Privacy Policy

Who we are

The data controller is GYPAETUSCODE S.R.L., with its registered office at Str. Principală nr. 332W, Sat Șard, Com. Ighiu, Alba county, Romania, registered under trade register no. J01/97/2019, fiscal code (CUI) RO40407772 ("squad4.digital", "we"). squad4.digital is a brand of GYPAETUSCODE S.R.L.

For any request about your personal data, write to team@squad4.digital. We have not appointed a data protection officer.

What data we collect

We collect only what each purpose below actually needs:

• Analytics events - only after you accept the Analytics category in the cookie banner: pages viewed, the referring page, browser and device type, approximate location derived from your IP address, the elements you click and how far you scroll, page-speed measurements, and the two lead events described in the Cookie Policy. Collected with PostHog, hosted in the European Union. Your IP address is used to derive the approximate location and is then discarded, never stored with the events.
• Session replay - only if you also accept the Session replay category, which is a separate tick and off by default: a replayable recording of your visit on this site, covering mouse movement, clicks, scrolling and the structure of the pages you see. Anything you type is masked before it leaves your browser, the contact form is excluded from recording entirely, and the booking calendar runs in a separate frame that the recording cannot see into.
• Contact form (the brief): what your business does, the problem you want to solve, what you have already tried, the outcome you are after, and your email address. All five fields are required — they are the minimum we need to give you a useful written answer.
• Booking: your name, email address, time zone, the slot you choose and any notes you add when scheduling a call. The notes field is optional — please do not put sensitive information in it.
• Technical logs: IP address, requested URL, timestamp and browser identification recorded by our hosting infrastructure for security and troubleshooting.

Why we process it, and on what legal basis

• Analytics - to understand which pages are useful and improve the site. Legal basis: your consent (Art. 6(1)(a) GDPR), given through the cookie banner and withdrawable at any time.
• Session replay - to find the places where the site confuses people or breaks, which aggregate numbers do not show. Legal basis: your consent (Art. 6(1)(a) GDPR), given as a separate tick in the cookie banner and withdrawable at any time. We do not use recordings to assess or make decisions about individuals.
• Contact form and booking — to review your request, respond, and hold the scheduled call. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, where that does not apply, our legitimate interest in responding to enquiries addressed to us (Art. 6(1)(f) GDPR).
• Technical logs and security — to keep the site available and detect abuse. Legal basis: our legitimate interest in the security of our infrastructure (Art. 6(1)(f) GDPR).
• Email marketing — we do not send a newsletter. If we ever introduce one, it will require your separate, explicit consent, and this policy will be updated first.

Who receives your data

We use a small number of processors to run the site. We do not sell personal data and we share nothing with third parties for advertising.

• PostHog Inc., EU cloud (eu.posthog.com) - analytics events and, if you accept that category, session recordings. Only after your consent. Requests travel through our own domain, never directly to a third-party address.
• Cloudflare — hosting and delivery of the website (Cloudflare Pages) and of the contact-form backend.
• Resend — delivery of the email generated when you submit the contact form.
• Our self-hosted scheduling application (cal.diy) at calendar.squad4.digital — booking data is stored on infrastructure we control, a Kubernetes cluster on servers rented from Hetzner Online GmbH in Nuremberg, Germany, so it stays inside the European Union. Booking confirmation emails are delivered through an email delivery provider acting on our behalf.
• Google Ireland Limited — the calendar is connected to Google Calendar and creates each call as a Google Meet link, so the meeting details (your name, email address and the time you chose) are shared with Google in order to create the meeting.

Transfers outside the EEA

Analytics data is processed in the European Union (PostHog EU cloud), and booking data is stored in Germany. Cloudflare operates a geographically distributed global network, Resend processes data primarily in the United States, and Google may process meeting details outside the European Economic Area - so those three may process data outside the EEA. Those transfers are covered by the EU-US Data Privacy Framework, under which all three providers are certified, and by the European Commission’s Standard Contractual Clauses incorporated in their data processing agreements.

How long we keep data

• Analytics events: 12 months from collection, after which PostHog deletes them.
• Session recordings: up to 30 days from the visit, after which PostHog deletes them.
• Contact-form briefs (received by email): 24 months after our last exchange with you, after which they are deleted.
• Bookings: 24 months after the call, after which they are deleted from the scheduling application.
• Technical logs: a short rolling window determined by our hosting provider.

Your rights

Under the GDPR you can ask us, at any time and free of charge, to exercise any of the rights below. Write to team@squad4.digital — we respond within one month.

• Access the personal data we hold about you, and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), including a submitted brief or a booking.
• Restrict processing while a request is being examined.
• Receive your data in a portable, machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Withdrawing your consent

Open "Cookie settings" in the footer of any page, untick the categories you no longer want and save. Unticking Session replay stops the recording immediately. Unticking Analytics stops all collection and deletes the analytics identifiers stored in your browser. The Cookie Policy lists exactly what is stored and when.

Withdrawing stops future collection. If you also want recordings or events already collected to be deleted, ask us and we will delete them.

Complaints

If you believe we process your data unlawfully, you have the right to lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, www.dataprotection.ro — or to bring proceedings before the courts. We would appreciate the chance to address your concern first.

Changes to this policy

The date and version at the top of this page change whenever the policy does. If a change materially affects processing based on your consent — new purposes, new categories, new providers — the cookie banner is shown again and your previous choice is not carried over.