Privacy policy
This is a translation of the Romanian original, provided for convenience. It has not been reviewed by a legal translator.
1. Who processes your data
The data controller is Cătălin Hotca, which operates themarketlab.cloud.
For any question about your data: office@themarketlab.cloud.
We are not legally required to appoint a Data Protection Officer and we have not appointed one. Requests are handled at the address above.
We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.
2. What we collect, why, and on what basis
2.1. Visiting the site
To know how many people read us and which pages work, we record for each page view: the page visited, the referring page, the device and browser type, the country and the time of the visit.
Your IP address is used once, at the moment of the visit, solely to generate a visitor code on our server through an irreversible transformation (SHA-256 hash) with a key that changes daily, after which it is discarded. We do not store your IP address, neither in raw form nor separately. Because that key changes every day, the same visitor produces a different code the next day — we cannot track you across days. The country is provided by the Cloudflare network, through which the site's traffic passes. We use no analytics cookies and write nothing to your device for this purpose.
Basis: our legitimate interest in measuring the site's audience in a form that does not identify you (Art. 6(1)(f) GDPR).
2.2. Subscribing to the email list
If you subscribe, we collect your email address, the time of subscription and the language of the page you subscribed from, in order to send you educational material and news about our products.
Basis: your consent (Art. 6(1)(a) GDPR and Art. 12 of Romanian Law 506/2004). You may withdraw it at any time, through the unsubscribe link in every email or by writing to office@themarketlab.cloud. Withdrawal does not affect the lawfulness of processing before it.
2.3. Buying the ebook
Payment and delivery are handled by Lemon Squeezy, operated by Sold through Link, LLC (Statele Unite), acting as Merchant of Record — that is, it is the registered seller to you and it processes the payment.
Your card details never reach us and never pass through our servers. From the platform we receive: name, email address, country, the product purchased, the amount and the order number.
Basis: performance of the contract (Art. 6(1)(b) GDPR) for delivery and support, and legal obligation (Art. 6(1)(c) GDPR) for accounting and tax records.
For its own payment operations, Lemon Squeezy is an independent controller, with its own privacy policy, which you can read on the platform's site.
2.4. Writing to us
If you write to us, we keep the message and the email address so that we can reply and so that we have a record of the exchange.
Basis: our legitimate interest in answering the requests we receive (Art. 6(1)(f) GDPR) or, where the message concerns an order, performance of the contract.
2.5. What we do not do
We do not sell your data. We do not rent it. We do not hand it to data brokers. We make no automated decisions with legal effects on you and we do no profiling. We do not knowingly process special categories of data (health, political or religious beliefs and so on) — please do not send them to us.
3. How long we keep data
| Category | Retention |
|---|---|
| Traffic statistics (no identification) | 90 days for individual events, aggregated data afterwards |
| Email address for the newsletter | Until you unsubscribe, plus 3 years for the proof of consent |
| Order data | 10 years, the archiving term for supporting documents (Romanian Law 82/1991) |
| Correspondence | 3 years from the last message |
4. Who else has access to your data
We work with the following providers, each only for what it needs:
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, DNS, the site's database (Cloudflare D1), abuse protection | USA / global network |
| Sold through Link, LLC (Lemon Squeezy) | Sale and delivery of digital products, payments | Statele Unite |
| Purelymail LLC | Hosting of the contact mailbox | USA |
We may also disclose data to authorities where the law requires it, and to an accountant or a lawyer should the need arise, under an obligation of confidentiality.
5. Transfers outside the European Economic Area
The providers above are in the United States. Transfers are made on the basis of:
- the European Commission's adequacy decision on the EU–U.S. Data Privacy Framework, for providers certified under it; and/or
- the Standard Contractual Clauses adopted by Decision (EU) 2021/914, together with additional technical measures where the provider is not certified.
You can ask at office@themarketlab.cloud which mechanism applies to each provider.
6. Your rights
You have the right: of access to your data; to rectification of inaccurate data; to erasure; to restriction of processing; to object to processing based on legitimate interest; to data portability; to withdraw consent at any time, where consent is the basis.
Write to us at office@themarketlab.cloud. We reply within 30 days. If the request is complex, we will tell you and may extend by two months. We charge no fee, except for manifestly repetitive requests.
If we refuse your request, we tell you why and remind you that you may lodge a complaint.
Supervisory authority:
The National Supervisory Authority for Personal Data Processing (ANSPDCP), Romania
B-dul G-ral. Gheorghe Magheru nr. 28–30, Sector 1, 010336 Bucharest
anspdcp@dataprotection.ro · www.dataprotection.ro
You also have the right to go to court.
7. Cookies
The site uses no analytics, advertising or tracking cookies and stores no information on your device for those purposes. That is why you will not see a cookie banner.
If we ever introduce a tool that requires cookies, we will ask for your consent before it activates, through a banner where refusing is as easy as accepting, and we will update this policy.
If you choose another site language, we keep that preference in your browser's memory, strictly so that you do not have to select it again on every page. It is not used for analytics or tracking and it requires no consent, being strictly necessary for the function you explicitly asked for.
The site's administration area, accessible only to us, uses strictly necessary cookies for authentication. They do not concern you as a visitor.
8. Security
The site runs exclusively over HTTPS. Access to the administration panel is restricted through Cloudflare Access, with authentication separate from the site and cryptographic verification of every request. The number of people with access to data is minimal. We do not store card data.
If a security breach occurs with a high risk to you, we notify you without undue delay and notify the ANSPDCP within 72 hours, in accordance with Art. 33–34 GDPR.
9. Minors
Our services are not addressed to persons under 18. We do not knowingly collect data from children. In Romania, the age at which a person's own consent is valid for online services is 16 (Art. 2 of Law 190/2018). If you learn that a minor has given us data, write to us and we will delete it.
10. Changes to this policy
We may update this policy. The version in force is always the one on this page, with the date and version number shown at the top. For significant changes — a new provider receiving your data, a new processing purpose, a change of legal basis — we notify subscribers by email at least 15 days before they take effect.
11. Contact
Cătălin Hotca · office@themarketlab.cloud · 0743 621 760