What we do with your data. Short version, we protect it.
We do not sell data, we do not share it with third parties for marketing, and we do not use it for anything other than what is listed here. Your data stays yours.
Last updated: June 2026
Data controller
The data controller, within the meaning of Regulation (EU) 2016/679 (GDPR), is STEFAN SERBAN INVESTITII IMOBILIARE SRL, tax ID (CUI) RO49663952, registered office in Pitesti, Arges County, Romania, registered with the Trade Registry Office at the Arges Tribunal.
Commercial brand: High-Up LABS Automatizare. Site: automatizare.highuplabs.ro.
Data Protection Officer: Serban Stefanita Madalin.
Contact for any request regarding personal data: business@highuplabs.ro.
Legal framework
This policy is drafted in accordance with:
- Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR)
- Romanian Law no. 190/2018 on measures implementing Regulation (EU) 2016/679
- Romanian Law no. 506/2004 on personal data processing and privacy in electronic communications
- Romanian Law no. 365/2002 on electronic commerce
What data we collect
We collect only the data needed to reply to you, generate your offer, and run the website. We do not process special categories of data (sensitive data) and we do not ask you for any.
3.1 Data you provide directly
When you submit an offer request through the form on the site or contact us, we process:
- Full name
- Email address
- Phone number (optional)
- Company name and field of activity (optional)
- The areas of interest selected and the process you want to automate
- The message and details you send us via the form or WhatsApp
3.2 Data from the offer generator
The offer generator uses an AI model to turn what you describe into an indicative estimate. We process only the text you enter and your contact details, so we can send and discuss the offer with you. Do not enter other people's personal data, passwords, or sensitive information into the generator. Details about the providers involved are in the Data recipients section.
3.3 Data collected automatically
- IP address (anonymized for statistical analysis)
- Browser and device type
- Pages visited and visit duration
- Traffic source (referrer)
- Cookie data (details in the Cookie Policy)
Purpose and legal basis
We process your data only for specified purposes, each with a clear legal basis, under Art. 6 GDPR:
| Purpose | Legal basis (GDPR) |
|---|---|
| Recording your contact request and starting the conversation | Art. 6(1)(a). Consent, expressed by submitting the form |
| Generating the offer and replying to your request | Art. 6(1)(f). Legitimate interest, replying to a request you addressed to us |
| Pre-contractual steps at your request and delivering the contracted services | Art. 6(1)(b). Contract performance or steps prior to entering into it |
| Website analysis and improvement | Art. 6(1)(a). Consent, expressed through the cookie banner |
| Invoicing, accounting, and archiving | Art. 6(1)(c). Legal obligation |
| Response to requests from authorities | Art. 6(1)(c). Legal obligation |
Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
Data recipients and processors
We do not sell or share your personal data with third parties for marketing purposes. Data may be accessed only by the processors below, each under a data processing agreement concluded per Art. 28 GDPR:
- Supabase Inc. (processor): database hosting, servers in the European Union (Ireland)
- Vercel Inc. (processor): site hosting
- Resend Inc. (processor): transactional email delivery
- The provider of the AI model behind the offer generator (processor): processes the text you enter only to generate the estimate, without using it to train other models
- Public authorities: only upon legal request, per applicable legislation
Transfers outside the European Union
Data is stored primarily on servers within the European Union. Certain data may be transferred outside the EU through our processors (for example Vercel, Resend, or the AI model provider). These transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission or, where applicable, by the EU-U.S. Data Privacy Framework, per Art. 44 and following of GDPR. Upon request, we can provide information about the safeguards applied.
Data retention periods
We keep data only as long as necessary for the purpose for which it was collected or as required by law:
| Data category | Retention period |
|---|---|
| Requests from the offer generator and contact form | 1 year from last contact, unless they become a contract |
| Contractual data (name, company, tax ID) | Contract duration plus 3 years |
| Invoices and financial data | 10 years (per Romanian Accounting Law no. 82/1991) |
| Analytics and cookie data | Per cookie duration (see Cookie Policy) |
| Server logs | 90 days |
After the retention period expires, data is permanently deleted or irreversibly anonymized.
Your rights under GDPR
As a data subject, under Regulation (EU) 2016/679, you have the following rights:
- Right of access (Art. 15): you may request a copy of the data we hold about you
- Right to rectification (Art. 16): you may request correction of inaccurate or incomplete data
- Right to erasure (Art. 17): you may request deletion of your data, except data required by legal obligations
- Right to restriction (Art. 18): you may request limitation of processing in certain situations
- Right to data portability (Art. 20): you may receive your data in a structured, commonly used, machine-readable format
- Right to object (Art. 21): you may object to processing based on legitimate interest
- Right to withdraw consent (Art. 7): you may withdraw consent at any time, without affecting the lawfulness of prior processing
- Right not to be subject to automated decisions (Art. 22): the AI-generated offer is indicative, has no legal effect, and the final decision is taken by you together with a human from our team
To exercise any right, write to business@highuplabs.ro. We acknowledge receipt without undue delay and respond fully within 30 calendar days, a period that may be extended by a further two months for complex requests, per Art. 12(3) GDPR.
Data security
We implement appropriate technical and organizational measures to protect data, per Art. 32 GDPR:
- HTTPS/TLS encryption for all data transmissions
- Role-based restricted access
- Storage on infrastructure with automatic backups
- Data minimization: we ask only for what is needed to reply and deliver the service
Cookies
We use strictly necessary cookies for site functionality and, only with your consent, analytics cookies. Full details about types, purpose, duration, and control are in the Cookie Policy.
Minors
Our services are intended for legal entities and authorized individuals. We do not knowingly collect personal data from individuals under 16 years of age. If you discover that a minor has provided us with data, write to business@highuplabs.ro for immediate deletion.
Policy changes
STEFAN SERBAN INVESTITII IMOBILIARE SRL reserves the right to update this policy. Changes are published on this page, with the update date. For substantial changes, we notify users by email or through an on-site notification.
Contact and complaints
To exercise your rights or for any question regarding your data, you can write to us at business@highuplabs.ro. We encourage you to contact us first, so we can resolve the issue directly and quickly.
If you believe your data is being processed incorrectly or your rights have not been respected, you have the right to file a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):
- Website: www.dataprotection.ro
- Email: anspdcp@dataprotection.ro
- Address: B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, Romania