Privacy Policy
This policy explains what personal data we process when you use webplan.ro, request a quote, fill in a brief or have a client account. It is written in plain language and in line with Regulation (EU) 2016/679 (“GDPR”) and applicable Romanian law.
1. Who we are
The controller of your data is LSSMEDIA DEVELOPMENT GROUP SRL (LSS Media), tax ID (CUI) 28394916 (“we”), which runs the WebPlan.ro service.
For any question about your data, write to [email protected] or call +40 748 280 305. We have not appointed a Data Protection Officer because the law does not require us to; privacy questions are handled directly by us.
2. What data we process, why and for how long
We only process the data we need for the purposes below. Fields marked with * in our forms are required — without them we cannot answer your request.
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Answering quote requests (contact form) | Name, phone, email, the subject you chose and your message | Pre-contractual steps at your request — Art. 6(1)(b) GDPR | 12 months after the last communication, if no contract is signed |
| Preparing the offer and the website (the brief, with or without an account, including the ITP station brief) | Contact details plus business name, type, domain, description and services; for ITP stations: address, opening hours, vehicle categories and rates | Pre-contractual steps and performance of the contract — Art. 6(1)(b) GDPR | 12 months if no contract is signed; otherwise as under “Client account” |
| Client account and contracted services (panel, websites, support tickets, service-related messages) | Name, email, phone (optional), password (stored only in hashed form), date you accepted the terms, billing details (company, tax ID, address), your websites and subscriptions, ticket messages | Performance of the contract — Art. 6(1)(b) GDPR | While the account is active and 3 years after the contract ends (the general limitation period); then the account, brief, websites and tickets are deleted automatically. An account without a contract is deleted after 3 years without activity. Invoices are kept as long as the law requires (next row) |
| Invoicing and accounting records | Billing details, amounts, due dates and payment status | Legal obligation — Art. 6(1)(c) GDPR (accounting and tax law) | For the periods required by law (generally 5 to 10 years) |
| Website usage statistics (Google Analytics 4) | Online identifiers (cookie), pages visited, device and browser type, approximate location, traffic source | Your consent — Art. 6(1)(a) GDPR and Law no. 506/2004. Only switched on if you accept analytics cookies | At most 14 months in Google Analytics |
| Security and proper functioning of the site | IP address, browser type, date and time of access (server logs); the account security log (sign-ins, password changes and account actions, with the IP address shortened and the email masked); the technical browser signals used by the anti-bot check on the forms | Legitimate interest — Art. 6(1)(f) GDPR (protecting the site from abuse) | Up to 90 days |
We do not send newsletters or promotional messages, we do not sell your data, we do not profile you and we do not take decisions based solely on automated processing.
3. Who we share data with
Your data can only be accessed by the members of our team who need it and by the following categories of recipients, acting as processors or independent controllers:
- Hosting and infrastructure providers, who keep the site running and protected.
- Google Ireland Limited — Google Analytics, only if you agree to analytics cookies.
- The ITP offer partner (itp-bucuresti.ro) — only the station information you submitted to be promoted (name, address, hours, categories, rates), for promotion on the partner’s platform.
- Accountants and advisers (accounting, legal), to the extent needed to meet legal obligations.
- Public authorities, when the law requires it.
We have, or are putting in place, data processing agreements under Art. 28 GDPR with providers who process data on our behalf.
4. Transfers outside the European Economic Area
Some providers (for example Google) may process data outside the European Economic Area, notably in the United States. In those cases we rely on the safeguards provided by the GDPR: the European Commission’s adequacy decision for companies certified under the EU–US Data Privacy Framework, or standard contractual clauses.
5. Data security
The site uses an encrypted connection (HTTPS). Passwords are stored only as hashes (we cannot see them), access to the admin panel is limited to authorised people, and documents (for example invoices) can only be downloaded by the account they belong to. No system is perfect, but we apply technical and organisational measures appropriate to the risk. If a security breach affects you, we will notify you and the supervisory authority as required by law.
6. Your rights
You have the following rights regarding your data:
- access — to find out whether we process data about you and to receive a copy;
- rectification — to have inaccurate or incomplete data corrected;
- erasure (“right to be forgotten”) — when the data is no longer needed or you withdrew consent, except for data we are legally required to keep (for example invoices);
- restriction of processing, in the cases provided by law;
- portability — to receive the data you provided in a structured format and pass it to another controller;
- objection — to processing based on our legitimate interest;
- withdrawal of consent, at any time, without affecting the lawfulness of earlier processing. For analytics cookies you can do it here: .
To exercise your rights, write to [email protected]. We reply within one month (extendable by two more months for complex requests, in which case we will tell you). We may ask you to confirm your identity to protect your data.
7. Cookies and Google Analytics
We use strictly necessary cookies (language, sign-in) and, only with your consent, Google Analytics cookies. Until you agree, nothing is sent to Google and no analytics cookies are set. Details, the list of cookies and how to manage them are in the Cookie Policy.
8. Children
Our services are aimed at businesses and people aged 18 or over. We do not knowingly collect data from children. If you believe a child has sent us data, write to us and we will delete it.
9. Changes to this policy
We may update this policy, for example when we add a service or the law changes. The version in force is always the one on this page, with the date of the last update shown at the top. For important changes we will let you know through your account or by email.
10. Contact and complaints
You can reach us at any time at [email protected]. If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28–30 Gheorghe Magheru Blvd., District 1, Bucharest — www.dataprotection.ro — or with your local supervisory authority or a competent court. We encourage you to write to us first so we can try to sort it out together.