Last updated: May 30, 2026
Privacy policy
I collect the minimum data about you. Only what I need to reply to your form and contact you back. Here's exactly what I collect, where I store it, who I share it with, how long, what rights you have, and where to complain if something's off.
Who the data controller is
The data controller is STEFAN SERBAN INVESTIȚII IMOBILIARE SRL, tax ID (CUI) 49663952, registered office in Pitești, Argeș county, Romania, operating under the commercial brand HighUpLabs. Contact point for any data-related question: business@highuplabs.ro, +40 725 358 757. No mandatory DPO (under 250 employees), but replies come directly from Stefan Serban.
What data I collect and on what legal basis
When you fill the form: name (if you write it), email, phone (optional), project details. Technically I also collect IP and user agent (browser). Legal basis: explicit consent through the form checkbox (GDPR Art. 6(1)(a)) for contact data and conversation, plus legitimate interest (Art. 6(1)(f)) for IP/user agent as anti-spam and anti-abuse. If we reach a contract, the basis shifts to contract performance (Art. 6(1)(b)).
Where I store data
Form data goes into a Supabase database hosted in EU-West (London, region eu-west-2). Emails go through Resend with verified domain highuplabs.ro. Encrypted backups, access restricted to service role.
Who I share with
Nobody for commercial purposes. I don't sell data, I don't do automated profiling, I don't send unauthorized promos. My technical processors are Supabase Inc. (database, standard DPA in place) and Resend Inc. (transactional emails, standard DPA in place). Their DPA documents are public at supabase.com/legal and resend.com/legal.
International transfers
Supabase EU-West (London) is UK post-Brexit; UK has a GDPR adequacy decision from the European Commission (2024), so transfers are lawful without additional SCCs. Resend is a US company (Delaware); transfers to the US rely on EU-approved Standard Contractual Clauses (SCCs) and a Transfer Impact Assessment. If you want a copy of the SCCs, write to business@highuplabs.ro.
How long I keep data
For leads that don't become clients: 12 months from last active interaction, then auto-deletion. For invoiced clients: accounting data (invoices, contracts) are kept for 10 years per Romanian fiscal law (Tax Code Art. 25). Technical data (IP, logs) max 6 months. If you want earlier deletion and there's no fiscal or contractual obligation, we delete within 30 days.
Your rights (GDPR full)
You have the right to: access (Art. 15), rectification (Art. 16), erasure („right to be forgotten”, Art. 17), restriction (Art. 18), portability (Art. 20), objection to processing (Art. 21, including direct marketing), not to be subject to automated decisions including profiling (Art. 22, we don't do this anyway), withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3)). All free, via email at business@highuplabs.ro. I respond within 30 days max, usually faster.
Cookies and local storage
For the site to work I use two strictly-necessary things: a localStorage key for the chosen theme (dark/light) and a cookie for the selected language (RO/EN) managed by next-intl. Both are exempt from consent because they're strictly necessary under ePrivacy. Zero tracking cookies, zero third-party marketing pixels, zero Google Analytics, zero Meta Pixel. If I ever add anything non-strict, you'll see a consent banner first.
Complaint to supervisory authority
If you believe we process your data unlawfully, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru no. 28-30, sector 1, Bucharest, anspdcp@dataprotection.ro, dataprotection.ro. Before that, write to me at business@highuplabs.ro; I respond personally and we try to resolve directly.
Changes to policy
If I change something important (different processor, different purpose, different legal basis), I post the new version here and update the date above. For major changes that affect you directly, I notify by email if I have your active data.