Legal

Privacy Policy

Last updated: 13 October 2026

This policy explains what personal data is processed when you visit malvixia.com, contact us or request a free website audit, why, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Romanian Law no. 190/2018.

1. Who is responsible (controller)

  • Controller: ARARIPE IT SRL, trading as “Malvixia”
  • Tax ID (CUI): 34710924 (not registered for VAT)
  • Trade Register no.: J35/485/2024
  • Registered office: Str. Baladei nr. 4, ap. 1, Dumbrăvița 307160, Timiș, Romania
  • Privacy contact: mihai.udrea@malvixia.com

We have not appointed a Data Protection Officer, as we are not required to.

Malvixia provides services for businesses only; our services are not offered to consumers.

2. What we process, why, and on what legal basis

Contact form and direct email. Name, email, phone number, company, budget range and your message. Used to reply to you and, if relevant, prepare an offer. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f)).

Free website audit form. Name, email, website URL, business type, main goal, optional phone number, and your confirmation that we may contact you. Used to review the publicly visible parts of your website, send you the report and follow up on it. Legal basis: steps at your request before a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)). We do not add you to a newsletter.

Website analytics, only with your consent. If you click “Accept” in the banner, we load Google Analytics 4 (with IP anonymisation) and Microsoft Clarity (session replay and heatmaps). They collect device and browser data, approximate location (country/city), referrer and campaign parameters, pages viewed, clicks, scrolling and mouse movement. Clarity masks text you type in form fields. These tools set cookies or similar identifiers. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law no. 506/2004). If you click “Decline”, they are not loaded.

Privacy-friendly statistics. We use Vercel Web Analytics to count visits, pages, referrers, campaign parameters and simple events (for example form submitted, section viewed). It sets no cookies and does not identify individual visitors; it uses a short-lived hash of the request that is discarded within a day. Legal basis: legitimate interest in understanding how the site is used (Art. 6(1)(f)).

Hosting and security logs. When you load the site, our host receives your IP address, browser user agent, requested URL and time. Used to deliver the site and keep it secure. Legal basis: legitimate interest (Art. 6(1)(f)).

Email open tracking. Some business emails we send (for example outreach emails to companies) contain a small invisible image (a “tracking pixel”, served from malvixia.com/api/open) that tells us whether the email was opened (recorded as an event in Google Analytics, with a campaign identifier rather than your name). Legal basis: legitimate interest in measuring our outreach (Art. 6(1)(f)). You can block it by disabling automatic image loading. You can object or unsubscribe at any time by replying “unsubscribe” or emailing us; every such email includes this option.

Fonts. The site loads fonts from Google Fonts, so your browser sends your IP address to Google when the page loads. Legal basis: legitimate interest in consistent presentation (Art. 6(1)(f)).

We do not use your data for automated decision-making or profiling with legal or similarly significant effects, and we do not sell it.

3. Cookies and local storage

  • malvixia-analytics (browser local storage): remembers whether you accepted or declined analytics. Strictly necessary; kept until you clear it.
  • Google Analytics (_ga, _ga_*): distinguishes visitors; up to 2 years. Only after consent.
  • Microsoft Clarity (_clck, _clsk, CLID and similar): links page views into a session; up to 1 year. Only after consent.

You can change your choice at any time: . Withdrawing consent does not affect processing that happened before.

4. Who receives your data (processors)

  • Vercel Inc. (USA): website hosting, logs and Vercel Web Analytics.
  • EmailJS (EmailJS Pte. Ltd.): delivers form submissions to our mailbox.
  • Google (Google Ireland Ltd. / Google LLC): Google Analytics, Google Fonts.
  • IONOS (IONOS SE / IONOS Cloud Ltd.): our email provider, which stores the emails and form submissions we receive.
  • Microsoft (Microsoft Ireland Operations Ltd. / Microsoft Corp.): Clarity.

We may also disclose data to authorities when required by law, or to professional advisers bound by confidentiality.

5. Transfers outside the EU/EEA

Some of these providers process data in the United States or other countries outside the EEA. Where a provider is certified under the EU–US Data Privacy Framework, transfers rely on the European Commission’s adequacy decision; otherwise they rely on the Commission’s Standard Contractual Clauses (Art. 46 GDPR). You can ask us for more information about these safeguards.

6. How long we keep data

  • Contact and audit requests: up to 24 months after our last exchange, unless they lead to a contract; contract and invoicing records are kept as long as Romanian accounting and tax law requires (generally 5–10 years).
  • Google Analytics data: 14 months. Microsoft Clarity recordings: up to 30 days (aggregated heatmaps up to 13 months).
  • Hosting logs: as set by Vercel, typically a few days to 30 days.
  • Consent choice: in your browser until you clear it.

7. Your rights

Under the GDPR you have the right to:

  • access the data we hold about you and get a copy;
  • have inaccurate data corrected;
  • have data erased (“right to be forgotten”);
  • restrict processing;
  • data portability, where processing is based on consent or contract;
  • object at any time to processing based on legitimate interest, including email open tracking;
  • withdraw consent at any time, without affecting earlier processing.

To exercise any right, email mihai.udrea@malvixia.com. We reply within one month (extendable by two months for complex requests) and may ask you to confirm your identity.

You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 General Gheorghe Magheru Blvd., Sector 1, 010336 Bucharest, Romania, www.dataprotection.ro, or with the authority in the EU country where you live or work.

8. Security and providing data

The site is served over HTTPS and access to submissions is limited to the people who handle them. Providing data in our forms is voluntary, but without an email address we cannot reply to you or send an audit report. The site is not aimed at children under 16.

9. Changes

We may update this policy. The date at the top shows the latest version; significant changes will be highlighted on the site.