Privacy policy
1. Who we are
euaiactaudit.com (euaiactaudit.com) is run by Human Synthesis SRL, Sat Buciumeni, Comuna Buciumeni, Nr. 279, Județul Dâmbovița, 137065, Romania, registered with the Romanian Trade Register under J15/860/12.06.2024, VAT RO50224420 ("we", "us"). We decide why and how your personal data is used: we are the controller.
Contact for anything about your data: privacy@euaiactaudit.com.
2. What data we use, why, and on what legal basis
| What we use it for | Data | Legal basis | Who receives it | Transfer safeguard | How long we keep it |
|---|---|---|---|---|---|
| Answering messages you send us through the contact form (business, press, an error on a page). We do not answer individual legal questions. | name, email, subject, message, optional page and source link, time sent | our legitimate interest in answering you | Cloudflare (storage; notification sent through our own email service emails.aiosis.com, which runs on Cloudflare); Apple iCloud Mail or Google Gmail for some of our mailboxes that receive forwarded mail; our staff | EU-US Data Privacy Framework, Standard Contractual Clauses | 2 years after the last message; reports of an error are kept as anonymised notes on the page, without your details |
| Security, abuse and bot prevention (Cloudflare Turnstile on every public form, server logs, rate limits) | IP address, device and browser signals, request logs | our legitimate interest in keeping the service safe | Cloudflare | Data Privacy Framework, SCCs | 90 days, longer only for an incident |
| Improving the site without cookies | page counts and errors, aggregated from server logs; no identifiers kept | our legitimate interest in improving our products | Cloudflare | Data Privacy Framework, SCCs | aggregated statistics only; raw logs as above |
| Analytics cookies (Google Analytics), only if we switch them on; not in use today | cookie identifiers, pages visited, device data | your consent (see the cookie policy) | Google, only after your consent | Data Privacy Framework, SCCs | at most 13 months |
| Recording your cookie choice | date, version of the banner, your choices; no IP address | legal obligation to prove consent | Cloudflare | Data Privacy Framework, SCCs | 5 years after your last choice |
| Strictly necessary cookies and local storage (cookie choice, language, closed "under construction" notice, staff sign-in) | small identifiers on your device | no consent needed (strictly necessary) | nobody | none | per item, listed in the cookie policy |
| Following a link to our sister service aiactaudit.ai | no personal data: the link carries only where you came from and your language | not personal data | nobody | none | not kept |
| Administering the site (accounts of our own staff only) | email, password (stored hashed), second-factor secret, admin log | contract and our legitimate interest in running the site | Cloudflare | Data Privacy Framework, SCCs | while the account exists; admin log 1 year |
| Complying with the law and defending legal claims | the data needed for the purpose | legal obligation; our legitimate interest in defending our rights | authorities, courts and advisers when needed | as the law requires | as long as the obligation or the claim requires |
The site has no public accounts, no purchases, no newsletter and no comments.
Where we rely on legitimate interest, we have balanced it against your rights and freedoms; you can ask us for this assessment and you can object at any time (section 6).
Fields marked as required in the contact form are needed to answer you; without them we cannot reply. Optional fields are marked optional.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
3. Where your data comes from
From you (the contact form) and from your device (logs; cookies only with your consent, except strictly necessary ones).
4. Who receives your data
We do not sell your personal data. We share it only with:
- Service providers who process it for us under contract and our instructions: hosting, infrastructure and email delivery (Cloudflare, Inc.); mailboxes to which some of our addresses forward messages (Apple iCloud Mail, Google Gmail); analytics with your consent (Google, not in use today). The current list: https://euaiactaudit.com/en/subprocessors.
- Authorities, courts and advisers when the law requires it or to defend our rights.
- A buyer or successor of all or part of our business, who must keep this policy's protections.
- Partners for their own marketing only with your consent. We have no such partners today.
Our AI provider receives no data about readers (see the AI notice: https://euaiactaudit.com/en/ai-notice).
5. Where data is stored and transfers outside the European Economic Area
Our database and file storage run on Cloudflare in its Eastern Europe region (EEUR); pages and emails are handled through Cloudflare's global network.
Some providers are in other countries. We transfer data only to countries the European Commission (or, for UK users, the UK government) recognises as adequate, including US companies certified under the EU-US Data Privacy Framework, or under the Standard Contractual Clauses approved by the Commission (and the UK addendum). Ask us for a copy of the safeguards.
6. Your rights
You can ask us to: access your data and get a copy; correct it; delete it; restrict its use; receive it in a portable format; and object to uses based on legitimate interest. You can object to direct marketing at any time, with no reason needed. Where we rely on consent you can withdraw it at any time, without affecting earlier use.
How: by email to privacy@euaiactaudit.com. We answer within one month (at most three months for complex requests, and we tell you why). We may ask you to confirm your identity.
You can complain to us first; you also have the right to complain to a data protection authority, in particular in the country where you live or work: Romania ANSPDCP (dataprotection.ro), France CNIL (cnil.fr), Italy Garante (garanteprivacy.it), Spain AEPD (aepd.es), Greece HDPA (dpa.gr), Ireland DPC (dataprotection.ie), United Kingdom ICO (ico.org.uk). Our lead authority is the ANSPDCP in Romania.
7. How long we keep data
- Contact messages: 2 years after the last message, then deleted. Reports of an error on a page are kept as anonymised notes on the page, without your details.
- Security logs: 90 days, longer if needed for an incident.
- Records of your cookie choice: 5 years after your last choice.
- Analytics cookies, if switched on: at most 13 months.
- Staff accounts: while the account exists; admin log 1 year.
8. Security
We protect your data with encryption in transit, access limited to people who need it, two-factor sign-in for staff, backups and regular security reviews. No system is perfect; if a breach puts your rights at risk we will tell the authority and, when the risk is high, you.
9. Children
euaiactaudit.com is not meant for children under 16. We do not knowingly collect their data; if we learn we have, we delete it. Parents can contact us at privacy@euaiactaudit.com.
10. Cookies
We use cookies and similar technologies. Non-essential ones are used only with your consent. Details and your choices: https://euaiactaudit.com/en/cookies; you can change your choice at any time with the "Cookie settings" link at the bottom of every page.
11. Changes to this policy
We may update this policy. We show the date of the last change at the top. Important changes are announced on this site before they take effect.