Privacy

Google Analytics — optional measurement

Google Analytics 4 is configured for public pages. The Google script loads only after analytics consent, on the configured public domain. You can refuse or withdraw your choice in ‘Cookie preferences’.

When enabled and permitted, measurement uses the page address without query parameters or fragments, its title and technical visit/device information. We measure configurator starts and completions, successfully saved enquiries and clicks on email or phone links. For known search engines we keep only the domain origin, without the referring page or search terms. We do not send names, email addresses, companies, descriptions, budgets or enquiry references as events, nor the email or phone destination. The legal ground is consent under Article 6(1)(a) GDPR. Refusal does not restrict website use.

Google provides the integration under the Google Analytics terms and the data processing agreement applicable to this account. User-level and event-level retention is set to two months, without resetting it on a new visit; this limit does not apply to standard aggregated reports. Google Signals, advertising personalisation, automatic enhanced measurement and granular location/device collection are disabled. Withdrawal stops future measurement and removes this integration’s analytics cookies; it does not recall information already transmitted.

Separately from information sent to Google, after analytics consent we retain only a source category and an allowlisted search engine in sessionStorage (aureniq.acquisition.v1) for up to 30 minutes. These categories may accompany a submitted enquiry in the CRM to evaluate qualified enquiries. We do not retain search terms, the referring URL, a Google identifier or a link to a person in Analytics. Without consent the source remains unknown. Withdrawal removes the browser record and stops future collection; an enquiry already submitted is covered by the retention and rights procedures explained here.

Google may process information through its international infrastructure, including outside the EEA and in the United States, under its data processing terms and applicable transfer mechanisms. Hosting the application in Romania does not mean that Google measurement is processed exclusively in Romania or the EU. You can avoid this processing by refusing analytics.

1. Who is responsible for your data

The controller for the AURENIQ website is HITEXBAU ROMANIA S.R.L., RO46984605, J2022001708208, EUID ROONRC.J2022001708208, Aleea Castanilor nr. 6, Deva, județul Hunedoara, 330041, România. AURENIQ is the brand presenting our software, AI and digital development services.

You can contact us at contact@aureniq.ro or write to the registered office. The mailbox has been verified for incoming and outgoing email.

This notice covers visitors, people requesting information or proposals, client representatives and authorised administration users. Processing within a product developed for a client is addressed separately according to the project’s roles and agreement.

2. Information we use and its sources

You provide the information entered into our forms. When acting for a company, use professional contact details and share only information you are entitled to disclose. Do not include passwords, identity document copies, complete bank details or sensitive data in the project description.

• Enquiries: name, email, optional company, project description, selected service, features, integrations, budget range, timing, package of interest and form language.
• Relationship management: enquiry reference and date, acknowledged notice version, correspondence, relevant notes, discussion stage, assigned team member and proposal versions.
• Administration: authorised account details, role, a hashed password, session identifiers and a record of relevant actions.
• Operation and security: errors, timestamps and abuse-prevention counters. Technical logs may include the IP address and information about a request that caused an error. Form bodies are not recorded in access logs.

3. Preparing and submitting your enquiry

Contact, service and quotation pages use the same configurator. Your choices and contact details remain in page memory until submission; they are not saved in persistent browser storage. Moving between steps does not create a CRM record.

When you select ‘Submit request’, your details are recorded on the server with a reference for assessment and follow-up. Associated notifications are prepared in the application queue; recording an enquiry does not mean that an email has already been delivered.

Required fields are needed to understand your request and reply. Company information is optional. You can continue browsing without completing a form if you do not wish to submit your details.

4. Purposes and legal grounds

We use an appropriate legal ground for each purpose. The configurator checkbox acknowledges the notice; it is not a newsletter subscription and does not determine the legal ground for every processing activity.

• Assessing a request from a person who may become a contracting party and preparing a proposal: pre-contractual steps at that person’s request, Article 6(1)(b) GDPR.
• Communicating with company representatives, organising enquiries and following up proposals: legitimate interests under Article 6(1)(f) in managing professional relationships and responding to requests, while respecting individuals’ rights.
• Managing access, preventing abuse, investigating incidents and defending rights: legitimate interests under Article 6(1)(f) in protecting systems and commercial relationships.
• Performing a contract with an individual: Article 6(1)(b). Complying with applicable legal obligations, including accounting records and lawful authority requests: Article 6(1)(c).
• Email marketing is not active in this version. Any future communication relying on consent will provide a separate choice and a way to withdraw consent.

5. Who may receive information

Internal enquiry access is limited to authorised personnel according to administration and sales responsibilities. Necessary hosting, email, backup and technical support providers, professional advisers and authorities may receive information where there is an appropriate legal reason and only to the extent needed.

The application and database are hosted on a ROMARG VPS in Brașov, Romania. Email is hosted in a separate ROMARG cPanel account, with secure SMTP delivery and forwarding to the operator's professional mailbox. Cloudflare provides DNS in DNS-only mode and does not proxy page traffic. Backups are encrypted on the VPS and copied to the operator's local NAS independently of the computer; an additional copy is downloaded to the computer when connected. The decryption key is held separately. Google Analytics is a separate optional service.

We do not sell enquiry data. Following an external link takes you to a separate operator with its own notice. Displaying a portfolio project does not automatically transfer your data to that project.

6. International transfers and AI

Enquiries are not sent to an external AI provider. The website does not make solely automated decisions producing legal or similarly significant effects. A configurator estimate is not project acceptance or a contractual decision.

If future infrastructure or an integration involves access from outside the European Economic Area, we will document the destination and applicable transfer mechanism, such as an adequacy decision or standard contractual clauses, before use. We do not assume a global provider keeps all data exclusively in the EU.

7. How long information is kept

For enquiries that do not become projects, the agreed period is 12 months from the last relevant interaction. At expiry we review whether retention remains necessary and delete or redact information with no justified continuing purpose. This period does not authorise marketing messages.

For contracted projects, retention depends on the relationship’s duration, the legal requirements for the relevant records and the need to establish, exercise or defend a right. A dispute or legal obligation may justify keeping specific restricted records longer; this does not automatically justify retaining the entire brief.

An administration session expires after a maximum of 8 hours. VPS technical logs have rotation configured for 30 days. Administration audit records are reviewed at least annually, removing data no longer needed and retaining justified records relevant to incidents or legal rights. Providers manage their own logs under their applicable terms.

A daily report identifies enquiries due for review; the administrator checks each case and removes personal fields or records a justified hold. The same 12-month review rule applies to correspondence that does not become a project, including copies in the forwarded professional mailbox. Necessary references and metadata may remain and are assessed separately. Daily encrypted backups are kept for 30 days; the current recovery copy is always preserved. NAS cleanup follows mirroring of the VPS copies, while the computer copy is cleaned on its next connection. Removed data may remain in these copies until expiry; restoration includes checking and reapplying removals.

8. Your rights and how to exercise them

Subject to GDPR conditions, you can request access, rectification, erasure, restriction or portability and object to processing based on legitimate interests. Where consent is the legal ground, you may withdraw it without affecting earlier lawful processing. Rights depend on the circumstances and legal ground; a legal obligation or defence of a right may limit erasure.

You can use the controller’s contact channels without a mandatory form or a requirement to justify an access request. Where there are reasonable doubts about identity, we may ask only for the additional information needed to verify it, rather than routinely requesting an identity document copy.

We respond without undue delay and no later than one month after receiving the request. Where complexity or the number of requests justifies it, this may be extended by up to two further months; we explain the extension and reasons within the first month. Requests are handled free of charge, subject to GDPR exceptions. If we do not act on a request, we explain why and inform you about the right to complain and seek a judicial remedy.

You may complain to Romania’s ANSPDCP or the competent authority where you live, work or believe an infringement occurred. You do not have to contact us first to exercise that right.

9. Protection, limitations and updates

The application uses HTTPS, role-based access, hashed passwords, limited sessions, validation and encrypted backups. No technical measure can guarantee that every risk is eliminated.

Our services are not directed at children and forms do not request minors’ information. Contact the controller if such information is submitted by mistake. When purposes or providers change, we update this notice and provide the necessary information before the new processing begins.