Privacy policy

Who is responsible for your data

Vistek is the brand under which two companies work. They decide together how the data is used and are therefore joint controllers, within the meaning of art. 26 GDPR:

• Stamiteki SRL, Tax ID (CUI) RO46415189, Trade Register no. J40/11302/2024, registered office at Drumul Valea Cricovului nr. 68, et. 2, ap. 9, Sector 6, București.
• Nvision Data Solutions SRL, Tax ID (CUI) RO42482410, Trade Register no. J40/4857/2020, registered office at Str. Nerva Traian nr. 27-33, sc. B, et. 1, birou 6, Sector 3, București.

In short, what we have agreed between us: we use the same systems and the same contact address, each company is responsible for the offers and invoices it issues, and we answer any request from you together. You can exercise your rights against either of them by writing to us at contact@vistek.ro. We do not have a data protection officer, because the law does not require us to.

When you ask us for an offer

From the form on the home page or from the site configurator we receive your name, company, phone number, email, the situation you are in, your message and what you chose in the configurator, plus the page you sent it from and, if you came from a campaign, its parameters (utm). We use them to reply to you and prepare an offer. The legal basis is your request itself: you ask us for an offer, and to make it for you, before any contract, we need this data (art. 6(1)(b) GDPR). If you no longer want the offer, send us an email and we will delete the request. We keep the request for two years from the last conversation, so that we can pick up an offer that was put on hold.

When you receive an offer or become a client

The offer has a private link. To view it or respond to it, we ask for your email address and send a sign-in link to it. We keep your responses to the offer, the contract, the invoices and the contact details of the person we work with. The legal basis is entering into and performing the contract (art. 6(1)(b)) and, for invoices, our legal obligation (art. 6(1)(c)). We keep the contract data for as long as the contract lasts and for three more years, the period in which we might have to defend ourselves in a dispute, and the accounting documents for as long as accounting and tax law requires.

When you write to us

We keep the emails sent to contact@vistek.ro and our replies so that we know what we discussed, on the basis of our legitimate interest in keeping a record of our conversations (art. 6(1)(f)), for no longer than we keep the request or contract they relate to. If you write to us on WhatsApp through the links on the site, the conversation goes through Meta's service, under the WhatsApp privacy policy, and we see it on our team's phones.

When you leave a review

From the review page we receive your name, role, company, the text and, if you wish, a link. We publish it on the site only with the consent you tick, and only after we have read it. The legal basis is your consent. The review stays published until you ask us to withdraw it.

When you visit the site

• Statistics without cookies. Vercel Web Analytics counts visits without storing anything on your device and forgets the code by which it recognises a visit after 24 hours. The legal basis is our legitimate interest in knowing which pages are read (art. 6(1)(f)).
• Google Analytics and Google Ads store cookies only if you accept them in the banner. The legal basis is your consent, which you can change at any time through the “Cookie preferences” link in the page footer. Google Analytics keeps the data for no more than 14 months.
• LinkedIn Insight Tag, from LinkedIn Ireland Unlimited Company, loads only if you accept “Advertising” in the banner. It shows us whether a Vistek ad on LinkedIn brought a request and lets us show you Vistek ads on LinkedIn again. LinkedIn receives the page address, the IP address, the browser and the codes in its cookies. We see only aggregate numbers, not who you are. The legal basis is your consent, which you can withdraw at any time through “Cookie preferences”. LinkedIn keeps the data from the tag for no more than 180 days.
• Before you choose, the Google tag sends a cookieless signal for each page: the page address, the browser type and the fact that you have not answered yet. Google also receives the IP address, as with any request on the internet. The signal cannot link two visits together. The legal basis is our legitimate interest in counting visits (art. 6(1)(f)).
• Server logs. Vercel keeps the IP address, the page requested and the time for a short period, to stop attacks and find errors (legitimate interest, art. 6(1)(f)).

The full list, with every cookie and how long it lasts, is in the Cookie policy.

Measurement reports for clients

For clients who give us access to Google Analytics, we connect our team's Google accounts and read only the reporting data (the analytics.readonly permission) and the email address of the connected account. We use the data received from Google only to produce the reports and checks the client asked for. We do not sell it and do not use it for advertising. Our use of it complies with the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

We do not sell data. It reaches only the providers we need:

• Vercel hosts the site. Forms are processed on servers in Ireland.
• Supabase stores requests, offers, emails and reviews in a database in Ireland.
• Resend sends and receives our emails, from Ireland.
• Google receives the notification about a new request in our Gmail inbox and, if you accept them, the Google Analytics and Google Ads data.
• LinkedIn, the data from the LinkedIn Insight Tag, only if you accept “Advertising”.
• Anthropic, through the Claude assistant, which we use to read requests and prepare offers and replies.
• Meta, only if you write to us on WhatsApp.
• Our accountant and, where the law requires it, the authorities.

Transfers outside the EU

Google, Anthropic, Meta and the parent companies of LinkedIn, Vercel, Supabase and Resend are in the United States, so the data may reach it. The transfer relies on the European Commission's decision on the EU-U.S. Data Privacy Framework, for certified companies, or on the standard contractual clauses approved by the Commission. On request, we will send you a copy of the safeguards.

Do you have to give us your data?

No. Without a name and an email we cannot reply to a request, and without billing details we cannot enter into a contract. We do not make automated decisions about you and do not profile you.

Your rights

You can ask for access to your data, its rectification or erasure, the restriction of processing, a copy in a format that can be moved elsewhere (portability), and you can object to processing based on legitimate interest. Where the legal basis is consent, you can withdraw it at any time. Write to us at contact@vistek.ro and we will reply within one month at most. If you are not satisfied, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

Changes

When something changes, we update this page and the date at the top. Any new measurement or advertising tool appears here and in the Cookie policy before it runs.