Privacy Policy (GDPR)

The controller of personal data, within the meaning of Art. 4(7) GDPR, is the company that administers the btu.ro website and provides the associated services. It determines the purposes and means of the processing described in this document.

You may contact us about any matter relating to the processing of your personal data using the contact details below. We respond to data protection requests within the timeframes set out by GDPR (generally within one month of receiving the request).

• Company name: SND TEAM S.R.L. (commercial brand / website name: "BTU", btu.ro)
• VAT ID / Tax code: RO38963245 (CIF 38963245)
• Trade Register No.: J2018000311325 (EUID: ROONRC.J2018000311325)
• Registered office: Str. Mihai Viteazu no. 260, bl. 5, sc. B, ap. 17, Șelimbăr, Sibiu County, postal code 557260, Romania
• Email for data matters: contact@btu.ro
• Phone: +40 792 222 882
• Web: https://btu.ro

We collect only the data necessary to provide the requested services, manage your account, issue tax documents and meet our legal obligations. The categories of data we process are as follows:

• Account data: first and last name, email address, password (stored encrypted/hashed), phone number, language preferences and account settings.
• Billing data: name/legal name, billing address, and for corporate customers — the company name, VAT/tax registration code (CUI), Trade Register number and registered office address.
• Service data: registered or managed domains, hosting plans, allocated resources, server/VPS configurations, SSL certificates and order history.
• Usage data and technical logs: IP address, browser and device type, operating system, access and server logs, timestamps, pages visited and actions taken in the client panel.
• Payment data via processor: handled through our payment processor; we do NOT store the full card number — we only receive transaction confirmation and minimal data (e.g. last digits, payment status).
• Cookies and similar technologies: identifiers stored in the browser for site operation, security, preferences and, with consent, traffic analytics (see the Cookies section).
• Correspondence and support: the content of messages, support tickets and requests you send us.

We process personal data solely for specified, explicit and legitimate purposes. We do not use the data in a manner incompatible with those purposes.

• Creating and managing the customer account and authenticating access to the panel.
• Providing, configuring, maintaining and supporting hosting, cloud/VPS, dedicated server, domain and SSL services.
• Processing orders and payments and issuing invoices/proformas and accounting documents.
• Transactional and service communications (confirmations, technical notices, renewals, security alerts).
• Ensuring infrastructure security, preventing fraud and abuse, and performing technical monitoring and maintenance.
• Complying with legal, tax and accounting obligations and responding to requests from competent authorities.
• Improving our services and, only with consent, statistical traffic analysis and marketing communications.

Each processing activity is based on one or more legal grounds set out in Art. 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): account creation, provision of ordered services, payment processing and related support.
• Legal obligation (Art. 6(1)(c)): issuing and retaining invoices and accounting documents in accordance with Accounting Law no. 82/1991 and tax legislation.
• Legitimate interest (Art. 6(1)(f)): network and service security, prevention of fraud and abuse, technical improvement and customer relationship management, while respecting your rights and freedoms.
• Consent (Art. 6(1)(a)): analytics/marketing cookies and commercial communications, which you may withdraw at any time without affecting the lawfulness of prior processing.

We do not sell your personal data. We disclose it only to partners strictly necessary for providing the services, who act as processors under data processing agreements compliant with Art. 28 GDPR, or to authorities where required by law.

The categories of recipients are:

• The payment processor (Stripe) — for secure card payment processing.
• The invoicing provider (SmartBill) — for issuing invoices, proformas and tax reporting.
• The email/SMTP provider — for delivering transactional and service emails.
• Infrastructure partners in the European Union (Tier III data centres in the EU) — for the physical hosting and connectivity of servers.
• Related service providers (e.g. domain registrars, SSL certificate authorities) — strictly for delivering the requested service.
• Public authorities, courts or law enforcement — only upon lawful request and within the limits provided by law.

Your data is processed and stored primarily within the European Union / European Economic Area (EU/EEA), where the level of protection guaranteed by GDPR applies directly.

To the extent that a provider (for example the payment processor) processes data outside the EEA, the transfer is carried out only on the basis of appropriate safeguards provided by GDPR — in particular the Standard Contractual Clauses (SCC) approved by the European Commission or an adequacy decision. You may request further information about these safeguards at contact@btu.ro.

We retain personal data only for as long as necessary for the purposes for which it was collected or to comply with legal obligations. The retention criteria are:

• Accounting and billing data: 10 years, in accordance with Accounting Law no. 82/1991 and tax legislation.
• Account and service data: for the duration of the contractual relationship and a reasonable period thereafter to manage renewals, disputes or legal obligations.
• Technical and security logs: generally up to 12 months, depending on security and fraud-prevention needs.
• Data processed on the basis of consent (cookies, marketing): until consent is withdrawn or the cookie expires.
• Correspondence and support tickets: for the period needed to resolve them and to maintain a record of the contractual relationship.

As a data subject, you have the following rights under GDPR, which you may exercise free of charge by request to contact@btu.ro:

• Right of access — to obtain confirmation and a copy of the data processed.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — under the conditions provided by law.
• Right to restriction of processing — in the situations set out in Art. 18 GDPR.
• Right to data portability — to receive the data in a structured, commonly used and machine-readable format.
• Right to object — to processing based on legitimate interest or for marketing purposes.
• Right to withdraw consent — at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint with the supervisory authority (ANSPDCP) and to seek a judicial remedy.

If you consider that the processing of your data infringes GDPR, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP). We do, however, encourage you to contact us first so that we may attempt to resolve any issue amicably.

• National Supervisory Authority for Personal Data Processing (ANSPDCP)
• Address: B-dul G-ral. Gheorghe Magheru no. 28-30, sector 1, postal code 010336, Bucharest, Romania
• Phone: +40 318 059 211 / +40 318 059 212 · Email: anspdcp@dataprotection.ro
• Web: https://www.dataprotection.ro

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure. These include traffic encryption (TLS/SSL), hashed password storage, role-based access control, infrastructure segmentation, security event logging, backups and regular maintenance.

Nevertheless, no system can guarantee absolute security. In the event of a security breach posing a risk to the rights and freedoms of data subjects, we will notify ANSPDCP within 72 hours and, where applicable, the affected individuals, in accordance with Art. 33 and 34 GDPR.

The btu.ro website uses cookies and similar technologies for operation, security, retaining preferences and, only with your consent, for traffic analytics. Processing complies with Law no. 506/2004 and GDPR.

The categories of cookies used are:

• Strictly necessary cookies — for authentication, session, cart and security; these cannot be disabled.
• Preference cookies — for retaining language and settings.
• Analytics cookies — used only with consent, for traffic statistics (our own first-party system and Google Analytics / Google Tag Manager). See the Cookie Policy for details.
• You can manage your preferences through the consent banner and your browser settings. Full details are provided in the dedicated Cookie Policy.

Our services are intended for persons with full legal capacity and are not directed at minors under 16. We do not knowingly collect personal data of minors without the consent of the holder of parental responsibility. If we become aware of such a situation, we will delete the relevant data.

We commit not to misuse your data. In particular:

• We do not sell or rent personal data to third parties.
• We do not use data for automated profiling with legal effects without a legal basis and prior information.
• We do not share data with partners for purposes other than those necessary to provide the services.
• We do not send commercial communications without a legal basis (consent or legitimate interest, as applicable).

We may update this policy from time to time to reflect legal, technical or operational changes. The updated version will be published on this page, indicating the date of the last update. Substantial changes will be communicated, where appropriate, by email or by notice in the client panel. We recommend reviewing this page periodically.

For any questions, requests regarding your rights or concerns relating to the processing of personal data, you may contact us using the details below. Data protection requests are handled as a priority.

The company is not legally required to appoint a Data Protection Officer (DPO) within the meaning of Art. 37 GDPR; nevertheless, we have established a dedicated contact point for data protection matters.

• Controller: SND TEAM S.R.L. (brand "BTU", btu.ro)
• Data protection email: contact@btu.ro
• Phone: +40 792 222 882
• Address: Str. Mihai Viteazu no. 260, bl. 5, sc. B, ap. 17, Șelimbăr, Sibiu County, postal code 557260, Romania