GDPR rights.

The GDPR gives you a set of rights over your personal data. This page explains each one in plain terms and tells you exactly how to use it with us. For what we collect and why, read the privacy policy — the two are meant to be read together.

1. Access — Article 15

You can ask whether we hold data about you and get a copy, along with why we have it, who has seen it and how long we intend to keep it. In practice this usually means the contact form submissions you have sent us and any email correspondence that followed.

2. Rectification — Article 16

If something we hold is wrong or incomplete, tell us and we will correct it. This one needs no justification and no waiting.

3. Erasure — Article 17

You can ask us to delete your data. We will, unless we are legally required to keep it — the main case being invoices and accounting records, which Romanian tax law obliges us to retain for ten years. If we cannot delete something, we will tell you which record and which obligation.

4. Restriction — Article 18

You can ask us to keep your data but stop using it, for example while a dispute about its accuracy is being resolved.

5. Portability — Article 20

Where we process data by consent or under a contract, and by automated means, you can ask for it in a structured, machine-readable format, or ask us to send it directly to another provider where that is technically feasible.

6. Objection — Article 21

Where we rely on legitimate interest, you can object and we will stop unless we can show compelling grounds that override your interests. If we ever process your data for direct marketing, an objection is absolute: we stop, no balancing test.

7. Withdrawing consent — Article 7(3)

Where processing rests on consent, you can withdraw it at any time, and it is as easy to withdraw as it was to give. Use Cookie preferences in the footer for the consent bar, or email us. Withdrawal does not undo processing that was lawful before you withdrew.

8. Automated decisions — Article 22

We do not make decisions about you by automated means alone, and we do not profile you. A human reads every enquiry.

9. Complaint — Article 77

If you think we have handled your data badly, please tell us first — most problems are faster to fix directly. You are entitled to go straight to the supervisory authority regardless.

ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest
dataprotection.ro

If you live in another EU or EEA country, you may complain to your own national supervisory authority instead.

If you are in the Republic of Moldova, Law no. 195/2024 applies to us alongside the GDPR and you may go to the Moldovan authority instead:

CNPDCP — Centrul Național pentru Protecția Datelor cu Caracter Personal
str. Serghei Lazo 48, MD-2004 Chișinău, Republica Moldova
datepersonale.md

10. How to make a request

Email contact@smartix.digital with the right you are exercising and enough detail for us to find your records — the email address you used to contact us is usually sufficient.

• We respond within one month. If a request is complex we may extend by a further two months, and we will tell you within the first month if that happens.
• There is no charge. We may charge a reasonable fee, or decline, only for requests that are manifestly unfounded or repetitive.
• If we cannot confirm who you are from the request itself, we may ask for enough information to be sure — we are not going to hand your data to someone else.

11. Data Protection Officer

We are not required to appoint a DPO under either Article 37 GDPR or Article 37 of Moldovan Law no. 195/2024: we are a small studio, we do not carry out large-scale monitoring, and we do not process special-category data at scale. Data protection questions go to contact@smartix.digital and are handled by the founders directly.

We are also not required to designate a representative in the Republic of Moldova. Article 27(2)(c) of Law no. 195/2024 exempts controllers and processors established in an EEA member state, and we are established in Romania.

12. Breach notification

If a personal data breach occurs that is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours of becoming aware of it — ANSPDCP, and CNPDCP where the affected people are in the Republic of Moldova — and we notify you directly where the risk is high.

Contact

ECOSOL PRO S.R.L. — trading as Smartix Digital
Trade Register J2019003396232 · VAT RO39292598
Str. 1 Decembrie 1918 nr. 122, sat Roșu, com. Chiajna, jud. Ilfov, Romania
Email: contact@smartix.digital
Phone: +40 749 274 274