Legal notice GDPR · the contact form and analytics
Privacy policy
In short: we use the data you send us through the form only to reply to you, and visit statistics run only if you agree. No ads and no selling of data.
Who we are
The controller of your data is Ion Rusu, founder of Bitnoda — the studio that built this website and the products shown on it.
For any question about your data, write to us through the contact form or at hello@bitnoda.team.
What data we collect
When you send us a request through the contact form, we receive:
- Your name — so we know how to address you.
- Your email address — so we can reply.
- Your company — only if you choose to fill it in.
- The services, budget and timeline you picked — so we understand the project.
- Your message — what you tell us about your idea.
- The consent checkbox — confirmation that you agree to this processing.
Please don’t include sensitive data in your message (for example, about your health). We don’t need it to discuss a project.
Along with your message we automatically save the date and time it was sent, your browser identifier (user agent), your browser’s preferred language (Accept-Language) and the language version of the site you used to send the form (English or Romanian), so we can reply in the same language. We do not store your IP address: we only keep it in memory for 10 minutes, to limit abusive submissions. The server’s access logs may contain the IP address for a short time, for security reasons.
Why we use it
We use the data only to:
- reply to your request and clarify what you need;
- prepare an estimate or a quote for your project;
- protect the form from spam and abuse;
- measure, only with your consent, how many visits the site gets and which pages are useful (Google Analytics).
We don’t send you newsletters, we don’t profile you and we never sell or rent your data to anyone.
Legal basis
We process the data under Regulation (EU) 2016/679 (GDPR), on the basis of:
- your consent (Art. 6(1)(a)) — you give it by ticking the box in the form or by allowing analytics in the cookie banner, and you can withdraw it at any time;
- steps taken at your request before entering into a contract (Art. 6(1)(b)) — when we discuss a specific project;
- legitimate interest (Art. 6(1)(f)) — only to limit abusive submissions and for the technical logs that keep the site secure.
For visitors from the Republic of Moldova, we also comply with the national legislation on the protection of personal data.
How long we keep it
We keep your request for at most 12 months after your last message if we don’t start working together. The technical data saved with it (date sent, user agent, browser language and the site’s language version) is kept for the same period and deleted together with the message. If we work together, we keep the correspondence for the duration of the project and then only as long as legal obligations require, such as tax and accounting rules.
The IP address used to limit submissions is dropped from memory after 10 minutes. The server’s access logs are kept only briefly, for as long as security requires. You can ask us to delete your data sooner at any time.
Google Analytics data is kept for 14 months and then deleted automatically. The analytics cookies expire after at most 2 years, and they are removed as soon as you withdraw your consent.
Who has access to it
Your data only goes where it is strictly needed:
- Hosting. The website and the form run on our own server, hosted in the European Union. That is also where the messages are stored.
- Notifications (optional). When a new request arrives, we may get a notification by email or on Telegram, which may include its content. These providers may process data outside the EU; we use them only for internal notifications.
- Google Analytics (only with your consent). Google Ireland Limited processes usage data for us: the pages you visit, where you came from, your device and browser type, your approximate country and city, and a random identifier stored in a cookie. Google Analytics does not store IP addresses, and Google signals and ad personalisation are turned off. The data may be transferred to the US under the EU–US Data Privacy Framework and standard contractual clauses.
- Collaborators. If we start a project that developers from our network also work on, they receive only the information they need and keep it confidential.
We never pass your data on to anyone for marketing purposes.
Your rights
You are in control of your data. Under the GDPR, you have the right to:
Access
Find out what data we hold about you and get a copy of it.
Rectification
Correct inaccurate data or complete it.
Erasure
Ask us to delete your data — the “right to be forgotten”.
Restriction
Temporarily limit the use of your data, for example while we check a correction.
Objection
Object to processing based on legitimate interest.
Portability
Receive your data in a structured format that is easy to move elsewhere.
Withdrawing consent
At any time, without affecting what was lawfully done before.
For any of them, just write to us. We reply within one month at most, as the GDPR requires.
If you feel your data is not being handled properly, you can file a complaint with a supervisory authority:
Security
The connection to the site is encrypted (HTTPS), we manage the server ourselves, and access to messages is limited to the people who reply to you.
Changes
If we change how we use the data, we update this page and the date at the top. The version published here is always the one in force.
A question about your data?
Write to us and we will reply personally, in plain language.