Legal
Privacy Policy
This policy explains which personal data we process through the bwcounter.com website, why, on what legal basis, how long we keep it and what rights you have. It is written from what the website actually does: the tables below are generated from its configuration.
In short
- You can visit the site without telling us who you are. We receive personal data only if you write to us or fill in a form.
- We use no analytics or advertising cookies without your consent. The site currently uses only the cookies listed in the Cookie Policy.
- We do not sell data, do not profile you with legal effects and take no automated decisions about you.
- Form data is deleted automatically at the periods below.
- For any request about your data: hello@bwcounter.com. We answer within one month.
Who the controller is
The controller of your data, within the meaning of Regulation (EU) 2016/679 (“GDPR”), Romanian Law no. 190/2018 implementing the GDPR and Romanian Law no. 506/2004 on electronic communications, is:
- Controller
- BEAUTY & WELLNESS COUNTER S.R.L.
- Fiscal code (CUI)
- 55415560
- Trade register
- J2026049511004
- Registered office
- Str. Ioan Budai-Deleanu nr. 5, Cugir, jud. Alba, România
- Contact
- hello@bwcounter.com
We are not legally required to appoint a Data Protection Officer (DPO). You can send any question about personal data to the address above.
What we process, why and for how long
| Activity | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting the website | IP address, date and time, requested page, browser type (server logs); technical session cookie. | Delivering the pages, security, preventing abuse. | Legitimate interest — art. 6(1)(f) GDPR | Application logs: 30 days, then automatic deletion; server access logs are kept by the hosting provider for short periods. Technical session: 120 minutes. |
| Cookie consent records | Random consent ID, choices, date and time, policy version, language, device category (mobile/tablet/desktop), keyed hash of the IP address (the IP itself is not stored). | Proving that consent was requested and what was chosen. | Legal obligation — art. 6(1)(c) and art. 7(1) GDPR | 3 years from the last change of choice |
| Audience measurement and advertising | Online identifiers (cookies), pages viewed, interactions, device and browser data, approximate location. | Statistics and campaign measurement — only through the services listed in the Cookie Policy. | Consent — art. 6(1)(a) GDPR | As listed in the Cookie Policy (cookies: at most 13 months; Google Analytics data: 14 months). |
| Collaboration & distribution requests | Name, company, country, phone, e-mail, type of business, brands of interest, sales projection, message; date, language, page of origin, keyed hash of IP, browser type. | Answering the request and discussing a possible commercial collaboration. | Steps prior to a contract at your request — art. 6(1)(b); legitimate interest in developing the business — art. 6(1)(f) GDPR | 36 months from submission, then automatic deletion. If we sign a contract, the data then follows the contract. |
| Job & partnership applications | First and last name, country, e-mail, LinkedIn profile, area of interest, statements ticked; date, language, keyed hash of IP, browser type. | Evaluating the application; with separate optional consent, keeping it for future opportunities. | Steps prior to a contract at your request — art. 6(1)(b); consent for the talent pool — art. 6(1)(a) GDPR | 6 months from submission; 36 months only if you ticked the optional talent-pool box. Automatic deletion. |
| E-mail correspondence | E-mail address, name, content of the message. | Answering the message. | Legitimate interest — art. 6(1)(f) GDPR; art. 6(1)(b) where it concerns a contract | 36 months from the last message, except correspondence we must keep by law (e.g. accounting documents — 10 years). |
| Data protection requests | Identity and contact data, the request, our answer. | Handling and documenting GDPR requests. | Legal obligation — art. 6(1)(c), art. 12–22 GDPR | 3 years from closing the request |
Fields marked * in the forms are needed so that we can answer; without them we cannot handle the request. The box for keeping your application for 36 months is optional and does not affect how your application is assessed.
Where the data comes from
Directly from you (forms, e-mail) and, automatically, from your browser (technical data). If you give us a link to your LinkedIn profile, we may look at the public information in that profile, only to assess the application.
What we do not do
- We do not sell or rent personal data or pass it to third parties for their marketing.
- We take no decisions based solely on automated processing and do no profiling with legal effects (art. 22 GDPR).
- We do not ask for or knowingly process sensitive data (health, origin, beliefs etc.). Please do not include it in messages.
- We do not store IP addresses in clear: we keep only a keyed hash, enough to prevent abuse.
- We send no newsletters and do not use your address for advertising.
Who receives the data
Data is accessed only by the members of our team who need it, through personal accounts with two-factor authentication and an audit log. We use the following providers (processors, art. 28 GDPR) or, where applicable, independent recipients:
| Recipient | What it does | Location / transfer |
|---|---|---|
| Hostinger International Ltd. 61 Lordou Vironos Street, 6023 Larnaca, Cyprus | Web hosting, database, backups and e-mail (servers in Frankfurt, Germany). | EU (Germany) |
| Google Tag Manager Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland |
Loads the measurement tags listed on this page, only after consent. Sets no cookies of its own. (Analytics and Performance Cookies) | Possible transfer to Google LLC (USA) — EU–US Data Privacy Framework adequacy decision + Standard Contractual Clauses |
| Google Analytics 4 Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland |
Aggregated audience statistics (pages visited, time on page, device type, approximate country/city). IP addresses are not logged or stored by GA4; Google signals and ad personalisation are off. Data retention in GA4: 14 months. (Analytics and Performance Cookies) | Possible transfer to Google LLC (USA) — EU–US Data Privacy Framework adequacy decision + Standard Contractual Clauses |
| Meta Pixel Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland |
Measures our Facebook/Instagram campaigns and builds audiences for them. Meta is joint controller for collection and transmission (CJEU C-40/17 Fashion ID). (Advertising and Marketing Cookies) | Possible transfer to Meta Platforms, Inc. (USA) — EU–US Data Privacy Framework + Standard Contractual Clauses |
We may also share data with our legal or accounting advisers (bound by confidentiality) and with public authorities, only when the law requires it.
Transfers outside the European Economic Area
The website and its database are hosted in the EU (Germany). A transfer outside the EEA can occur only through the optional services marked in the table above and only after your consent; the safeguards used are the EU–US Data Privacy Framework adequacy decision and the European Commission’s Standard Contractual Clauses.
Cookies
Details on each cookie, its purpose, duration and provider are in the Cookie Policy. You can change your choice at any time from “Cookie settings” at the bottom of every page, and on My consent you can see what you chose and download the proof.
How we protect the data
- Mandatory encrypted connection (HTTPS with HSTS) and a strict Content Security Policy (CSP) that allows only the declared services.
- Encrypted, HttpOnly, Secure, SameSite session cookies; CSRF and spam protection on forms.
- Admin access only with personal accounts, roles and two-factor authentication; every view, export or deletion of form data is logged.
- Daily automatic deletion when retention periods end.
If a personal data breach presents a risk, we notify the supervisory authority within 72 hours and, where the risk is high, we inform you directly (art. 33–34 GDPR).
Your rights
- Access (art. 15) — to know whether we process data about you and receive a copy.
- Rectification (art. 16) — to correct inaccurate data.
- Erasure (art. 17) — to have data deleted.
- Restriction (art. 18) — to limit processing temporarily.
- Portability (art. 20) — to receive your data in a structured format (CSV/JSON).
- Objection (art. 21) — to object to processing based on legitimate interest.
- Withdrawing consent (art. 7(3)) — at any time, without affecting earlier processing. For cookies, from “Cookie settings”; for the talent pool, by e-mail.
- Complaint to the Romanian supervisory authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, Bucharest, 010336, www.dataprotection.ro, anspdcp@dataprotection.ro, or to the authority of your EU country of residence.
Write to us at hello@bwcounter.com. Exercising your rights is free. We answer within one month of receipt; for complex requests this can be extended by two further months, in which case we tell you within the first month. We may ask for additional information only if we have reasonable doubts about your identity. Every request is recorded together with our answer.
Children
The website is intended for professionals and adults. We do not knowingly collect data from people under 16; if you learn that a child has sent us data, write to us and we will delete it.
Changes
Any change to this policy is published here as a new, numbered and dated version. Earlier versions remain available at the end of the page. If a change affects your rights or concerns a consent, we will tell you before it applies.