01Who we are
The controller of your personal data is BIGCONVERT SRL, a company incorporated under Romanian law and a digital and performance marketing agency. We determine the purposes and means of the processing described in this policy and are responsible for GDPR compliance for that processing.
Strada Mihail Kogălniceanu 13, Brașov, 500173, Romania
Data Protection Officer (DPO)
BIGCONVERT SRL is not legally required to appoint a data protection officer, as it does not fall under any of the cases set out in Art. 37(1) GDPR: it is not a public authority or body, its core activities do not consist of processing operations that require regular and systematic monitoring of data subjects on a large scale, and it does not process special categories of data or data relating to criminal convictions on a large scale.
Nevertheless, we have appointed an internal contact person for data protection requests. You can send any request or question on this topic to [email protected], with "GDPR" in the subject line.
Scope of this policy
This policy applies to the processing of personal data carried out by BIGCONVERT SRL through the bigconvert.com website (including its subdomains and the partners.bigconvert.com booking platform), through our communication channels (email, phone, forms, social media) and in our contractual relationships with clients, partners, suppliers and job applicants.
02Definitions
The terms below have the meaning given to them in Art. 4 GDPR:
- Personal data – any information relating to an identified or identifiable natural person (for example: name, email, phone number, IP address, online identifiers).
- Processing – any operation performed on data: collection, recording, storage, consultation, use, disclosure, erasure, etc.
- Controller – the entity that determines the purposes and means of the processing.
- Processor – the entity that processes data on behalf of and on the instructions of the controller.
- Data subject – the natural person whose data is processed (you).
- Consent – a freely given, specific, informed and unambiguous indication of the data subject's wishes by which they agree to the processing.
- Special categories of data – the data listed in Art. 9 GDPR (racial or ethnic origin, political opinions, religious beliefs, health data, sex life, etc.). We do not knowingly collect such data.
- Personal data breach – an incident that leads, accidentally or unlawfully, to the destruction, loss, alteration or unauthorized disclosure of data.
- ANSPDCP – the National Supervisory Authority for Personal Data Processing, the competent supervisory authority in Romania.
03Applicable legal framework
We process personal data in compliance with the following European and Romanian legislation:
- Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
- Law no. 190/2018 on measures implementing Regulation (EU) 2016/679.
- Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector – applicable to cookies and unsolicited commercial communications.
- Directive 2002/58/EC (ePrivacy Directive), as amended by Directive 2009/136/EC.
- Law no. 365/2002 on electronic commerce, republished.
- Law no. 102/2005 on the establishment, organization and functioning of ANSPDCP.
- Accounting Law no. 82/1991, republished, and Law no. 207/2015 on the Fiscal Procedure Code – for record-keeping obligations.
- Labor Code (Law no. 53/2003) – for processing in the context of recruitment and employment relationships.
- Regulation (EU) 2022/1925 (DMA) and Regulation (EU) 2022/2065 (DSA) – to the extent they affect the online advertising services we manage.
All our processing follows the principles in Art. 5 GDPR: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.
04When we act as controller and when we act as processor
As a marketing agency, we have two distinct roles. For the data of our website visitors, leads and clients, we are the controller. For the data we process in our clients' ad accounts, analytics platforms or databases, we are a processor and act solely on their documented instructions.
4.1. BigConvert as controller
We are the controller when we decide the purposes and means of the processing ourselves – for example: running the bigconvert.com website, handling proposal requests and bookings, sending marketing communications to our own contacts, invoicing and performing contracts, recruitment, and defending our rights in court.
4.2. BigConvert as processor
When we manage Google Ads, Meta Ads, TikTok Ads or LinkedIn Ads campaigns, product feeds, analytics accounts, CRM platforms or email marketing lists for our clients, the data belongs to the client, who is the controller. In these cases:
- we process data only on the client's documented instructions;
- we sign a data processing agreement (DPA) with each client, in line with Art. 28 GDPR;
- we bind our staff to confidentiality obligations;
- we do not subcontract processing without the client's prior authorization;
- we help the client handle data subject requests and notify any incidents;
- we delete or return the data when the collaboration ends, at the client's choice.
If you are a customer, user or visitor of a website run by one of our clients and want to exercise your GDPR rights over your data, your request must be sent to that controller (the company whose website or service you used). If you write to us, we will confirm receipt and forward your request to the client-controller without undue delay.
05What personal data we process
We only collect the data needed for the purposes described below (data minimization). The categories depend on your relationship with us.
| Category of individuals | Data processed |
|---|---|
| Website visitors | IP address (partially anonymized where possible), browser type and version, operating system, device type, screen resolution, language, traffic source and referring page, pages visited, session duration, interactions (clicks, scrolling, form submissions), cookie identifiers and online identifiers. |
| People who request a proposal or an audit | First and last name, email address, phone number, company name, job title, company website, industry, estimated budget, platforms used, your message, and the date and time of the request. |
| People who book a meeting | Name, email, phone, time zone, chosen time slot, discussion topic, notes added in the form and, for online meetings, the meeting link and, where applicable and with your consent, the recording or transcript of the call. |
| Newsletter and marketing email subscribers | Name (optional), email address, date and proof of consent, communication preferences, engagement statistics (opens, clicks), subscription status. |
| Clients and client contact persons | Name, job title, work email and phone, company identification details (name, tax ID, Trade Register number, registered office), bank and billing details, contractual and operational correspondence, access granted for managing ad accounts. |
| Suppliers, contractors and partners | Identification and contact details, contractual and financial data, supporting documents related to the collaboration. |
| Job applicants | Data from your CV and cover letter: name, contact details, work experience, education, skills, portfolio, public professional profiles, assessment results and interview notes. |
| People who contact us on social media | Public username, the content of the message or comment, and data made available by the platform through its features. |
Scroll the table sideways to see all columns.
Data we do not collect
We do not request or knowingly collect special categories of data within the meaning of Art. 9 GDPR (health data, ethnic origin, political opinions, religious beliefs, biometric data, sex life), nor data relating to criminal convictions (Art. 10 GDPR). Please do not send us such information through forms, email or your CV. If we do receive such data, we delete it as soon as we notice it, unless the law requires us to keep it.
We do not collect national identification numbers (CNP) and do not request copies of identity documents unless this is strictly necessary to meet a legal obligation (for example, in the context of an employment relationship), in compliance with the conditions set out in Art. 4 of Law no. 190/2018.
06Purposes of processing and legal bases
We never process data without a valid legal basis. The legal bases we rely on are those set out in Art. 6(1) GDPR.
| Purpose of processing | Legal basis | Details |
|---|---|---|
| Providing and operating the website | Legitimate interest – Art. 6(1)(f) | Displaying pages correctly, maintaining sessions, load balancing, and preventing abuse and automated attacks. Our legitimate interest is running our own website securely and reliably. |
| Responding to proposal, audit or information requests | Pre-contractual steps – Art. 6(1)(b) | The processing is necessary to take steps at your request before entering into a contract (analysis, proposal, collaboration offer). |
| Scheduling and holding meetings | Pre-contractual steps – Art. 6(1)(b) · Consent – Art. 6(1)(a) for recording | We manage bookings through our own booking platform. An online meeting is only recorded with your explicit consent, given at the start of the call. |
| Performing contracts with clients and suppliers | Performance of a contract – Art. 6(1)(b) | Delivering the contracted services, operational communication, reporting, support and managing the business relationship. |
| Invoicing, accounting and tax reporting | Legal obligation – Art. 6(1)(c) | Issuing and archiving financial and accounting documents in line with Law no. 82/1991 and the Fiscal Code. |
| Newsletter and marketing communications | Consent – Art. 6(1)(a) · Legitimate interest – Art. 6(1)(f) for existing clients | We send marketing communications based on consent. For existing clients, we may send information about similar services under Art. 12 of Law no. 506/2004, with an option to unsubscribe in every message. |
| Traffic analysis and website improvement | Consent – Art. 6(1)(a) | Cookies and analytics technologies (Google Analytics 4). They are only activated after you accept the "Statistics" category in the cookie banner. |
| Online advertising, remarketing and conversion measurement | Consent – Art. 6(1)(a) | Google Ads, Meta Pixel and Conversions API, LinkedIn Insight Tag, TikTok Pixel. They are only activated after you accept the "Marketing" category. |
| Managing lead relationships in our CRM | Legitimate interest – Art. 6(1)(f) | Organizing and following up on business opportunities. Our legitimate interest is running and growing our own business. |
| Recruitment | Pre-contractual steps – Art. 6(1)(b) · Consent – Art. 6(1)(a) for keeping your CV | Assessing applications for open positions. We only keep your CV for future positions with your consent. |
| Information security and fraud prevention | Legitimate interest – Art. 6(1)(f) · Legal obligation – Art. 6(1)(c) | Access logs, monitoring of intrusion attempts, protection of our infrastructure and client data. |
| Establishing, exercising or defending legal claims | Legitimate interest – Art. 6(1)(f) | Keeping the evidence needed for potential disputes, complaints or inspections by authorities. |
| Meeting legal obligations and requests from authorities | Legal obligation – Art. 6(1)(c) | Responding to requests from competent authorities, within the limits set by law. |
Scroll the table sideways to see all columns.
Legitimate interest balancing test
When we rely on legitimate interest, we first assess whether that interest is overridden by your interests or fundamental rights and freedoms. We document this assessment and review it regularly. You can ask about the legitimate interest we rely on in a specific case by writing to us at [email protected], and you can object to this processing at any time (see section 12).
07Data sources
We collect data:
- directly from you – when you fill in a form, email or call us, book a meeting, subscribe to our newsletter, apply for a job or sign a contract;
- automatically, through tracking technologies – cookies, pixels, SDKs and server logs, as described in section 15;
- from third parties – advertising and analytics platforms, social networks (when you interact with our pages), partners who refer us, and public sources (company websites, the Trade Register, public professional profiles), to verify partners and for B2B prospecting, within the limits of our legitimate interest.
When we collect data from public sources or third parties, we inform you within one month of obtaining it or at the first contact, in line with Art. 14 GDPR.
08Who we share your data with
We do not sell or rent your personal data to third parties. We only share it with suppliers who help us run our business, under processing agreements that comply with Art. 28 GDPR, and with authorities when the law requires it.
| Recipient / service | Role | Purpose of disclosure |
|---|---|---|
| Google Ireland Ltd. / Google LLC (Google Analytics 4, Google Ads, Google Tag Manager) | Processor | Traffic analysis, conversion measurement, advertising and remarketing. |
| Meta Platforms Ireland Ltd. (Meta Pixel, Conversions API, Facebook & Instagram Ads) | Joint controllers / processor | Conversion measurement and ad delivery on Facebook and Instagram. For certain operations we act as joint controllers with Meta, under the Meta Controller Addendum. |
| LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag, LinkedIn Ads) | Joint controllers / processor | Conversion measurement and B2B advertising. |
| TikTok Technology Limited (TikTok Pixel, TikTok Ads) | Processor / joint controllers | Conversion measurement and campaign delivery. |
| HubSpot Ireland Ltd. / HubSpot Inc. (CRM and email marketing) | Processor | Managing leads and the business relationship, and sending communications you have agreed to receive. |
| Our own booking platform (partners.bigconvert.com) | Internal system | Scheduling meetings and audit sessions. The data is hosted on our own infrastructure and with our hosting providers. |
| Hosting, CDN and cloud infrastructure providers | Processor | Website hosting, backup storage, protection against attacks. |
| Email and collaboration service providers (productivity suites) | Processor | Correspondence, working documents, calendar, storage. |
| Accounting, audit, legal advice | Independent controllers / processors | Meeting accounting and tax obligations, advice and representation. |
| Financial institutions and payment processors | Independent controllers | Receiving and making payments. |
| Public authorities (ANAF, ANSPDCP, courts, investigative bodies) | Independent controllers | Only at their request, under a legal obligation. |
| Potential buyers, in the event of a reorganization | Controller | In the event of a merger, demerger or business transfer, with prior notice to data subjects. |
Scroll the table sideways to see all columns.
All our processors are selected based on the security guarantees they offer and are contractually bound to process data only on our instructions, keep it confidential and implement appropriate technical and organizational measures.
Joint controllers
For advertising pixels (Meta, LinkedIn, TikTok), some operations – in particular collecting the data and sending it to the platform – are carried out as joint controllers, under Art. 26 GDPR. The platforms then also process this data for their own purposes, as independent controllers, under their own privacy policies. You can exercise your rights both with us and directly with each platform.
09International data transfers
Some of our suppliers are companies based in the United States or have parent companies outside the European Economic Area. As a result, some data may be transferred outside the EEA.
These transfers only take place under the conditions of Chapter V GDPR (Art. 44–49), based on one of the following safeguards:
- the European Commission's adequacy decision of July 10, 2023 on the EU–U.S. Data Privacy Framework, for U.S. providers certified under this framework;
- the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914;
- supplementary technical and organizational measures (encryption in transit and at rest, pseudonymization, minimizing the fields transmitted), set following a transfer impact assessment.
You can get a copy of the safeguards that apply to a specific transfer by writing to us at [email protected].
If you decline statistics and marketing cookies, your browsing data is not sent to analytics and advertising platforms and, as a result, is not subject to any international transfer linked to these technologies.
10How long we keep data
We keep data only as long as needed for the purpose it was collected for, or as long as the law requires. When these periods expire, the data is deleted or irreversibly anonymized.
| Data category | Retention period | Criterion |
|---|---|---|
| Proposal and audit requests that did not go ahead | 24 months from the last contact | Commercial legitimate interest; period for reassessing the opportunity. |
| Email correspondence | 3 years from the last interaction | Operational and evidentiary need. |
| Contract and business relationship data | Term of the contract + 3 years | General limitation period (Art. 2517 Civil Code). |
| Financial and accounting documents | 5 years, or 10 years for annual financial statements | Accounting Law no. 82/1991, as amended. |
| Tax-relevant documents | 5 years (10 years where required by law) | Limitation period under Law no. 207/2015. |
| Newsletter subscription data | Until consent is withdrawn + 3 years as proof of consent | Consent; obligation to demonstrate consent (Art. 7(1) GDPR). |
| Meeting booking data | 24 months from the meeting date | Following up on the business relationship. |
| Online meeting recordings | Up to 12 months, or until consent is withdrawn | Explicit consent. |
| CRM data (leads) | 36 months from the last relevant interaction | Legitimate interest; B2B sales cycle. |
| CVs of unsuccessful applicants | 6 months, or 24 months with consent for future positions | Pre-contractual steps; consent. |
| Server and security logs | Up to 12 months | Legitimate interest in network and information security. |
| Cookies | As per the durations in the table in section 15 | Consent; the specific duration of each cookie. |
| Proof of cookie consent | 3 years from when it was given | Obligation to demonstrate consent. |
| Data involved in a dispute | Until final resolution + 3 years | Establishing, exercising or defending legal claims. |
Scroll the table sideways to see all columns.
11Data security
We implement appropriate technical and organizational measures, in line with Art. 32 GDPR, to ensure a level of security appropriate to the risk. These include:
- encryption of traffic via HTTPS/TLS on all pages and forms;
- encryption of data at rest at our infrastructure providers;
- strict access control on a "need-to-know" basis, with individual accounts and two-factor authentication for critical systems and client ad accounts;
- internal security and confidentiality policies, with regular team training;
- confidentiality agreements signed by employees and contractors;
- regular backups and tested restore procedures;
- separate working environments and minimal data access in client projects;
- vetting suppliers before contracting and monitoring them throughout the collaboration;
- an internal security incident management procedure.
That said, no method of electronic transmission or storage is 100% secure. We cannot guarantee the absolute security of data sent over the internet, but we are committed to responding promptly and transparently to any incident.
12Your rights under the GDPR
As a data subject, you have the following rights under Art. 15–22 and Art. 77 GDPR:
Right of access
You can find out whether we process data about you, for what purpose, which categories of data, who we share it with and how long we keep it. You can receive a copy of your data.
Right to rectification
You can ask us to correct inaccurate data or complete incomplete data, including by providing a supplementary statement.
Right to erasure
Also known as the "right to be forgotten". You can ask us to delete your data when it is no longer needed, when you withdraw your consent or when you object to the processing.
Right to restriction
You can ask us to restrict processing, for example while we check the accuracy of the data or whether an objection is justified.
Right to data portability
You can receive the data you provided in a structured, commonly used and machine-readable format, and transfer it to another controller.
Right to object
You can object to processing based on legitimate interest. For direct marketing, your objection is unconditional and we act on it immediately.
Withdrawing consent
You can withdraw your consent at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before it.
Automated decisions
You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.
Complaint to the authority
You can lodge a complaint with ANSPDCP or with the supervisory authority in your country of residence.
Legal remedy and compensation
You can go to the competent courts and claim compensation for damage suffered as a result of unlawful processing.
13How to exercise your rights
Send a request to [email protected], with "GDPR request" in the subject line, or by post to our registered office: Șoseaua Gheorghe Ionescu Șișești 32, Sector 1, Bucharest, 013824. We reply within 30 days, free of charge.
What your request should include
- your name and a way for us to reply to you;
- the right you want to exercise and, if possible, the processing it relates to;
- any detail that helps us identify you in our records (for example, the email address you used with us).
Timelines and conditions
- We reply within one month of receiving your request. This period may be extended by two further months for complex or numerous requests, in which case we will tell you about the extension and the reasons for it within the first month (Art. 12(3) GDPR).
- Exercising your rights is free of charge. If a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse to act on it, and we will explain our decision (Art. 12(5) GDPR).
- If we have reasonable doubts about the identity of the person making the request, we may ask for additional information strictly necessary to confirm it. We will only ask for a copy of your ID if there is no other reasonable way to verify your identity.
- In certain cases provided by law, a right may be limited – for example, we cannot delete data we are legally required to archive. In these cases, we will explain why we are refusing.
Withdrawing consent for marketing communications
You can unsubscribe at any time using the "Unsubscribe" link at the bottom of every marketing email or by writing to us at [email protected]. We will process your request without undue delay.
Withdrawing consent for cookies
You can change your cookie preferences at any time in the or directly in your browser. Full details in section 15.
14Complaints and remedies
If you believe we have infringed your rights, we encourage you to contact us first – in most cases we can resolve the issue quickly and directly. However, you have the right to contact the supervisory authority at any time.
You can also go to the competent courts in Romania, under Art. 79 GDPR, and claim compensation for material or non-material damage suffered, under Art. 82 GDPR. If you habitually live in another EU member state, you can also lodge a complaint with the supervisory authority in that state.
16Direct marketing and commercial communications
We only send marketing emails if:
- you have given your explicit consent (opt-in), for example by subscribing to our newsletter; or
- you are already our client and we send you information about services similar to those you have contracted, under Art. 12(2) of Law no. 506/2004, with the option to object when your address is collected and in every subsequent message.
Every marketing email identifies the sender and includes a clear, free way to unsubscribe. We do not send unsolicited commercial messages ("spam") and do not use email addresses obtained from sources that do not allow prospecting.
Measuring email engagement
Our newsletters may contain pixels that show us whether a message was opened and which links were clicked. We use these statistics to make our content more relevant. You can block this tracking by turning off automatic image loading in your email client.
B2B prospecting
We may contact company representatives at their publicly available business contact details, based on our legitimate interest in growing our business. At the first contact, we tell you where we got your data and give you the option to object right away, in which case we stop all communication.
17Automated decision-making and profiling
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you, within the meaning of Art. 22 GDPR.
We do, however, use certain forms of low-risk profiling, solely for marketing purposes and only based on your consent to marketing cookies:
- segmenting visitors into remarketing audiences based on the pages they visited;
- building lookalike audiences on advertising platforms;
- personalizing marketing content shown on the site or sent by email;
- internal lead scoring in our CRM, used only to prioritize follow-up by a team member – the final decision is always made by a person.
You can object to this processing at any time by withdrawing your consent to marketing cookies or by writing to us at [email protected].
18Children's data
Our services are aimed exclusively at professionals and companies. The website is not intended for people under the age of 16 and we do not knowingly collect data from minors.
Under Art. 8 GDPR, read together with Romanian law, where information society services are offered directly to a child, processing is lawful only if the child is at least 16; below that age, consent from the holder of parental responsibility is required.
If you are a parent or guardian and believe a minor has given us personal data, please contact us at [email protected]. We will delete this data without undue delay.
19Security incidents
We have an internal procedure for identifying, assessing and managing personal data breaches. In the event of an incident:
- we notify ANSPDCP within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to the rights and freedoms of individuals (Art. 33 GDPR);
- we inform you directly and without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Art. 34 GDPR), describing the nature of the incident, its likely consequences and the measures taken;
- we document every incident, including its effects and the remedial action taken, so the authority can verify it;
- if the incident concerns data we process as a processor, we inform the client-controller without undue delay, under Art. 33(2) GDPR.
20Links to third-party websites
Our website contains links to websites and platforms run by third parties: our Instagram, Facebook and LinkedIn pages, client websites featured in our portfolio, and external resources cited in our blog articles.
This policy does not apply to those websites. We do not control and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit through a link from us.
Embedded videos (for example, from YouTube or Vimeo) load by default in privacy-enhanced mode or only after you consent to marketing cookies, so the provider does not set cookies before you interact with them.
21Changes to this policy
We may update this policy from time to time to reflect changes to our services, the technologies we use or the legal framework. The version that applies is always the one published on this page.
If we make substantial changes – for example, adding a new processing purpose or changing the legal basis – we will let you know in advance through a visible notice on the website or, where appropriate and if we have your email address, by direct message. If the change concerns processing based on consent, we will ask for your consent again.
We encourage you to check this page regularly.
22Contact
For any question, request or complaint about how we process your personal data, you can contact us:
We reply within 30 days of receiving your request. For urgent data security matters, please put "URGENT – data security" in the email subject line.