Privacy notice

1. Who is responsible for your data

2. Information we handle

Form. We process your full name, organisation, work email address, team size and requested service. A telephone number and free-text message are optional. When you submit the form, the information is sent over HTTPS to Netlify Forms. Netlify handles form intake, spam filtering and availability in the project dashboard; HAVOC IT may also receive a notification at office@havoc-it.ro, a mailbox operated in Microsoft 365. We use the information only to answer and manage the B2B enquiry. Do not send passwords or confidential information through the form.

Enquiry source. When present in the page address, the form attaches only utm_source, utm_medium, utm_campaign, utm_content and utm_term, together with the language and page path. We do not attach the complete query, URL fragment, full referring address or browser-storage identifiers.

Email and telephone. For a direct email, we process the sender's address, the message content and the technical data needed for delivery through Microsoft 365. If you call us, we process the telephone number and may create minimal notes when needed for the enquiry. We do not record calls.

WhatsApp. We process the number, visible profile information and content you send only after you start the WhatsApp channel and send us a message. HAVOC IT does not create conversation exports. The account type, backups, provider retention and connected systems remain under internal verification.

Hosting and security. Netlify hosts the site, and technical access and security logs may include the IP address, request date and time, requested path, user-agent information and security events.

Aggregate statistics. Netlify Web Analytics is the only approved service for aggregate website traffic statistics. When enabled for the project, it derives those statistics from Netlify CDN logs, without a browser analytics script and without an analytics cookie. Real User Monitoring and advertising trackers are outside the approved configuration for this release. Any future activation requires configuration verification and an update to this notice before use.

3. Why we use it

Article 6(1)(b) of the EU GDPR applies only when a professional asks us to take steps for their own potential contract. We then use the information to reply, prepare a quotation and take the requested pre-contract steps.

Article 6(1)(f) of the EU GDPR applies when we communicate with company representatives. Our legitimate interest is to receive, assess and manage the B2B enquiry and conduct limited follow-up on the discussion started by the representative.

Article 6(1)(f) also applies to bounded UTM values used to identify the enquiry source and for aggregate campaign-level reporting. Article 6(1)(f) applies to technical logs used for website and service security. Our legitimate interests include operating our B2B sales/service process, better allocation of content and campaigns, and service security and operation.

If the enquiry leads to a contract, we may retain documents needed to meet legal obligations under Article 6(1)(c) and to establish, exercise or defend legal claims under Article 6(1)(f). Article 21 provides a right to object to processing based on legitimate interests.

We do not sell the information, we do not automatically enrol enquiries in marketing lists, and an enquiry is not consent to direct marketing.

4. Details needed for a useful response

Your name, organisation, email address, team size and requested service allow us to assess the enquiry and respond meaningfully. Without them, we may be unable to help. The telephone and message fields remain optional.

5. Recipients and technical providers

Enquiries may be accessed only by HAVOC IT personnel who need them to respond, quote, deliver, administer or handle a privacy request.

Netlify Forms is the target form flow: it handles intake, spam filtering and availability in the project dashboard. Any notification at office@havoc-it.ro is operated in Microsoft 365. Project enablement, submission storage, effective retention, notification recipient and anti-spam configuration remain under operational verification.

Microsoft 365 is the confirmed service for email sent directly to office@havoc-it.ro. The contracting entity, agreement chain, tenant data location and retention remain under internal verification.

Netlify hosts the site and may process technical access and security logs needed to deliver, operate and protect it; the provider entity is Netlify, Inc. The contracting entity, applicability of the public data processing agreement, actual transfer path and log retention for the HAVOC IT account remain under internal verification.

When you choose the WhatsApp channel and send a message, WhatsApp Ireland Limited processes use of the service under its own EEA notice, which describes international transfers connected with the service. We do not present WhatsApp as acting solely as HAVOC IT's processor. Telephone providers involved in calls process their own technical data under their applicable roles and terms; HAVOC IT's provider identity and settings remain under internal verification.

6. International transfers and safeguards

Use of these providers may involve international processing and transfers. Information is not necessarily confined to the European Union.

According to Netlify's public DPA, the mechanisms described for restricted transfers include the Data Privacy Framework and, when that framework is unavailable, Standard Contractual Clauses.

According to Microsoft's public documentation, Standard Contractual Clauses are available under its DPA for in-scope cloud services. WhatsApp's notice for the European Economic Area describes international processing and transfers connected with the service.

The contractual applicability of these mechanisms and the HAVOC account configurations remain under internal verification; you may ask for information about the applicable safeguards at office@havoc-it.ro.

7. How long we keep information

Non-converted enquiry: we keep the form, email, WhatsApp conversation or telephone note for 12 months after the last meaningful contact between both sides.

Converted contract evidence: we keep only the evidence needed until contract end or final performance, as applicable, plus 3 years. This is a HAVOC IT claims-risk rule, not a universal statutory period.

Accounting evidence: material that actually supports a financial-accounting entry is kept for 5 years calculated from 1 July of the year following the financial year in which it was created. This exception does not justify retaining an entire mailbox or conversation.

Microsoft 365 and WhatsApp: copies controlled by HAVOC IT follow the applicable enquiry, contract or accounting category above; telephone notes follow the same rule. Routine calls do not create a note by default.

HAVOC-controlled logs and UTM values: ordinary troubleshooting exports are kept for 30 days, and documented security-incident evidence is kept for 90 days after the investigation ends. Raw UTM values are kept for no more than 30 days, then we delete or aggregate them irreversibly after submission or enquiry closure.

Privacy-request accountability record: we keep the minimal record for 3 years after the final response or closure, and identity copies and excess content are deleted, normally within 30 days after closure.

Account configuration for Netlify Forms retention, applicable contractual terms, transfers, the complete subprocessor list and notifications is checked operationally and is not stated as a fixed value without dated account evidence. Provider residual retention and backups follow the provider's configured or documented criteria, and the effective period remains an open verification for Netlify, Microsoft 365, WhatsApp and the telephone provider; we do not publish an unverified provider-specific period.

8. Your rights

Subject to the conditions in the EU GDPR, you may request access, correction, erasure, restriction of processing and portability where applicable. You may object to processing based on legitimate interests, including UTM attribution associated with the enquiry.

Send your request to office@havoc-it.ro. We respond without undue delay and ordinarily within one month after receipt; where the EU GDPR permits it because of complexity or the number of requests, a lawful extension of up to two further months may apply, and we will tell you about the extension and the reasons before the first month ends.

You may lodge a complaint with the Romanian data protection authority (ANSPDCP).

9. Automated decisions

For the processing described here, there is no solely automated decision-making or profiling that produces legal or similarly significant effects.

10. Changes to this notice

The current review date appears at the top of this page. Any material change in processing requires this notice to be updated before that change is activated.