Privacy policy · Stridebytes Consulting

1. In brief

We use your data to reply to you, to prepare a quote and, if we work together, to carry out the contract. We also use it as far as necessary to meet our legal obligations (for example, our accounting obligations), to defend our rights and to keep the site secure (details in section 4).
We do not sell or rent out your data, and we do not use it for marketing, newsletters or advertising.
The site does not use cookies, traffic analytics or tracking tools.
You can ask us at any time to show you what data we hold about you, to correct it or to delete it, by writing to us at contact@stridebytes.com.

This policy applies to the stridebytes.com website and to the messages you send us through the contact channels shown on it. It does not apply to the external websites our links lead to (for example vendoevents.ro or the ANPC’s SAL platform), which have their own policies.

If you become a client and, as part of the project, we process data of your customers or users on your behalf, we set out that relationship separately, in the contract between us, in accordance with Article 28 GDPR.

2. Who the controller is

The controller of your data, that is, the company that decides why and how it is processed, is Stridebytes Consulting S.R.L. We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Law no. 190/2018.

Company name: Stridebytes Consulting S.R.L.
Registered office: Str. Coriolan Brediceanu nr. 8, 6th floor, room 621, 300011 Timișoara, Timiș County, Romania
Trade Register number: J35/1287/26.03.2021
Unique registration code: 43994817 (VAT registration number: RO43994817)
Email (also for personal data requests): contact@stridebytes.com
Phone / WhatsApp: +40 756 415 902
Website: https://stridebytes.com

We have not appointed a data protection officer (DPO), because our activities do not require one (Article 37 GDPR). For any question about your data, write to us directly at the email address above.

3. What data we process and where we get it

From the contact form

When you fill in the form on our homepage, we receive from you:

your name (required);
your email address (required);
your phone number (optional);
your estimated budget (optional, chosen from a list);
the service you are interested in (chosen from a list);
the description of your project (required, up to 3,000 characters);
your confirmation that you have read and understood this policy (the ticked box).

The form also has a hidden field, which people do not see and do not fill in, used only to stop messages sent automatically by bots (spam). The field stays empty when you fill in the form yourself, so it contains no data about you.

When you press “Send message”, the data reaches our server. We do not use an external form service: the server sends the message to our mailbox, contact@stridebytes.com, hosted by the email provider listed in section 6. The server does not keep the message once it has sent it. Your IP address is kept only in the server’s memory, for one hour at most, so that we can limit automatically sent messages; we do not save it anywhere outside the technical logs described below.

From messages you send us directly

If you email us, call us or send us a WhatsApp message, we receive the data you choose to give us: usually your name, your email address or phone number, the content of your message and any attached files. On WhatsApp we also see your profile name and, depending on your settings, your profile photo. If you write to us on behalf of a company, we usually also receive the company name and your job title.

Technical data from the server logs

When you visit the site, your browser automatically requests from our server the pages and files it needs in order to display them to you. For each request, the server records in its logs the IP address, the date and time, the address of the page requested and a few technical details about the request and the response (the request method and protocol, and the response code, size and duration). We do not record any other information sent by the browser, such as the type of browser or operating system. The server is managed by us and runs on DigitalOcean infrastructure, in a data centre in Frankfurt (Germany). We keep the logs for 14 days, for delivering the pages and for security, after which they are deleted automatically. They may also end up in the server’s weekly backups, which are kept for 4 weeks at most and then deleted as well. We do not use this data for traffic statistics and we do not build a profile of you from it.

Data we receive from someone else

Sometimes we receive your data from someone else, for example from a colleague who writes to us on behalf of your company and names you as the contact person for the project. In that case we usually receive your name, email address, phone number and job title, and the source of this data is that person or your company. In the first message we send you, we also give you the link to this policy.

What we ask you not to send us

We do not need your personal identification number (CNP), your bank details or any special categories of data (for example health data) in order to reply to you, so please do not include them in your messages. If you give us the contact details of a colleague (for example of the person who will look after the project), please let them know and send them the link to this policy.

4. Why we use the data and on what legal basis

For each purpose we use only the data we need, and we rely on the appropriate legal basis under Article 6 GDPR:

Purpose	Data	Legal basis	How long we keep it
Replying to your message and preparing a quote, when you write to us in your own name, as an individual	Name, email, phone (if you give it to us), budget, the service chosen, your message and the rest of the correspondence	Article 6(1)(b) GDPR: steps taken at your request before entering into a contract; once the discussion has ended, keeping the messages is based on Article 6(1)(f) GDPR (our legitimate interest in being able to resume the discussion)	12 months from the last message, if we do not enter into a contract
The same, when you write to us on behalf of a company or another organisation	The same data, plus the company name and your job title, if you tell us	Article 6(1)(f) GDPR: our legitimate interest in replying to enquiries from companies and communicating with their contact persons	12 months from the last message, if we do not enter into a contract
Replying to other messages that do not concern a quote or a contract (for example general questions or partnership proposals)	Name, email, phone (if you give it to us) and the content of the message	Article 6(1)(f) GDPR: our legitimate interest in replying to the messages we receive	12 months from the last message
Communication during a contract, if we work together	Contact details and correspondence about the project	Article 6(1)(b) GDPR, if you are a party to the contract; Article 6(1)(f) GDPR, if you are the contact person of a client company (our legitimate interest in performing the contract with that company)	For the duration of the contract
Keeping the correspondence related to a contract, so that we can prove what we agreed and defend our rights in the event of a dispute	The correspondence, the quote and the contract	Article 6(1)(f) GDPR: our legitimate interest in establishing, exercising or defending legal claims	3 years after the contract ends (the general limitation period under the Romanian Civil Code)
Accounting and tax obligations, if we enter into a contract	The data in the contract and invoices: name or company name, address, tax identification number (for companies), the services and the amounts	Article 6(1)(c) GDPR: the legal obligation to keep accounts, under Accounting Law no. 82/1991 and tax legislation	The period set by Accounting Law no. 82/1991
Responding to requests in which you exercise your data protection rights, and keeping proof of how we dealt with them	The identification and contact details in the request, the request itself and our reply	Article 6(1)(c) GDPR: the legal obligation to respond to these requests, under Articles 12-22 GDPR	3 years from our reply
Delivering the site’s pages and protecting the site from attacks and abuse	Technical data: IP address, date and time, the page requested and technical details about the request and the response (request method and protocol, response code, size and duration)	Article 6(1)(f) GDPR: our legitimate interest in displaying the site correctly and keeping it secure	14 days in the server logs; 4 weeks at most in the server’s weekly backups

The legitimate interests we rely on

Where the legal basis is legitimate interest (Article 6(1)(f) GDPR), our interests are:

to reply to enquiries from companies and communicate with the people they designate, so that we can make quotes and enter into contracts;
to reply to the messages we receive, including those that do not concern a quote or a contract;
to keep, for a limited period, enquiries that did not lead to a contract, so that we can resume the discussion if you come back to us;
to be able to prove what we discussed and what we agreed, and to defend our rights in the event of a dispute;
to deliver the site securely and protect it from attacks, spam and other abuse.

We rely on these interests after checking that they are not overridden by your interests or fundamental rights and freedoms: we process little data, only in ways you can reasonably expect when you write to us or visit our site, and we keep it for a limited period. You can object to this processing at any time (see Your rights).

We do not rely on consent

For the contact form and for messages sent to us directly, we do not rely on your consent (Article 6(1)(a) GDPR), but on the legal bases in the table above. The box you tick in the form only confirms that you have read and understood this policy. It is not consent to the processing of your data and does not allow us to use the data for other purposes, such as marketing.

If, in future, we intend to use the data for a purpose other than those above, we will inform you before we start that processing (Article 13(3) GDPR) and, where the law requires it, we will ask for your consent.

5. How long we keep the data

Enquiries and other messages that do not lead to a contract: 12 months from the last message exchanged, so that we can resume the discussion if you come back to us; after that we delete them.
Correspondence related to a contract: for the duration of the contract and for 3 years after it ends, which is the general limitation period under the Civil Code.
Accounting documents (contracts, invoices and other supporting documents): the period set by Accounting Law no. 82/1991, currently 5 years counted from 1 July of the year following the end of the financial year in which they were drawn up.
Requests in which you exercise your rights: 3 years from our reply, which is the general limitation period, so that we can prove how we dealt with them.
The server’s technical logs: 14 days, after which they are deleted automatically. They may also end up in the server’s weekly backups, which are kept for 4 weeks at most and then deleted as well.
The IP address used to limit messages from the form: one hour at most, only in the server’s memory.
Messages from the form: our server does not keep a copy; the message exists only in our mailbox, where the periods above apply.

At the end of these periods we delete the data or anonymise it. We keep it for longer only if a dispute is under way, until it is settled, or if an authority requires us by law to keep it.

6. Who we share the data with

We do not sell or rent out your data. We share it only with the following categories of recipients, and only as far as necessary:

Recipient	Role	Where it processes the data
DigitalOcean, LLC (USA), the provider of the infrastructure on which the site’s server runs	Processor: provides the server (which holds the site and the technical logs, and through which the messages from the form pass) and its weekly backups, kept for 4 weeks at most	Germany (the Frankfurt data centre); for support and security, DigitalOcean and its sub-processors may also access the data from the USA
Microsoft, through Microsoft 365 (Exchange Online), the provider of the contact@stridebytes.com mailbox. We contract directly with Microsoft under the Microsoft Customer Agreement and are billed directly by Microsoft. No partner or reseller has access to our tenant.	Processor: hosts the emails we receive and send	United Kingdom (the current and committed location for Exchange Online mailbox data); for support and operations, Microsoft may also access the data from outside the EEA and the United Kingdom, for example from the USA
WhatsApp Ireland Limited (Meta group), only if you choose to write to us on WhatsApp	Independent controller: transmits the messages between you and us and processes data under its own privacy policy	As set out in the WhatsApp policy, which also provides for transfers outside the European Economic Area (EEA)
The accountant or accounting firm we work with, only if we enter into a contract	Keeps the accounting records on the basis of the contracts and invoices	Romania
Public authorities and courts (for example ANAF, the Romanian tax authority), only when the law requires it or when we need to defend a right	Receive the data under the law, as independent controllers	Romania

Processors process the data only on our instructions, under a contract that complies with Article 28 GDPR, and are required to keep it confidential and secure.

7. Transfers outside the European Economic Area

Some of our providers may have their headquarters or servers outside the European Economic Area (EEA), for example in the United States. When your data is transferred there, the transfer takes place only with one of the safeguards provided for by the GDPR:

a European Commission adequacy decision (Article 45 GDPR), for example Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework, for US providers certified under that framework;
the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (Article 46 GDPR), where there is no adequacy decision, together with supplementary measures where necessary.

The safeguard used for each provider:

DigitalOcean, LLC: the adequacy decision (DigitalOcean is certified under the EU-US Data Privacy Framework) and, as a fallback, the standard contractual clauses in its data processing agreement.
Microsoft (Microsoft 365, Exchange Online): for storage in the United Kingdom, the European Commission’s adequacy decision for the United Kingdom under Article 45 GDPR, renewed on 19 December 2025 and in force until 27 December 2031. For access from outside the EEA and the United Kingdom, including from the USA, for support and operations, the standard contractual clauses in the Microsoft Products and Services Data Protection Addendum apply. Microsoft is also certified under the EU-US Data Privacy Framework, but states that it does not rely on this framework for transfers from the EU/EEA to the USA.
WhatsApp: the safeguards described in the WhatsApp privacy policy.

You can ask us for a copy of the safeguards used (for example the standard contractual clauses) by writing to us at contact@stridebytes.com.

8. Do you have to give us your data?

You are not required by law or by contract to give us any data. To be able to reply to you, however, we need your name, an email address and your message: without them the form cannot be sent and we cannot contact you. Your phone number and estimated budget are optional, and we can reply to you without them.

If you become a client, we will also need the billing details required by law. Without them we cannot enter into the contract or issue invoices.

9. Your rights

Under the GDPR, you have the following rights:

Right of access (Article 15): to find out whether we process data about you and to receive a copy of it, together with the information in this policy.
Right to rectification (Article 16): to ask us to correct inaccurate data or to complete incomplete data.
Right to erasure (Article 17, the “right to be forgotten”): to ask us to delete the data, for example when we no longer need it or when you object and we have no overriding legitimate grounds. We cannot delete data that the law requires us to keep, such as invoices.
Right to restriction of processing (Article 18): to ask us to keep the data without using it any further, for example while we check a correction you have asked for.
Right to data portability (Article 20): to receive the data you have given us in a structured, commonly used and machine-readable format, or to ask us to send it directly to another controller, where the processing is based on a contract or on steps taken before entering into one and is carried out by automated means.
Right to object (Article 21): to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. In that case we stop the processing, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

The right to withdraw consent applies only to processing based on consent. For the form and for contact messages we do not rely on consent, so this right does not apply here. If, in future, we introduce processing based on consent, you will be able to withdraw it at any time, as easily as you gave it, without affecting the lawfulness of the processing carried out before then.

How to exercise your rights

Write to us at contact@stridebytes.com. Tell us which right you want to exercise and, if possible, the email address or phone number you contacted us from, so that we can find your data.

We reply without undue delay and at the latest within one month of receiving your request. If the request is complex or we receive a large number of requests, this period may be extended by two further months. In that case we will let you know within the first month and tell you why.

Exercising your rights is free of charge. If a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse to act on it, explaining our reasons to you (Article 12(5) GDPR). If we have reasonable doubts about your identity, we may ask you for additional information, only to the extent necessary to make sure we do not give your data to someone else.

10. Complaints to the data protection authority

If you believe that we are processing your data in breach of the law, you have the right to lodge a complaint with the supervisory authority in Romania, the Romanian data protection authority (ANSPDCP). You can write to us first, so that we can look into the problem and propose a solution, but you are not required to.

Authority: National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP)
Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania
Phone: +40 318 059 211 or +40 318 059 212
Email: anspdcp@dataprotection.ro
Website: www.dataprotection.ro

You can lodge a complaint online, through the form on the ANSPDCP website, by email or by post. If you live or work in another EU Member State, you can also lodge your complaint with the supervisory authority there.

11. Automated decisions and profiling

We do not take decisions based solely on automated processing of your data, including profiling, that produce legal effects concerning you or similarly significantly affect you. Every message is read by a person on our team, who also replies to you.

12. How we protect the data

The site and the form work only over an encrypted connection (HTTPS).
Only the people on our team who need to read the messages, to reply to you or to work on your project, have access to them.
A hidden field in the form (a honeypot) helps us stop messages sent automatically by bots.
We ask only for the data we need and keep it only for as long as necessary.
We work only with providers who are contractually bound to protect the data.

No system is perfectly secure. If a personal data breach does occur and the law requires us to notify it, we notify the supervisory authority (ANSPDCP) without undue delay and, where feasible, no later than 72 hours after becoming aware of it. If the incident is likely to result in a high risk to your rights and freedoms, we will also inform you (Articles 33 and 34 GDPR).

13. Minors

Our site and services are aimed at businesses and adults. If you are under 18, please do not send us personal data through the form or in messages, and ask a parent or guardian to contact us instead. If we find out that we have received data from a minor without the consent of a parent or guardian, we delete it.

14. Cookies

The site does not set cookies and does not use browser local storage (localStorage, sessionStorage), traffic analytics, tracking pixels, advertising or embedded third-party content. The fonts and all of the site’s files load from our own server, so your visit does not send data to other services, such as Google Fonts.

Our server does not set any cookies, including ones strictly necessary for security. If, in future, we use a service that does, its strictly necessary cookies do not require your consent, under Article 4(6) of Law no. 506/2004, but we will list them in the Cookie Policy. If we add cookies that are not strictly necessary, or analytics tools, we will ask for your consent first and update our policies.

15. Changes to this policy

We may update this policy when our providers, the way we handle data or the law change. The version in force is always on this page, with the date of the last update and the version number shown at the top. If a change is significant and affects you directly, for example a new purpose, we will flag it clearly on this page and, if we are in correspondence with you, we will also tell you directly.

16. Contact

For any question about this policy or about your data, write to us at contact@stridebytes.com or call us on +40 756 415 902. You can also write to us by post, at our registered office: Stridebytes Consulting S.R.L., Str. Coriolan Brediceanu nr. 8, 6th floor, room 621, 300011 Timișoara, Timiș County, Romania.

The rules for using the site are set out in the Terms and Conditions.