PRIVACY
POLICY.

01 // Data Controller

The controller of personal data collected through dpixel.agency is CDP PIXEL AGENCY S.R.L. (CUI 43900308, J40/4473/2021), Str. Emanoil Mihail Severin nr. 16, Sector 6, Bucharest, Romania. For any data protection question or request, write to hi@dpixel.agency. This policy explains what we collect, why, on what legal basis, for how long, who receives it and what rights you have under Regulation (EU) 2016/679 (GDPR).

02 // What We Collect, Why & Legal Basis

• Inquiry forms: Name, email address, project type, your message and the page you sent it from. Used to answer your inquiry and prepare an offer. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and your consent given via the form checkbox (Art. 6(1)(a)). Providing this data is voluntary, but without it we cannot reply to you.
• Direct email & phone: The data you choose to send us. Used to communicate with you. Legal basis: pre-contractual steps (Art. 6(1)(b)) or our legitimate interest in replying to correspondence (Art. 6(1)(f)).
• Website analytics (only if you accept): Pseudonymous identifiers stored in cookies, IP address (truncated), device and browser data and pages visited, collected via Google Analytics 4. Used to measure and improve the site. Legal basis: your consent (Art. 6(1)(a)), given through the cookie notice. No analytics cookies are set before you accept. With the same consent, when you arrive from an Affizy ad and then send a form, your browser reports the conversion to Affizy (affizy.network) with the ad's click id and campaign id only — never your name, email or message.
• Clients: Contract, billing and accounting data. Legal basis: performance of the contract (Art. 6(1)(b)) and compliance with Romanian fiscal and accounting law (Art. 6(1)(c)).

We do not use your data for automated decision-making or profiling, and we do not sell it.

03 // Retention

• Inquiries that do not lead to a contract: up to 24 months from our last exchange, then deleted.
• Client and accounting documents: for the periods required by Romanian law (generally 10 years for accounting records).
• Google Analytics data: 14 months, after which it is automatically deleted by Google. Analytics cookies expire after at most 24 months or when you withdraw consent.

04 // Recipients & International Transfers

We share data only with providers that process it on our behalf, under data processing agreements, and only as far as needed:

• Hosting and infrastructure providers for this website and our internal CRM, where form submissions are stored.
• Email and communication service providers.
• Google Ireland Ltd. / Google LLC — Google Analytics (only with your consent).
• Affizy (affizy.network) — ad conversion counting (only with your consent).
• Accountants, auditors and public authorities where required by law.

Google Analytics may involve a transfer of data to the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection (Art. 45 GDPR); Google also relies on the Standard Contractual Clauses. We do not otherwise transfer personal data outside the European Economic Area.

05 // Your Rights

Under GDPR you have the right to:

Withdrawing consent does not affect processing carried out before withdrawal. You can withdraw analytics consent from “Cookie settings” in the site footer, and any other consent by emailing hi@dpixel.agency. We answer requests within one month.

You also have the right to lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28–30, Sector 1, Bucharest, www.dataprotection.ro.

06 // Security

Data is transmitted over encrypted connections (HTTPS) and access to our CRM is restricted to authorised staff. More details on cookies are available in our Cookie Policy.