Privacy policy

Who processes the data

The data controller is HEXALAB SRL, VAT no. (CUI) RO23461259, Trade Register no. J2008000368304, with its registered office at Str. Avram Iancu nr. 39, Satu Mare, Romania. Our office, where we meet clients, is at Piața Libertății nr. 22, corp B, et. 1, Satu Mare, Romania.

You can contact us about your data at [email protected] or on +40 361 403 999.

What data we collect

Through the contact form we collect only the data you send us: name, organization, e-mail address, phone number, subject and the content of your message.

Why we use it and on what legal basis

• To prepare an offer or a project at your request – steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• To answer any other question, including when you write to us on behalf of an organization – our legitimate interest in answering the people and organizations that contact us (Article 6(1)(f) GDPR).

That is why the contact form asks for no consent: sending the message is enough for us to answer it. We do not use these data for newsletters or advertising.

Applications and recruitment

Through the form on the Careers page we collect your name, e-mail address, phone number, city, the role you are applying for, your level of experience, links to professional profiles, the CV you upload and the message you send.

• To evaluate your application for the role you chose, on the basis of your consent, given by ticking the required box (Article 6(1)(a) GDPR). We keep the application for the duration of the recruitment process and at most 6 months from receipt.
• To contact you about other suitable roles, only if you also tick the separate, optional box. In that case we keep the application for 12 months from receipt.

You may withdraw either consent at any time by writing to the e-mail address below; we then delete the application and the CV.

Free consultation (Google Workspace and Microsoft 365)

Through the form on the Google Workspace and Microsoft 365 pages we collect the service and what you are interested in, your name, company, e-mail address, phone number, number of users, subscription renewal date, preferred language, how you heard about us and your message. We use them to call you back and prepare an offer, at your request (Article 6(1)(b) GDPR).

Together with the request we also receive the source of your visit: the campaign parameters in the link (utm_*), the click identifier added by Google or Facebook ads (gclid / fbclid), the site you came from and the first page you opened. We use them only to know which campaigns bring requests – our legitimate interest (Article 6(1)(f) GDPR). The source is remembered while you browse the site only if you accepted the “Analytics” category; otherwise we receive only the parameters of the page with the form.

How long we keep it

• contact messages and consultation requests – 2 years from receipt, for any follow-up and for a possible contractual relationship;
• applications and CVs – 6 months from receipt, or 12 months if you agreed to be contacted about other roles.

At the end of these periods the data are deleted automatically from our server. The same periods apply to the copies we receive by e-mail. Data needed for a contract that was concluded, or that the law obliges us to keep, are kept for the period set by the law.

Who we share it with

We do not sell or rent your data. They can be accessed only by our processors, under a contract and only for the service they provide us: the providers of our hosting and e-mail services, and Google, for the anti-spam protection of the forms and, if you accept it, for traffic measurement.

Transfers outside the European Economic Area

The only provider through which data may reach outside the European Economic Area is Google (Google LLC, United States). Such transfers are made on the basis of the European Commission’s adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework, under which Google LLC is certified (list of certified organizations), and, in addition, the standard contractual clauses included in Google’s data processing terms (Google Cloud Data Processing Addendum). You can ask us for a copy of these safeguards at [email protected].

Anti-spam protection (Google reCAPTCHA)

The contact and job application forms are protected by Google reCAPTCHA v3, which tells human visitors apart from automated submissions. The Google script is loaded only when you start filling in a form. When you submit the form, Google receives your IP address, information about your browser and device and about how you interacted with the page, and returns a score that we use only to decide whether to accept the message.

For this processing we are the controller and Google acts as our processor, under the Google Cloud terms and the Google Cloud Data Processing Addendum. The legal basis is our legitimate interest in protecting the forms against abuse and spam (Article 6(1)(f) GDPR). The _GRECAPTCHA cookie is strictly necessary for the security of the form you are sending, so it does not require consent.

If you would rather not use reCAPTCHA, you can always write to us at [email protected] or call us instead.

Google Analytics

We use Google Analytics 4 for aggregated statistics about how the site is used – which pages are visited and how people reach us – so that we can improve it.

The Google script is not loaded at all until you accept the “Analytics” category: before that, no request whatsoever is sent to Google and nothing is stored on your device. We use no advertising or remarketing tags.

What Google Analytics receives

Where Analytics does run, Google receives your IP address, information about your browser and device and about the pages you visit, and sets the cookies listed below. Google Analytics 4 does not log or store IP addresses; the detailed, event-level data are kept for at most 14 months, and we see the statistics only in aggregate form.

The legal basis is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time from “Cookie settings” at the bottom of any page. You can also read Google’s privacy policy or install the Google Analytics opt-out add-on.

Cookies and your choice

A cookie is a small file stored by your browser. On this site we use two categories:

• strictly necessary – they keep the site working: the anti-spam protection of the forms and the record of your cookie choice. They need no consent and cannot be turned off;
• analytics – optional, set only if you accept them.

Your choice is never sent to our server. You can change or withdraw it at any time from “Cookie settings” at the bottom of any page; withdrawing it stops Analytics from the next page on, and you can delete the cookies already stored from your browser’s settings. Refusing analytics does not restrict your access to any part of the site. If we ever add a new purpose, we will ask for your consent again.

Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw your consent at any time. To exercise them, write to us at [email protected]. You may also lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (www.dataprotection.ro).

Changes to this policy

• 30 September 2026 – company identification details and registered office; separate legal bases for the contact form, the consultation form and applications; campaign source of consultation requests; optional consent for future roles and new retention periods for applications (6 / 12 months); Google as processor for reCAPTCHA; transfers outside the EEA; list of cookies; the “Marketing” category was removed.
• 14 September 2026 – previous version.