This policy explains what personal data CYBERVETTER S.R.L. handles when you use this website or write to us, why we handle it, how long we keep it, and the rights you can exercise under the General Data Protection Regulation (EU) 2016/679.
1. Who is responsible
The controller is CYBERVETTER S.R.L., Constanța, Romania, Trade Register ROONRC.J13/453/2021, CUI / VAT ID: RO43723117. The registered office and full statutory particulars are set out in our company information page.
Data protection enquiries should be addressed to privacy@cybervetter.com. That address reaches the person accountable for data protection at the firm.
[PLACEHOLDER: statement of whether a Data Protection Officer has been designated under Article 37 GDPR, and the DPO’s contact details if so.]
2. What we collect, why, and for how long
We collect only what you send us. There is no tracking, profiling, advertising or automated decision-making on this site, and no special category data is requested at any point — please do not include any in a form submission.
Enquiries sent through the contact form
Data
Name, organisation, email address, chosen topic, the content of your message, and the time of submission.
Purpose
To read your enquiry, reply to it, and take the pre-contractual steps needed to establish whether and how we can help.
Lawful basis
Article 6(1)(b) GDPR — steps taken at your request prior to entering a contract; and Article 6(1)(f) GDPR — our legitimate interest in responding to business correspondence.
Retention
24 months from the last exchange where an enquiry does not proceed. Where an engagement follows, the correspondence is retained under the engagement record.
Newsletter subscriptions
Data
Email address, the confirmation timestamp, and the record of your consent.
Purpose
To send the Insights briefing you asked for, and to demonstrate that the subscription was confirmed.
Lawful basis
Article 6(1)(a) GDPR — consent, given through a double opt-in confirmation. You may withdraw it at any time.
Retention
Until you unsubscribe, after which the consent record is kept for a further 12 months as proof that the subscription was lawful.
Server request logs
Data
IP address, timestamp, requested URL, HTTP status, referrer and user-agent string.
Purpose
To operate the site reliably, to investigate faults, and to detect and defend against abuse.
Lawful basis
Article 6(1)(f) GDPR — our legitimate interest in the security and availability of our own systems.
Retention
[PLACEHOLDER: hosting log retention period, to be confirmed with the hosting provider]
Vulnerability reports
Data
The contact details and technical content you choose to send us.
Purpose
To triage, verify and remediate the reported weakness, and to credit you if you wish.
Lawful basis
Article 6(1)(f) GDPR — our legitimate interest, and yours, in the security of our systems.
Retention
36 months from closure of the report, as part of the remediation record.
3. Cookies and tracking
This site sets no cookies and loads no third-party scripts. See the cookie policy for the detail.
4. Recipients and processors
We do not sell personal data and we do not share it for advertising. Data is disclosed only to the service providers we need in order to operate, each bound by a written processing agreement under Article 28 GDPR, and to public authorities where the law compels disclosure.
Website hosting and content delivery
[PLACEHOLDER: hosting provider name, legal entity and country of processing]
Email transmission and mailbox hosting
[PLACEHOLDER: email provider name, legal entity and country of processing]
Contact form handling and delivery
[PLACEHOLDER: form or transactional email provider name and legal entity]
Newsletter distribution
[PLACEHOLDER: newsletter provider name and legal entity]
Professional advisers and accountants
Engaged only where necessary, bound by professional confidentiality, acting as independent controllers or processors as the case requires.
5. International transfers
Our intention is that personal data is processed within the European Economic Area. Where a provider processes data outside the EEA, the transfer is made on the basis of an adequacy decision of the European Commission under Article 45 GDPR, or, in the absence of adequacy, the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) under Article 46 GDPR, supported by a transfer impact assessment and any supplementary technical measures it identifies.
[PLACEHOLDER: for each processor listed above, the country of processing and the specific transfer mechanism relied upon. A copy of the clauses relied upon can be requested from privacy@cybervetter.com.]
6. Your rights
Under the GDPR you have the following rights in respect of your personal data.
Access
A copy of the personal data we hold about you (Article 15).
Rectification
Correction of data that is inaccurate or incomplete (Article 16).
Erasure
Deletion where we no longer have a basis to keep it (Article 17).
Restriction
A pause on processing while a dispute is resolved (Article 18).
Portability
Machine-readable transfer of data you gave us on consent or contract (Article 20).
Objection
Objection to processing based on our legitimate interests (Article 21).
Withdraw consent
Withdrawal of consent at any time, without affecting processing already carried out (Article 7(3)).
How to exercise them
Write to privacy@cybervetter.com and describe what you want. There is no form to complete and no charge. We respond within one month of receipt, extendable by a further two months for complex requests, in which case we will tell you within the first month. If we cannot identify you from the data we hold, we may need to ask for information that lets us match your request to a record; we will not use it for anything else.
To stop receiving the Insights briefing, use the unsubscribe link in any issue or write to the address above.
7. Complaints
If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Romanian supervisory authority:
Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, Romania www.dataprotection.ro · anspdcp@dataprotection.ro
You may also complain to the supervisory authority of your habitual residence or place of work, and you retain the right to a judicial remedy.
8. Security
Data in transit to this site is encrypted with TLS. Access to enquiry correspondence is limited to the people who need it in order to respond. If you find a weakness in one of our systems, please tell us through our contact form.
9. Changes
Where this policy changes materially, the revised version is published here with a new date. Version: 12 January 2026.
Placeholders
Entries marked [PLACEHOLDER: …] require a confirmed value — provider identities, processing locations and log retention — before this policy is relied upon in publication.