1. Data controller
The controller of your personal data is THINK ADMARKETING S.R.L., registered office: 72 Matei Basarab St., room 1, bl. L112, sc. 1, fl. 2, ap. 10, District 3, Bucharest, Romania, tax ID (CUI) 48700220, Trade Register no. J2023016080400. The Company acts as controller for the data of users and of people who use the thinkadmarketing.com website. For any question about your data, email us at [email protected] or call +40 767 390 470 (Monday–Friday, 9:00 AM – 5:00 PM (Romania time)).
2. What data we process and where it comes from
Through the enquiry form: your first and last name, email address, phone number and field of activity, and optionally your company name, unique identification code, Trade Register number, the name and title of the contact person or company representative, current website, company logo or brand, preferred template, services of interest and message. The form also sends the page language and a technical request ID used to prevent duplicate submissions.
By email, phone, WhatsApp and at contracting: client and representative identification, billing address and email, agreement and invoice records, bank account where necessary, payment history (amount, date, reference and status), withdrawal or termination requests and communication evidence (recipient, date, message ID and document fingerprint). Full card details and security codes are entered directly in the payment provider’s interface when online payment is enabled; they are not collected in our form or administrative database.
Technical data: when you visit the website, our hosting provider automatically processes technical data (IP addresses and infrastructure security logs, technical identifiers or cookies, browser type, date and time) needed to deliver pages and keep the service secure. We do not use analytics, tracking pixels or personalised advertising.
Page language: on your first visit without a manual choice, we use the country code provided by the infrastructure: Romanian for Romania and Moldova, English for all other countries or an unknown country. A manual RO/EN choice takes precedence. We do not store your IP address solely to choose the language and we do not use an external geolocation service.
Please do not send us sensitive data (for example health information) through the form.
3. Why we process it and on what legal basis
| Purpose | Legal basis (Regulation (EU) 2016/679 – GDPR) |
|---|---|
| Initiating contact and preparing the agreement | Art. 6(1)(b) – steps taken at your request before entering into a contract |
| Contract communications and administration: offers, confirmations, agreements, invoices, payment notices, withdrawals and reimbursements, including evidence of document transmission | Art. 6(1)(b) for an individual who is a party to the agreement; Art. 6(1)(f) for contacts and representatives of corporate clients – our legitimate interest in managing the business relationship |
| Issuing, sending, recording and retaining invoices and accounting records, including mandatory tax reporting where required by law | Art. 6(1)(c) – legal obligation |
| Security of the website, forms, infrastructure and administrative panel: abuse prevention, authorised access control and administrative operation logging | Art. 6(1)(f) – our legitimate interest in keeping the service secure |
| Establishing or defending legal claims | Art. 6(1)(f) – legitimate interest |
| Marketing emails, only with your separate, express consent | Art. 6(1)(a) – consent |
| Presenting our professional portfolio on our website | Art. 6(1)(a) – consent |
The marketing checkbox in the form is unchecked by default and optional; leaving it unchecked means you refuse, and refusing does not prevent you from requesting a quote or entering into a contract. You may withdraw consent at any time, using the method indicated in the message or at [email protected], without affecting the lawfulness of prior processing. Communications needed for your enquiry or the agreement are distinct from marketing. We do not make automated decisions with legal effects on you.
4. Hosting and providers
The thinkadmarketing.com website uses Cloudflare infrastructure for hosting and security. Our own administration envisages Cloudflare Workers (processing), D1 (administrative records) and Access (restricted access for authorised persons), separate from static client websites. They are used for real data only after the approved configuration has been activated and verified. Websites are not hosted on our own servers; after a full purchase and handover, the client is responsible for hosting.
The recipients below receive only the data needed for their purpose. Oblio and NETOPIA are described for their approved planned activation; listing them does not mean they already process real transactions. Before use, the final notice must match actual activation, agreements and account settings.
- Our accountant and the tax authorities, including ANAF where reporting is mandatory – the data needed for accounting and tax obligations.
- Cloudflare, Inc. – hosting, security (including anti-spam protection for the form), Workers, the D1 database and Access control, depending on the services activated. The DPA applies as processor to content processed for THINK; certain own account and usage records have a separate role under the provider’s privacy notice. Data may pass through its global network; an EU jurisdiction configured for a D1 database does not guarantee EU-only residence for logs or all services. Access may process the authentication identifier, IP address and access events of authorised persons. https://www.cloudflare.com/cloudflare-customer-dpa/ and the provider’s subprocessor list.
- NETOPIA FINANCIAL SERVICES S.A. (NETOPIA Payments), tax ID 43131360 – online payments, when enabled. It receives the data needed for the transaction, billing and fraud prevention; we receive the payment reference and outcome, rather than full card details or security codes. For payers, NETOPIA generally declares an independent-controller role and a standard five-year retention of transaction data, subject to its own duties and exceptions (NETOPIA notice). It is not automatically treated as THINK’s processor.
- Oblio Software S.R.L., tax ID 37311090 – issuing and administering invoices and, where configured, tax reporting. It receives the identity and billing details, service, amount and payment information needed. A processor role for THINK invoice data is proposed subject to actual instructions and the account agreement. Its DPA, locations, subprocessors, transfers and retention must be checked before activation. No claim is made of Romania-only storage or an already verified DPA. Entity verified at https://www.oblio.eu/terms.
- Plus Five Five, Inc. (Resend) – delivering form enquiries and contractual and administrative emails, including documents and invoices, when the relevant flow is enabled. It acts as processor for message data under its DPA and as a separate controller for certain own account/usage data. Content, recipients and logs may be stored in the United States; choosing an EU sending region does not move storage to the EU. The provider currently states 30 days for standard-account email and log data, 7 days for backups and deletion of remaining data within 90 days after account termination; the actual plan must be checked. https://resend.com/legal/dpa and https://resend.com/security/gdpr.
- Banking, domain-registration and mailbox providers – only the data needed for the services actually used.
We do not offer client sign-in through social networks. If you contact us on WhatsApp, WhatsApp processes data under its own policies.
5. Transfers outside the European Economic Area
Transfers outside the EEA are assessed for each provider and service actually used. Cloudflare and Resend provide for Standard Contractual Clauses and, where applicable and valid, participation in the EU–US Data Privacy Framework; compliance is not inferred from the selected region alone. NETOPIA states that storage is generally in Romania, with possible transfers protected by the applicable legal mechanisms. For Oblio, the arrangements and locations have not yet been confirmed from an account-level DPA and are checked before activation. You can request information and copies of the relevant safeguards at [email protected].
6. How long we keep it
- Enquiries that do not lead to a contract: up to 12 months after the last communication. Review is manual, prompted by a notification in the administrative panel, with no automatic deletion, and is scheduled so that deletion or anonymisation is completed on time across all active copies, including emails and separately saved files. Postponing a task in the panel does not extend the 12-month limit. Exceptional retention required by a legal obligation or a specific legal claim is limited to the relevant records, with a documented legal basis, reason, restricted access and review date.
- Marketing: until consent is withdrawn or the purpose ends; afterwards we keep only the minimum record needed to demonstrate your choice and respect your refusal.
- Contractual clients, invoices and tax records have separate periods. Invoices and accounting records are kept for the period required by accounting and tax law; transmission and payment evidence only as long as needed for legal obligations and related legal claims. Data that is no longer needed is not kept merely because an invoice exists. Exact periods per category are recorded in the internal retention register before activation.
- Technical logs, administrative evidence and backups have separate periods, based on the service actually used and security needs. Deleting an enquiry in the panel does not automatically erase emails, provider logs or independent backups. Backups have restricted access, are not used for normal operations and are removed through a documented rotation cycle; deletions are reapplied after a restoration.
- A client website’s technical archive, separate from the administrative database and tax records, is deleted within 30 calendar days after termination, subject to the justified exceptions in the Terms and Conditions.
- Portfolio: publication follows the agreement, anonymisation and the applicable consent.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, objection and data portability; the right to be informed of any rectification, erasure or restriction and of a personal data breach; the right to withdraw consent; and the right to lodge a complaint with a supervisory authority. To exercise them, email us at [email protected]. We reply within one month, which may be extended as permitted by the GDPR.
You can lodge a complaint with the Romanian supervisory authority, ANSPDCP, 28–30 General Gheorghe Magheru Blvd., Sector 1, Bucharest (www.dataprotection.ro), or with the data protection authority of the EU country where you live or work.
8. Security
We use HTTPS, authorised administrative accounts, abuse protection and operation logs. Technical secrets are kept outside public code. The D1 database, emails, exports and backups are included in our security and retention inventories; deletion and restoration are checked on each system. Activating a service requires confirmation of the necessary data processing agreements and testing of the configured measures. We do not promise our own certifications, an absolute absence of incidents or EU-only storage.
9. Client websites
This policy covers only thinkadmarketing.com and our own commercial relationship. For visitors to a client’s website, the client is the controller and provides the notice appropriate to their own activity. We do not use that data for our own purposes.
Building a website for a client does not by itself make us the controller of their visitors’ data. If we process data on a client’s behalf — by running the contact form, delivering email or through technical access — our role as processor or sub-processor, and the obligations that come with it, are set out in a Data Processing Agreement (DPA), entered into before that processing begins, according to the actual operations, our supplier contracts and the agreements required. The hosting provider acts, where applicable, as a sub-processor under the DPA.
10. Changes
We update this policy when the way we process data changes. The version in force and the date of the last update are shown on this page.