Privacy policy

This English version is a translation provided for convenience. In case of any discrepancy, the Romanian version prevails. The original: Politica de confidențialitate.

In short: we use the data you send us to reply to you and to prepare a quote. We set statistics and advertising cookies only if you agree, through the cookie banner; without your consent, Google tags send only cookieless signals, and the Meta, TikTok, LinkedIn, and OpenAI pixels do not load at all (section 2.4). We do not sell data. You can write to us at any time at contact@epicads.ro to find out what data we hold about you, or to have it corrected or erased.

1. Who we are

The controller is BIZEPIC SRL (trading as EpicAds), tax identification number (CUI) 36779077 (VAT number RO36779077), Trade Register number J2016002105056, with its registered office at str. Atacului nr. 15/A, Oradea, Bihor County, postal code 410183, Romania. Our office, where we meet clients, is in Oradea, Piața 1 Decembrie nr. 9, Palatul Ullmann.

Contact for any question about personal data: contact@epicads.ro, phone +40 745 181 913, or by post to either of the addresses above.

We have not appointed a data protection officer (DPO): we are not required to (Art. 37 GDPR), because we do not process sensitive data on a large scale. For any question about your data, write to us at contact@epicads.ro.

2. What data we process, why, and on what legal basis

2.1. The quote request and the contact form

What data: your name, email address, phone number, company website, the services you are interested in, your budget range, your ad account ID (if you provide it), and your message. In addition, the form automatically sends the page you submitted it from, your IP address, your browser type and—if you came from an ad—the click identifier (gclid, fbclid, etc.) and the campaign parameters (utm_*).

Why: to reply to you, to prepare the quote, and to know which campaign you came from. Your request reaches our customer relationship management system (CRM) and the team’s email.

Legal basis: steps taken at your request prior to entering into a possible contract—Art. 6(1)(b) of Regulation (EU) 2016/679 (the “GDPR”). For a message sent through the contact form that is not about a quote: our legitimate interest in replying to you, Art. 6(1)(f). For the IP address, browser, and time of submission (proof that you sent the form and the prevention of abuse): also our legitimate interest, Art. 6(1)(f). The forms have no consent checkbox: for the data in them we do not rely on consent, but on the legal bases above; under the submit button you will find a short notice and a link to this page. The fields marked as required are needed for us to reply; without them we cannot prepare a quote.

How long: 2 years from the last message, if you do not become a client. If you become a client, the data in the contract and invoices is kept for as long as accounting law requires (Romanian Law 82/1991).

2.2. Applying for a job

What data: your name, email, phone number, the role you chose, your CV (the PDF, DOC, or DOCX file you upload, or the link to your CV or LinkedIn profile), and what you tell us about yourself. Why: to assess you and contact you for an interview. Where it is kept: the application and the CV reach our administration panel, where only colleagues with an account can see them, and the email of the person handling recruitment (the CV as an attachment). The CV file is stored on our server, in a non-public area, not on the website. Applications do not go into the sales CRM and do not reach the advertising platforms. Legal basis: steps prior to entering into a contract, Art. 6(1)(b) GDPR. How long: the CV and the application are kept for 6 months from submission, then deleted automatically. We delete them sooner if you ask us at contact@epicads.ro.

2.3. Ad measurement (only with your consent)

If you accept marketing cookies, after you submit the form we tell the advertising platforms that an ad brought in a request, together with:

• your email address, phone number, and name, irreversibly hashed (SHA-256)—to Google Ads (Enhanced Conversions) and Meta (Conversions API) and, when we enable them, to LinkedIn and TikTok through their equivalent interfaces; the platform matches them against its own accounts to attribute the conversion, without receiving the data in clear text;
• the click identifier and the platform’s cookies (for example _fbp), plus your IP address and browser, so the platform can link the request to the click;
• an estimated value of the request, calculated from the budget range you chose, so the algorithms learn what kind of clients the ads bring in.

Legal basis: your consent—Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004. Without consent for marketing, our server sends nothing to these platforms, and your contact details do not reach them in any form; the Google tags on the page may send only the cookieless signal that a request was submitted (section 2.4). You can withdraw your consent at any time from “Cookie settings” at the bottom of the page.

The budget range helps us prioritize requests. We do not make decisions based solely on automated processing that produce legal effects concerning you: every request is read by a person.

2.4. Statistics and advertising on the website

Google tags load on every page. Google Tag Manager, Google Analytics 4 (G-KFFT4ZDGXL) and Google Ads (AW-16511797551) run in Google Consent Mode v2, in advanced mode:

• without your consent, they do not set or read cookies and do not use browser identifiers. They send Google only cookieless signals—for example, that a page was visited or a form was submitted, together with the state of your choice. Like any request on the internet, these signals contain the IP address and the browser type. Google uses them to estimate statistically the visits and conversions it cannot measure directly;
• with consent for statistics, Google Analytics sets its cookies and measures visits in the usual way;
• with consent for marketing, Google Ads sets its cookies and the data may be used to measure and personalize ads.

Google Analytics signals—both those with cookies and the cookieless ones from visitors who refuse—first pass through our tagging server ea.epicads.ro (section 4) and only then reach Google.

The Meta, TikTok, LinkedIn, and OpenAI pixels do not load at all without consent for marketing: we block them in Google Tag Manager until you accept.

Every cookie, who sets it, and how long it lasts: Cookie policy.

Legal basis: for cookies and for the other platforms’ pixels, your consent—Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law 506/2004. For the cookieless signals sent by Google tags when you have not accepted, our legitimate interest in having aggregated statistics about visits and ad performance, Art. 6(1)(f) GDPR. You can object at any time by writing to us; you can also block them in your browser.

2.5. Record of your choice in the banner

When you make a choice in the cookie banner, we keep a record with: a random identifier (not linked to your name or to any form), the policy version, the accepted categories, the date, your truncated IP address (without the last segment), and your browser type. Why: the law requires us to be able to demonstrate consent (Art. 7(1) GDPR). Legal basis: legal obligation, Art. 6(1)(c). How long: 3 years, then it is deleted automatically.

2.6. Operation and security of the website

The server technically logs every request (IP address, date, page, browser) so we can stop attacks and fix errors; the forms have submission limits per IP address. Legal basis: our legitimate interest in keeping the website secure, Art. 6(1)(f). How long: up to 30 days, after which the logs are deleted.

2.7. Reviews and videos

The website shows reviews published by clients on our Google profile, with the name publicly displayed there, and video reviews recorded with clients. Legal basis: for Google reviews, our legitimate interest in showing what clients say, from public sources—you can ask us at any time to remove a review; for videos, the consent of the people filmed: video reviews are published with the consent of each person who appears in them.

Videos do not load until you click on them: until then you see only an image hosted by us, and your browser does not contact YouTube. After you click, the video plays from youtube-nocookie.com, and Google receives your IP address and may set cookies, under its own policy.

2.8. When you write to us or call us directly

If you write to us by email or WhatsApp, or call us, we use the data in your message to reply to you (Art. 6(1)(b) or (f)) and keep it for as long as the conversation lasts, plus the period set out in section 2.1.

2.9. The website chat

If you write to us in the chat window in the corner of the page, we receive your messages and the page you are writing from, plus, if you arrived through an ad, its parameters (UTM, gclid, fbclid). We use them to reply to you and, if you leave your contact details, to send you a quote (Art. 6(1)(b) GDPR). The chat does not set cookies and does not store anything in your browser until you send the first message. Conversations are kept in the same way as quote requests (section 2.1).

3. What we don’t do

• We do not sell or rent data.
• We do not send you newsletters or commercial offers by email unless you have subscribed separately.
• We do not use Google Fonts from Google’s servers: the website’s fonts are hosted by us.
• The map on the contact page is an image hosted by us; the Google Maps map loads from Google (which receives your IP address) only after you click “Open the Google map.” Details in the Cookie policy.
• Our services are aimed at businesses. We do not knowingly collect data from children under 16.

4. Who else receives the data

The data reaches only the companies that help us operate (processors, under contracts that bind them to confidentiality) and the statistics and advertising platforms, within the limits set out in section 2.4:

• hosting of the website and the CRM: DataNode (ACVILE TECH SRL), with servers in Romania.
• the tagging server: Stape Europe OÜ (Tallinn, Estonia), with the server in the European Union (Poland). Google Analytics 4 data first passes through ea.epicads.ro, a tagging server of ours hosted by Stape, and only then reaches Google—both the data with cookies, when you have accepted statistics, and the cookieless signals, when you have refused (section 2.4). The server does not set cookies. Stape hosts it as a processor and does not use the data for its own purposes.
• the website chat: Leaply (leaply.ro), operated by ARHAI SRL, Oradea, a sister company of EpicAds, with servers in the European Union. It receives the chat messages and passes them on to our CRM.
• sending notification emails to the team: Resend, a transactional email provider based in the US.
• the team’s email (contact@epicads.ro): ClausWeb, Romania.
• Google statistics and advertising: Google Ireland Limited (Google Analytics, Google Ads, Google Tag Manager, YouTube)—the cookieless signals described in section 2.4 on every visit; cookies and advertising data only with consent.
• advertising, only with consent for marketing: Meta Platforms Ireland Limited (Facebook, Instagram), TikTok Technology Limited (Ireland), LinkedIn Ireland Unlimited Company, OpenAI Ireland Limited (ads in ChatGPT).
• For the data collected by their tags and pixels, the platforms above are joint controllers with us (Art. 26 GDPR) or independent controllers, according to their terms.
• accounting, legal advice, public authorities—only when the law requires it or to defend a legal claim.

5. Transfers outside the European Economic Area

Google, Meta, LinkedIn, TikTok, OpenAI, and Resend are groups with their main establishment or servers outside the EEA, in particular in the US. Transfers are made:

• to companies certified under the EU-U.S. Data Privacy Framework (the European Commission’s adequacy decision of July 10, 2023)—Google, Meta, and LinkedIn/Microsoft are certified;
• for Resend, TikTok, and OpenAI, on the basis of the standard contractual clauses approved by the European Commission (Art. 46 GDPR) and/or certification under the EU-U.S. Data Privacy Framework, as applicable, under the data processing agreements concluded with each of them.

6. Your rights

You have the right to request: access to your data and a copy of it; rectification of inaccurate data; erasure; restriction of processing; portability (your data, in a structured format); to object to processing based on legitimate interest; and to withdraw your consent at any time, as easily as you gave it—for cookies, from “Cookie settings” at the bottom of any page. Withdrawal does not affect processing lawfully carried out before it.

Write to us at contact@epicads.ro. We reply within one month at the latest (Art. 12(3) GDPR); if the request is complex, we will tell you within the first month that we need up to two more months. We may ask you to confirm your identity, so that we do not give your data to someone else.

If you are not satisfied, you can lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, postal code 010336, Bucharest, Romania; www.dataprotection.ro; anspdcp@dataprotection.ro—or you can go to court.

7. How we protect the data

The website runs only over HTTPS, with security policies that prevent unauthorized third-party code from loading. The administration panel is accessible only to the team, with a password and a limit on login attempts. The access keys for the CRM and email are encrypted. Only the team members who work with requests have access to them.

8. Changes

When we change what data we process or who we send it to, we update this page and the date at the top. If the change concerns cookies, the banner asks for your choice again.