Privacy Policy

1. Who is responsible for your data

The data controller is Cittago s.r.l., a company registered in Cluj-Napoca, Romania — CUI 28098325, Trade Register J12/421/2011, registered office Muncitorilor Nr. 18, Ap. 15, 400424 Cluj-Napoca. You can reach us any time at or +40 734 190 106 for anything related to your data.

2. What we collect

• Information you give us — your name, email, phone number, company and message when you use a contact or booking form, subscribe to our newsletter, or email us directly.
• Details from the contact form, the booking step and the chat — the topics you are interested in, whether you are writing as a prospective client or as a partner, supplier or job applicant, any links you choose to send us (for example your portfolio, or projects similar to the one you have in mind), your optional brief answers, the meeting format, day and time you pick, the time zone we show them in, and the channel you prefer us to use. Along with the message we also receive a few technical details about the submission: the page, the site you came from, your browser's language and time zone, your screen size and your browser type.
• Your email consent — the date, the form and the exact wording you ticked or subscribed under (in our forms, in the site footer or on the Cittago Assistant page), your email preferences, and how you interact with our emails (opens and clicks).
• Exposure-scanner data — the website address you submit to the email-exposure checker, the scan's findings, and the name and email you leave in order to receive the report. We keep an internal copy of the report so we can answer follow-up questions about it; delivering the report is a service you requested (Art. 6(1)(b)).
• Usage data — with your consent to the analytics category, aggregated statistics about how pages are used (for example pages viewed and approximate region), so we can improve the site.
• Interaction recordings — with that same analytics consent, Microsoft Clarity and Hotjar record how you use the page: mouse movement, clicks, scrolling and the order of pages you visit. We can replay that visit and see it aggregated as a heatmap, which is how we find broken or confusing parts of the site. We do not use it to identify you and we do not record anything outside this website, but it is a recording of your visit rather than a count, so we list it separately instead of hiding it under "analytics".
• Advertising measurement — with your separate consent to the marketing category, an identifier stored by Google and by Meta that lets us see which campaign a visit came from and whether it led to an enquiry. It is a distinct purpose from analytics, which is why it is a distinct choice. Separately from cookies, if you have accepted the marketing category, when you submit a form our server sends Meta (through its Conversions API) a lead event: your email address, name and phone number, irreversibly hashed (SHA-256), your IP address, your browser type and the page, plus Meta's identifiers from your device. Without marketing consent, no form data goes to Meta.
• Technical data — standard server logs (IP address, browser type, timestamps) kept briefly for security and to keep the site running.

We do not knowingly collect special categories of data, and we do not buy or sell personal data.

3. Why we process it, and our legal basis

• To reply and provide services — because you asked us to, or to take steps before entering a contract (GDPR Art. 6(1)(b)).
• To send you emails from Cittago — the newsletter, insights and practical digital-marketing guides, plus offers and news about Cittago's services and products. The legal basis is your consent (Art. 6(1)(a); Art. 12(1) of Romanian Law no. 506/2004), given by ticking the box in our forms or by subscribing in the site footer. You can withdraw it at any time, just as easily: from the unsubscribe link in any email, or by emailing us.
• To measure and tailor our emails — our emails contain a pixel and links that pass through Brevo, so we can see what gets opened and clicked. We use this to send you content that matches your interests, and it is part of your email consent. We make no automated decisions with legal effects on you. You can block the pixel by turning off images in your email app.
• To prove consent — we keep the date, the form and the exact wording you ticked (Art. 7(1); legitimate interest, Art. 6(1)(f)).
• To keep the site secure and improve it — on the basis of our legitimate interest in running a safe, useful website (Art. 6(1)(f)), and your consent for non-essential analytics.

4. Cookies, analytics and advertising

We use a small number of essential cookies to run the site. Beyond those there are two optional categories — analytics (Google Analytics 4, plus Microsoft Clarity and Hotjar, which record the visit as described above) and marketing (Google Ads, including our own remarketing audience lists, and the Meta pixel) — and you allow or refuse each one independently. Nothing optional loads before you answer, refusing is a single click, and you can change your mind at any time from Cookie settings in the footer. Page views are also counted by Cloudflare Web Analytics, which uses no cookies and cannot identify you. The full list, with retention periods measured from a real visit, is in our Cookie Policy.

5. Who we share it with

We share data only with service providers who help us operate, and only what they need to do their job, under contract. Today those are: Brevo (France, EU: sends our emails and holds the contact list, which also receives every enquiry sent through the site's forms as a record of enquiries: your name, email address, phone number, language and the form used; without email consent, the contact is kept only as a record of the enquiry: not subscribed, and sent no campaigns. Brevo acts as our processor, under a data processing agreement in line with Art. 28 GDPR), our hosting provider, Cloudflare (content delivery, cookieless page-view counting and spam protection for our forms, Turnstile), Google (Analytics 4 and Google Ads, only with your consent), Microsoft (Clarity, session recording and heatmaps, only with your analytics consent), Hotjar — part of Contentsquare — (session recording and heatmaps, only with your analytics consent) and Meta (the advertising pixel and, from our server, the lead event sent for each form, described in section 2 — both only with your marketing consent). We may also disclose data where the law requires it.

When you message us on WhatsApp, the conversation takes place on the WhatsApp platform, operated by WhatsApp Ireland Limited under its own terms. We use your messages only to reply to you (Art. 6(1)(b)). A WhatsApp message does not subscribe you to our emails, and we do not send you promotional messages on WhatsApp without your separate consent.

We also publish our own content to social platforms through an internal tool of ours. It signs in to LinkedIn, Meta (Facebook and Instagram) and Google Analytics using Cittago's own accounts, in order to post what we write and to read how those posts performed. It does not collect, request or store personal data about you, about anyone who sees our posts, or about anyone who interacts with them.

Where a provider processes data outside the European Economic Area, we rely on an appropriate safeguard. For Google and Meta that is the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework, under which both are certified; for any provider not covered by an adequacy decision, the Commission's Standard Contractual Clauses.

6. How long we keep it

We keep enquiry and client data for as long as needed to answer you and to meet legal or accounting obligations, then delete or anonymise it. Email data is kept until you unsubscribe or withdraw your consent. After you unsubscribe, your contact record stays in Brevo, marked as excluded from all sending, so that we do not write to you again, and we keep the proof of consent for 3 years after withdrawal, the general limitation period under Romanian law (Art. 2517 of the Civil Code). Server logs are kept for a short period only.

7. Your rights

Under the GDPR you can ask us to give you access to your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Where processing is based on consent, you can withdraw that consent at any time without affecting what came before. You can object at any time, without giving a reason, to direct marketing and to any profiling linked to it (Art. 21(2)–(3)), and we will stop straight away. To withdraw your email consent, use the unsubscribe link in any email, or email us. To exercise any right, email . You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro).

8. Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS) and access controls. No method of transmission is perfectly secure, but we work to keep the risk low.

9. Children

Our website and services are intended for businesses and adults. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date above always reflects the current version. For any new purpose we will ask for your consent again; consent you have already given is never extended without asking you.

11. Contact

Questions about your privacy? Write to — Cittago s.r.l., Cluj-Napoca, Romania.