Privacy Policy

XFINIT S.R.L., Romanian tax identification number (CUI) 42270654, trade registry number J2020002177409, with registered office at Str. Lămâiului no. 4, Sector 1, Bucharest, Romania is the controller for the processing described in this policy. You can contact us at contact@xfinit.ro.

XFINIT has no dedicated data protection officer because the current processing activities do not require one. Privacy questions and requests are handled through the contact address above.

This policy applies to the public xfinit.ro website, contact inquiries, newsletter subscriptions, consent management, website measurement, and technical security controls. Separate contracts or notices may govern client projects, recruitment, employment, or other services.

Depending on how you use the website, we may process the following categories:

• Contact inquiry data: name, email address, company, requested service, budget range, and message.
• Newsletter data: email address, subscription status, and subscription or update timestamps.
• Technical anti-abuse data: IP address, request timestamps, hashed rate-limit identifiers, and short-lived security records.
• Consent and measurement data: consent choices, device and browser information, page and referrer information, and aggregated interaction data produced by CookieYes, Google, or Vercel according to the state described below.
• Privacy-request data: the request, correspondence, verification information where necessary, and our resolution record.

We receive data when you submit the contact or newsletter forms, communicate with us by email, select consent preferences, or request website resources. Limited technical data is produced automatically when the website and its security or measurement services operate.

Please do not include confidential information, special-category personal data, credentials, or third-party personal data in a contact message unless it is necessary and you are authorized to provide it.

We use inquiry data to answer your request, understand proposed requirements, and take steps at your request before a possible contract. We may also rely on our legitimate interests in operating the business, keeping appropriate correspondence, preventing abuse, securing the website, and establishing or defending legal claims. Where law requires processing, the legal obligation is the basis.

Newsletter communication and full Google Analytics measurement rely on consent. You may withdraw consent at any time without affecting processing already carried out lawfully. Necessary consent-management and security functions operate so that the website and your choices can be provided. Vercel Web Analytics is used under our legitimate interest in limited, aggregated, cookie-free website measurement.

The contact form validates the fields you provide, stores the inquiry in MongoDB, and uses Mailjet to send an internal notification and a confirmation message. An IP address may be stored with the inquiry and used in an automatically expiring rate-limit record to prevent abuse.

Submitting the form does not create a services contract and does not subscribe you to marketing. We use the information to respond and to evaluate whether a further commercial discussion is appropriate.

If you subscribe, we store the normalized email address and subscription timestamps in MongoDB. Newsletter messages are sent only on the basis of your consent. You can unsubscribe through a link included in a message when available or by writing to contact@xfinit.ro; withdrawal is free and does not affect earlier lawful processing.

CookieYes is the website consent interface. It records and communicates your categories and allows you to accept, reject, change, or withdraw optional choices. The “Cookie settings” control in the footer reopens the preference interface at any time.

Rejecting optional categories does not block access to public website content. Necessary storage may still be used for consent choices, security, load delivery, and functionality that cannot reasonably operate without it.

Google Tag Manager loads with Google Consent Mode v2 in Advanced mode. Before it runs, analytics_storage, ad_storage, ad_user_data, and ad_personalization are set to denied and data redaction is enabled. We do not enable advertising or remarketing tags through this configuration.

If analytics consent is rejected, Google storage remains denied. Google may receive limited consent-aware cookieless signals that do not use analytics cookies; these signals communicate consent state and basic technical context. Full Google Analytics measurement starts only after analytics consent is granted and stops being authorized when it is withdrawn.

Vercel Web Analytics remains active regardless of the CookieYes analytics choice. It is configured for aggregated, cookie-free website measurement and is not given contact-form values, names, email addresses, message content, or other direct identifiers by XFINIT.

We use this limited measurement to understand overall page use and maintain the website. The basis is our legitimate interest in operating and improving a business website with proportionate, privacy-oriented measurement.

Access is limited to authorized XFINIT personnel and providers that support the stated purposes. Confirmed website providers are Vercel for hosting and web analytics, MongoDB for data storage, Mailjet for transactional and newsletter email, Google Tag Manager and Google Analytics for consent-aware measurement, and CookieYes for consent management.

Providers process data under their applicable contractual terms and security commitments. We may also disclose information when required by law, to protect rights or systems, or in connection with a properly managed corporate transaction.

Some providers or their support infrastructure may process data outside Romania or the European Economic Area. Where a destination does not benefit from an adequacy decision, we use an available transfer mechanism such as the European Commission standard contractual clauses and assess supplementary safeguards where required.

You may ask us for information about the transfer mechanism relevant to your data, subject to confidentiality and security limitations.

Contact inquiries are kept for no more than 24 months after the last recorded interaction, unless a longer period is necessary for a legal claim or legal obligation. Newsletter data is kept until unsubscribe or withdrawal of consent. Anti-abuse and security data is kept only for the configured technical need and uses automatic expiry.

Privacy-request records are kept for the time needed to resolve the request and demonstrate its handling, subject to applicable limitation periods and legal obligations. At the end of an applicable period, data is deleted or irreversibly anonymized unless lawful retention is still required.

We use measures appropriate to the nature of the website processing, including access controls, encrypted transport, input validation, rate limiting, provider access restrictions, logging, and retention controls. No online service can guarantee absolute security; we review measures as the website and risks change.

Subject to the conditions in applicable law, you may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent at any time. Where processing is based on legitimate interests, you may object for reasons relating to your particular situation.

Send a request to contact@xfinit.ro and describe the data or interaction concerned. We may ask for proportionate identity verification before disclosing or changing personal data. We normally respond within the legally applicable period and will explain any lawful limitation.

Please contact us first if you believe processing is incorrect. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or another competent supervisory authority in your habitual residence, workplace, or the place of the alleged infringement.

The website and XFINIT services are directed to organizations and professional decision-makers, not children. We do not knowingly request personal data from children through the public forms. Contact us if you believe a child has provided data so we can assess and delete it where appropriate.

We may update this policy when data flows, providers, or legal requirements change. The effective date identifies the current version. Material changes will be communicated through an appropriate website notice where required.

Questions and requests may be sent to contact@xfinit.ro or by post to XFINIT S.R.L., Romanian tax identification number (CUI) 42270654, trade registry number J2020002177409, with registered office at Str. Lămâiului no. 4, Sector 1, Bucharest, Romania.