Privacy policy
Last updated:
We respect the privacy of visitors to leandigital.ro. This policy explains what personal data we process, why, on what legal basis, and your rights under Regulation (EU) 2016/679 (GDPR).
1. Data controller
The data controller for information collected through this site is Florin Butnaru, as the individual behind the LeanDigital brand.
Privacy contact: hello.leandigital@gmail.com. We have not appointed a Data Protection Officer (DPO); use the email address for data-related requests.
2. Who this applies to
This policy applies to visitors of leandigital.ro, people who submit the contact form, and users who accept analytics cookies.
It does not automatically apply to third-party services accessed via external links; see those services’ policies.
3. What data we collect
Depending on how you interact with the site, we may process:
- Contact data (form): name, email address, subject, message, and optional references to an app or collaborator.
- Technical data (server / hosting logs): IP address, browser type, operating system, request date and time — for security and operation.
- Usage data (Google Analytics, consent only): pages viewed, approximate duration, traffic source, device type, approximate location (country/city from IP).
- Cookie preference: whether you accepted or declined analytics, stored locally in the browser (localStorage).
We do not intentionally collect sensitive data (health, ethnic origin, etc.) and we do not sell your data to third parties for marketing.
4. How we obtain data
- Directly from you — when you submit the contact form.
- Automatically — via essential cookies and, after consent, Google Analytics.
- From providers — minimal technical data from hosting infrastructure (e.g. access logs).
5. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Reply to your message | Name, email, subject, message | Art. 6(1)(b) — pre-contractual steps / Art. 6(1)(f) — legitimate interest |
| Site security and operation | IP, technical logs | Art. 6(1)(f) — legitimate interest |
| Visit statistics | Aggregated Analytics data | Art. 6(1)(a) — consent (cookie banner) |
| Legal compliance | Data required for records | Art. 6(1)(c) — legal obligation, if applicable |
You can withdraw analytics consent at any time (decline in the banner, clear cookies, or browser settings). Withdrawal does not affect the lawfulness of prior processing.
7. Who we share data with
We do not sell your data. We may share it only with providers that help us operate the site, under contracts requiring data protection:
- Google LLC (Google Analytics) — visit statistics, consent only. Policy: policies.google.com/privacy
- Hosting / infrastructure provider — site hosting, technical logs, security.
- Authorities — when required by law or to defend our rights in legal proceedings.
8. International transfers
Google and hosting providers may process data outside the European Economic Area (including the US). Transfers rely on GDPR safeguards (e.g. Standard Contractual Clauses, adequacy decisions where available) and provider policies.
9. Retention
- Contact messages: up to 24 months from last communication, or less if you request deletion.
- Technical logs: generally 30–90 days, per hosting provider.
- Google Analytics: per account settings and Google policies (typically up to 14–26 months for user-level data, depending on configuration).
- Consent preference: stored locally until you clear it or it expires.
10. Security
We apply reasonable technical and organizational measures: encrypted connection (HTTPS), limited access to data, providers with recognized security practices. No system is 100% secure; we will inform you if a relevant incident affects your rights.
11. Your rights
Under the GDPR, you have the right to:
- information and access to your data;
- rectification of inaccurate data;
- erasure (“right to be forgotten”), where the law allows;
- restriction of processing;
- data portability in a structured format;
- object to processing based on legitimate interest;
- withdraw consent for analytics without affecting prior processing;
- lodge a complaint with your supervisory authority — in Romania, ANSPDCP: dataprotection.ro
12. How to exercise your rights
Send a request to hello.leandigital@gmail.com with the subject "GDPR request". We may contact you to verify identity before disclosing data. We respond within one month (extendable by two months in complex cases, with notice).
13. Children
The site is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor submitted data, contact us for deletion.
14. Changes to this policy
We may update this policy to reflect legal or service changes (e.g. new analytics tools). The current version is marked by the date above. For material changes, we may show a notice on the site.