Last updated 19 October 2026
Privacy Policy
Innotive Digital is the brand under which the controller below operates. This document explains, briefly and concretely, what personal data we process through the innotive.digital website, the contact form, the free SEO audit and the client portal, why we process it, who we share it with, how long we keep it and what rights you have under Regulation (EU) 2016/679 (GDPR). The Romanian version of this document prevails.
Who processes your data
- Controller / provider
- BARBUR ALINA DIANA PERSOANA FIZICA AUTORIZATA
- Brand
- Innotive Digital
- CUI
- 51680360
- Trade Register no.
- F2025013985005
- Registered office
- Str. Lt.col. Pretorian, nr. 29, bloc N90, ap. 13, 450131 Zalău, județul Sălaj
- contact@innotive.digital
- Website
- innotive.digital
For any question about your data, email us at contact@innotive.digital. We are not required to appoint a data protection officer, so we answer you directly.
What data we process and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You write to us through the contact form | name, email, phone (optional), company and where it is based (optional), chosen service and budget, message, page language, the page you sent the form from (with the parameters in its address, such as a campaign source), date sent | to reply and prepare a quote; the page you wrote from and where your company is based tell us which pages of the site and which areas bring enquiries | Art. 6(1)(b) — steps taken at your request before a contract; Art. 6(1)(f) — our legitimate interest in knowing which pages of the site and which areas bring enquiries |
| You call us or write to us on WhatsApp | phone number, the name on your WhatsApp profile, the messages and files you send us | to reply and prepare a quote; WhatsApp messages pass through the WhatsApp service (Meta), under its own terms | Art. 6(1)(b) — steps taken at your request before a contract |
| You request a free SEO audit | website address, email, report language, whether you asked us to contact you, date of the request, audit result | to run the audit you asked for and send you the report; only if you ticked the box, to contact you about the results | Art. 6(1)(b) — the service you requested, for the audit and report; Art. 6(1)(a) — your consent, for contacting you, which you can withdraw at any time by replying to the email or writing to us |
| You receive a quote and we sign a contract | identification and contact details for you or your company (name, email, phone, company name, VAT number, address) and, if you give it to us, your accountant's email address, so they receive the invoices; for a proposal sent as a link: your name and phone, what we propose, the price, when you opened it and what you answered | to conclude and perform the contract | Art. 6(1)(b) — performance of a contract |
| You open your client report | contact email address (where we send your link), your personal links and when they were last opened | to see how your website is doing, what we worked on and your invoices | Art. 6(1)(b) — performance of a contract |
| We issue invoices | the details required on an invoice | to meet tax and accounting obligations | Art. 6(1)(c) — legal obligation |
| We send you the monthly summary (by email or WhatsApp) or project emails | name, email, phone, message content | to keep you informed about the work done | Art. 6(1)(b) — performance of a contract |
| You subscribe to the newsletter | your email, first name (if you gave it on the form you subscribed from), the page language, where you subscribed from and the date | to send you the monthly newsletter | Art. 6(1)(a) — your consent, given by ticking the box or filling in the subscribe form; you can withdraw it at any time from the unsubscribe link in every newsletter |
| You submit forms or sign in | IP address | to limit repeated attempts and abusive submissions | Art. 6(1)(f) — our legitimate interest in protecting the website |
| You visit the website and accept statistics or marketing cookies | a random identifier from a cookie (not your name), the pages you opened and how long you stayed, where you came from, your device and browser type, the country and city estimated from your IP address — the IP address itself never reaches us, and Google uses it only to estimate location, without storing it | to see how many people visit and which pages they read, so we know what is worth writing next; if you also accept marketing, to measure which ads bring clients | Art. 6(1)(a) — your consent, given in the cookie banner; you can withdraw it at any time, with a single click, from Cookie preferences in the footer of every page |
We send marketing emails only to people who subscribed to the newsletter themselves. Neither contact form requests nor SEO audit addresses end up on the list on their own: there you consented to a reply and to the report, not to marketing. Unsubscribing takes one click, from the link at the bottom of every newsletter. We don't sell or rent data and don't make automated decisions that produce legal effects concerning you.
The IP address used to limit repeated attempts is kept only in the server's memory, for about an hour, and is never saved to the database. The hosting server may separately keep technical logs for security, under the hosting provider's rules.
Access to your report
- You have no account and no password: your report opens with a personal link that we send you on WhatsApp or by email. The link is valid for 45 days; you can ask for a new one at any time, at your contact address.
- We don't store the link. Our database keeps only a cryptographic fingerprint of it, from which the link can't be rebuilt.
- The link is yours alone: anyone you pass it to can see the report until it expires. If you sent it by mistake, tell us and we'll stop it.
- While the link is valid we use a single strictly necessary cookie that remembers it. Details are in the Cookie Policy.
- “Customers from your site”: if you ask us to, we add a small script to your website that counts taps on Call, WhatsApp and email, and form submissions. We receive only the kind of tap and your site's domain: no cookies, nothing stored in the visitor's browser and no data about who tapped. The visitor's IP address stays only in the server's memory, for about an hour, so the same person isn't counted twice. For your site's visitors we act on your behalf; your site's privacy policy should mention the counting (we'll give you the text).
The free SEO audit
- The audit is automated. Our server opens the website whose address you entered and reads only public pages, like any visitor: the homepage and up to 10 other pages, plus a check of its internal links and a few technical addresses (robots.txt, the sitemap, the http and www versions, a non-existent address, the site icon). It identifies itself as “InnotiveAudit”, reads robots.txt first and never requests an address the file disallows for it; if the homepage is disallowed, it analyses nothing. It doesn't fill in forms or enter account areas.
- For speed, Google PageSpeed Insights receives only the homepage address and measures it from Google's servers. Your email doesn't reach Google.
- From the pages analysed we keep only what matters for SEO (page addresses, titles and descriptions, H1 headings, word and image counts, the issues found), not their full text.
- You receive the report by email as a PDF, and it stays online at the link you received until the audit is deleted: after 12 months, or sooner if you ask us. The report page doesn't show your email, but anyone with the link can open it, so share it only with people you choose.
- We contact you about the results only if you ticked the box on the form. You can withdraw your consent at any time by replying to the report email or writing to us at contact@innotive.digital; withdrawing doesn't affect what happened before. Without the tick, your email is used only to send the report.
- The audit analyses the website, not you, so it isn't an automated decision with legal effects concerning you. You may only request audits for websites you own or are allowed to analyse — details are in the Terms and Conditions.
Who we share data with
We use a few providers that process data on our behalf (processors), under contracts that require them to protect it and use it only for the service they provide:
| Provider | What for | Where the data is |
|---|---|---|
| Google (Firebase / Google Cloud) | the platform's database (form requests, SEO audits, clients, projects, portal) and portal sign-in | database: data centres in the European Union; sign-in: United States |
| Google (PageSpeed Insights API) | measuring speed in the SEO audit; it receives only the address of the audited website, not your email | Google's servers, including in the United States |
| Google (Analytics 4 and Ads) | statistics about how the website is used and measuring our ads — only if you accepted statistics or marketing cookies (see the cookie policy) | Google's servers, including in the United States |
| Resend | sending the platform's emails (notifications, invitations, reports, the SEO audit report) | United States |
| Brevo (Sendinblue SAS) | the newsletter list and sending it; it receives only the address, first name and language of subscribers | European Union (France, Germany) |
| Awesome Projects SRL (Hostico) | website hosting | Romania |
| Intelligent IT SRL (SmartBill) | issuing and storing invoices | Romania |
Data may also reach whoever keeps our accounting records, where applicable, and public authorities, only when the law requires it.
Transfers outside the European Economic Area
Signing in to our admin panel (Firebase Authentication, Google) and sending emails (Resend) involve transferring some data to the United States. Both providers participate in the EU-U.S. Data Privacy Framework, and their contracts also include the standard contractual clauses approved by the European Commission. For the SEO audit, Google (PageSpeed Insights) also receives the address of the audited website, which may likewise be processed in the United States — only the address, not your email. The same goes for the website statistics in the client portal: Google (PageSpeed Insights and Search Console) receives only the client's website address, and we receive aggregated figures from Google (visits, searches, speed), with no data about visitors. The newsletter involves no such transfer: Brevo processes the data in the European Union.
How long we keep data
| Data | How long we keep it |
|---|---|
| Contact form requests that don't lead to working together | 12 months from submission, then deleted automatically |
| SEO audit requests (website address, email, result) | 12 months from submission, then deleted automatically (checked daily); until then, the report stays available at the link you received |
| Client and project data | for as long as we work together; afterwards, only as long as needed for legal obligations or to defend legal claims |
| Report links | expired ones are deleted daily; all of them 6 months after we stop working together, when your email address is also removed from the activity history and sent reports |
| Proposals sent as a link | 12 months after they expire, then deleted automatically; sooner if you ask us |
| Your address on the newsletter list | until you unsubscribe (the link in every newsletter) or ask us to remove you; the ticked box you subscribed with stays as proof of consent, for as long as we keep the request it came from |
| Invoices | 5 years, as required by law for accounting documents |
| IP address used to limit repeated attempts | about an hour, in server memory only |
| Visit statistics (Google Analytics) | 14 months at Google — the setting we chose in the account — after which data tied to an individual visitor is deleted automatically; aggregate reports, from which nothing about a person can be learned, remain. The cookies in your browser disappear when you withdraw consent, or at the time shown in the cookie policy's table |
Your rights
Under the GDPR, you have the right:
- to know what data we hold about you and receive a copy (Art. 15);
- to have inaccurate or incomplete data corrected (Art. 16);
- to have your data erased when we no longer have grounds to keep it (Art. 17);
- to restrict processing (Art. 18);
- to receive your data in a structured format or have it transmitted to another controller (Art. 20);
- to object to processing based on our legitimate interest (Art. 21);
- not to be subject to a decision based solely on automated processing (Art. 22) — we make no such decisions.
To exercise any of them, email us at contact@innotive.digital. We reply free of charge within one month; for complex requests this can be extended by two further months, in which case we'll let you know.
If you believe your data is processed unlawfully, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or with the supervisory authority in your country.
How we protect data
- the website only works over an encrypted connection (HTTPS);
- the database can't be accessed directly from the browser; every read goes through our server, after your account (or, for an SEO audit report, the link) is checked;
- each client sees only the data of their own collaboration;
- invitation links expire and work only once;
- an SEO audit report link contains a random code that is practically impossible to guess, and the report page doesn't show the email address of whoever requested it;
- the sign-in cookie can't be read by scripts on the page.
No measure guarantees absolute security. If an incident put your data at risk, we would notify the supervisory authority and, where the law requires it, you as well.
Children
Our services are not aimed at people under 16, and we don't knowingly collect their data.
Changes
We update this document when the way we process data changes. The date of the last update appears at the top of the page.