This policy explains, in plain language, what personal data we process when you visit eliptum.tech or contact us, why, how long we keep it, how it is protected and what your rights are. It is written to meet the EU General Data Protection Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018 implementing it.
In short
- No cookies, analytics, advertising or tracking of any kind.
- We only receive what you type into the contact form or the chat, what you give us when you create an account, or what you send us by e-mail or phone.
- We use it only to reply to you, to run your account and, if you become a client, to deliver our services.
- When you send the contact form or use the chat, we create an account for you automatically (a "guest" account) and save an ID in your browser so that you find your conversation again on your next visit. Nothing is saved in your browser before that.
- Data is stored on servers in the European Union, encrypted with a separate key for each person, and never sold or shared for marketing.
- Conversations and accounts that are not used for 24 months are deleted.
- You can download or delete your data yourself in the chat window, or ask us at any time to see, correct or delete it.
1. Who is responsible for your data
The data controller is ELIPTUM TECHNOLOGIES S.R.L., a company registered in Romania (details below and in our Legal Notice). For any data-protection question or request, write to contact@eliptum.tech or call +40 750 295 552.
- Company
- ELIPTUM TECHNOLOGIES S.R.L.
- Registered office
- Str. Someș nr. 2, Tecuci, jud. Galați, Romania
- Trade Register no.
- J17/1137/2022
- Tax ID (CUI)
- 46407666
- EUID
- ROONRC.J17/1137/2022
- VAT
- RO46407666
- contact@eliptum.tech
- Phone
- +40 750 295 552
- Website
- eliptum.tech
We are a small company and are not required to appoint a Data Protection Officer (GDPR art. 37). Privacy requests are handled directly by the company's management.
2. What we collect, why, and on what legal basis
a) Contact form and chat
The contact form and the chat window (bottom right of the page, once you have written to us) are one conversation with our team. When you send the form or a chat message we receive:
- your name and e-mail address (required in the form, optional in the chat);
- your company name and the service you are interested in (optional);
- your messages, our replies, and the date and time of each;
- whether each message has been read, and when you were last active in the chat (used to decide whether to e-mail you our reply);
- the page of our site the message was sent from.
E-mails we send. Each message you send is forwarded to our company mailbox (contact@eliptum.tech) so that we can answer. If you gave us an e-mail address, we send you a copy of your message as confirmation, and we e-mail you our reply when you are no longer on the site. These are service messages about your own conversation, never marketing. An address typed into the form or the chat is not verified: if someone entered your address by mistake, ignore the e-mail or tell us and we will erase it.
The same applies to information you send us directly by e-mail or give us by phone.
Purpose: to reply to your enquiry, discuss your needs and prepare a proposal.
Legal basis: steps taken at your request before entering into a contract (GDPR art. 6(1)(b)) and our legitimate interest in answering business enquiries (art. 6(1)(f)).
Please do not include sensitive data (health, political opinions, etc.) or confidential technical details in the form or the chat. If an NDA is needed, we sign it before you share confidential information.
b) Guest accounts, registered accounts and your device
Guest account (automatic). The first time you send the contact form or a chat message, we create an account for you without asking for a password, so that your conversation has an owner. To recognise your browser on your next visit, the site generates a random device ID and saves it in your browser's local storage together with a rough device type (desktop, tablet or phone, derived from your browser). On our server we keep the device type and a one-way keyed hash of the device ID, not the ID itself. We do not use the ID to follow you across pages or sites, and we do not collect browser fingerprints. Visitors who never use the form, the chat or an account get no ID and no account.
Registered account (optional). You can turn the guest account into a registered one to continue the conversation from other devices. We then process your e-mail address, your name if you give it, and your password, of which we keep only a salted hash that is itself encrypted. We confirm your address by sending a 6-digit code to it. The same kind of code is used to reset a forgotten password. Codes are valid for 15 minutes and are stored only as a hash.
Sessions. While you use the chat or an account, your browser holds a short-lived access token (in memory, 15 minutes) and a refresh token (in local storage, up to 60 days, replaced every time it is used). On our server we keep only a hash of the refresh token and its expiry date. Signing out cancels it.
Security records. We count failed sign-in attempts and wrong codes per account and temporarily lock the account after five failures.
Purpose: to let you keep and continue your conversation, to sign you in, and to protect accounts against misuse.
Legal basis: providing a service you asked for (art. 6(1)(b)) and our legitimate interest in keeping accounts secure (art. 6(1)(f)).
c) Clients and contracts
If you become a client we also process the contact details of your representatives, contract and invoicing data. Legal basis: performance of the contract (art. 6(1)(b)) and our legal obligations under Romanian accounting and tax law (art. 6(1)(c)). Data we access in your systems while delivering the services (for example test data in your repositories) is processed only on your instructions, under a separate data processing agreement (GDPR art. 28) where required.
d) Technical data when you visit the site
Like every web server, ours records each request in a log file: your IP address, date and time, the page requested, the response status, the referring page and your browser's user-agent string. When you send the contact form, use the chat, sign in or ask for a code, your IP address is also held in the server's memory for one hour to limit automated abuse (for example, at most five contact-form messages per hour from one address). It is not saved with your account or your messages.
Purpose: to deliver the site, keep it secure, detect abuse and fix errors. We do not use these logs to profile visitors or build statistics about them.
Legal basis: our legitimate interest in operating a secure website (art. 6(1)(f)).
What we do not do
- No cookies, analytics, pixels, fingerprinting or session recording. The only thing saved in your browser is the session entry described above, and only after you use the form, the chat or an account (see the Cookie Policy).
- No third-party scripts, fonts, maps, videos or social-media plugins: everything is served from our own server, so visiting the site does not reveal your IP address to anyone else.
- No newsletters or marketing e-mails, and no selling, renting or sharing of data for marketing.
- No automated decision-making or profiling (art. 22).
3. Where and how your data is stored
Accounts and conversations are stored in a PostgreSQL database on our own server, hosted in a data centre in the European Union. Messages are also sent by e-mail to our company mailbox, and to you, as described in section 2a. Server logs are kept on the same server.
Encryption at rest, one key per person. Your name, e-mail address, company, password hash and every chat message are encrypted in the database with AES-256-GCM, using an encryption key generated only for your account. That key is itself encrypted with a master key kept outside the database, and is stored in a table of its own, separate from the data it protects. Where we need to look an account up by e-mail address, we use a one-way keyed hash (HMAC-SHA256) of the address rather than the address itself. Someone who obtained a copy of the database alone could not read your data. What is not encrypted is limited to technical fields: the account type, dates and times, read markers, the device type, the service and page a message refers to, and the hashes mentioned above.
We protect personal data with appropriate technical and organisational measures (GDPR art. 32), including:
- encryption in transit: the whole site is served only over HTTPS (TLS) with HSTS;
- the database accepts connections only from the server itself and is not reachable from the internet;
- access to the server, database and mailbox is restricted to authorised company personnel, protected by strong credentials, and credentials are kept out of source code;
- the contact form, chat and sign-in are protected against spam and abuse (rate limiting, input validation, bot trap, temporary lock after repeated wrong passwords or codes);
- passwords are stored only as salted hashes, sessions use short-lived tokens, and resetting a password signs out every device;
- only staff accounts designated as administrators can read conversations, and each visitor can read only their own;
- software is kept up to date, and data is limited to what is needed and deleted on schedule (section 5);
- web server logs are rotated daily and deleted after 30 days, and our application logs do not record IP addresses.
If a personal-data breach ever occurs that is likely to put your rights at risk, we will notify ANSPDCP within 72 hours and inform you without undue delay, as required by GDPR arts. 33 and 34.
4. Who receives your data
Your data is accessed only by our team. We use the following service providers (processors), who act only on our instructions under data processing terms that meet GDPR art. 28:
| Provider | What they do | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting: runs the website, the database (accounts and conversations) and the server logs | Germany (EU) |
| X Host Communication S.R.L. (20x.host) | E-mail hosting: delivers confirmation codes, copies of chat and contact-form messages and our replies, and stores our e-mail correspondence | Romania (EU) |
We may also share data with our accountant, lawyers or auditors where needed, and with public authorities when the law requires it. We do not transfer your data outside the European Economic Area. If that ever becomes necessary, we will do it only with the safeguards of GDPR chapter V (an adequacy decision or the European Commission's Standard Contractual Clauses).
5. How long we keep it
| Data | Retention |
|---|---|
| Conversations (contact form and chat) and guest accounts that do not lead to a contract | 24 months after you last used the chat, then erased automatically |
| Registered accounts (e-mail address, name, password hash) | Until you delete the account, or 24 months after you last used it |
| Guest accounts that never sent a message | 30 days after the last visit |
| Confirmation and password-reset codes; unfinished registrations | Codes expire after 15 minutes; leftovers are cleared within 24 hours |
| Session (refresh) tokens | Up to 60 days after last use; cancelled at sign-out |
| Enquiries received before the chat was introduced, and e-mail correspondence | 24 months after our last exchange, then erased |
| Client correspondence and contract data | For the duration of the contract and up to 3 years after it ends (the general limitation period under the Romanian Civil Code), for possible claims |
| Invoices and accounting records | As required by Romanian Accounting Law no. 82/1991 and tax legislation (currently 5 to 10 years) |
| Web server logs (IP address etc.) | 30 days |
| Abuse-protection counters (IP address) | 1 hour, in memory only |
| Session entry in your browser (device ID, device type, refresh token) | Until you delete your data in the chat window or clear your browser's site data |
We delete data earlier if you ask us to, unless we are legally required to keep it.
How deletion works. When your data is erased, by you in the chat window, on request, or at the end of the retention period, we delete your account, messages and sessions together with your personal encryption key. Without that key, any copy of your encrypted data that might still exist (for example in a backup) can never be decrypted again, by anyone, including us. Should a backup ever have to be invalidated, deleting the key is what invalidates it. We also delete the related e-mails from our mailbox. A copy of a message that we e-mailed to you stays in your own mailbox, which we do not control.
6. Your rights
Under GDPR arts. 15 to 21 you have the right to:
- access your data and get a copy of it;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict how we use it;
- receive it in a portable format (data portability);
- object to processing based on our legitimate interests;
- withdraw any consent you have given, at any time, without affecting processing done before.
Do it yourself. Open the chat window and choose the account icon: "Download a copy of my data" gives you everything we hold for your account as a file, and "Delete my conversation and data" (or "Delete my account and conversation") erases it immediately and permanently, including the encryption key. This works for guest accounts too.
To exercise any other right, or if you cannot use the chat, contact us through contact@eliptum.tech, by phone at +40 750 295 552 or by post at our registered office. It is free of charge. We reply within one month (extendable by two months for complex requests, in which case we will tell you why). We may ask you to confirm your identity, for example by replying from the e-mail address you used to contact us.
You also have the right to lodge a complaint with the Romanian data protection authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania, www.dataprotection.ro, or with the data protection authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first, so please contact us.
7. Children
Our services are for businesses. The site is not aimed at children, and we do not knowingly collect data from anyone under 16.
8. Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows the latest version. If a change significantly affects how we use data you have already given us, we will tell you directly.