent to us.

You can change your choice at any time via the “Cookie settings” link in the page footer.

7Your rights

Under the GDPR, you have the right:

• to know what data we hold about you and to get a copy;
• to ask for it to be corrected or deleted;
• to ask us to restrict processing or to object to it;
• to receive your data in a portable format;
• to withdraw your consent for Google Analytics at any time, via “Cookie settings”;
• to file a complaint with Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

For any of these requests, write to us on one of the channels above. We'll reply within one month at most.

8Security

The website loads over an encrypted connection (HTTPS), and access to the messages and documents you send us is limited to the people on our team who need them.

9Changes

If we update this policy, we publish the new version on this page and change the date at the top.