Legal - Data Protection
GDPR Compliance Notice
General Data Protection Regulation (EU) 2016/679 ยท Last updated: January 2025
Your Data Rights Under GDPR
HSW Pro - High Solutions Web is fully committed to protecting your personal data and respecting your rights under the General Data Protection Regulation (GDPR). This notice explains how we collect, process, and protect your personal data, and what rights you have as a data subject.
Your 8 GDPR Rights at a Glance
๐
Right to Access
Request a copy of all personal data we hold about you (Art. 15 GDPR)
โ๏ธ
Right to Rectification
Request correction of inaccurate or incomplete personal data (Art. 16)
๐
Right to Erasure
Request deletion of your personal data ("right to be forgotten") (Art. 17)
โธ
Right to Restrict
Request restriction of processing of your personal data (Art. 18)
๐ฆ
Data Portability
Receive your data in a structured, machine-readable format (Art. 20)
๐ซ
Right to Object
Object to processing of your data for direct marketing or profiling (Art. 21)
๐ค
Automated Decisions
Not to be subject to solely automated decisions with legal effects (Art. 22)
โฉ๏ธ
Withdraw Consent
Withdraw consent at any time without affecting prior processing (Art. 7)
1. Data Controller Identity & Contact
Data Controller
HSW Pro - High Solutions Web
EU
EU Member State
Email: contact@hswpro.com
Phone: +34 722 104 324
Web: www.hswpro.com
EU
EU Member State
Email: contact@hswpro.com
Phone: +34 722 104 324
Web: www.hswpro.com
Supervisory Authority
ANSPDCP
Autoritatea Naศionalฤ de Supraveghere a Prelucrฤrii Datelor cu Caracter Personal
If you believe your GDPR rights have been violated, you have the right to lodge a complaint with ANSPDCP at:
www.dataprotection.ro
Autoritatea Naศionalฤ de Supraveghere a Prelucrฤrii Datelor cu Caracter Personal
If you believe your GDPR rights have been violated, you have the right to lodge a complaint with ANSPDCP at:
www.dataprotection.ro
2. What Personal Data We Collect & Why
| Data Category | Examples | Legal Basis (GDPR Art.) | Purpose |
|---|---|---|---|
| Contact & Identity Data | Name, email, phone, company name | Art. 6(1)(b) - Contract performance Art. 6(1)(a) - Consent |
Responding to enquiries, service delivery |
| Project & Business Data | Project requirements, briefs, budgets | Art. 6(1)(b) - Contract performance | Providing the requested services |
| Technical & Usage Data | IP address, browser, pages visited, session duration | Art. 6(1)(f) - Legitimate interests | Website analytics, security, performance improvement |
| Communication Data | Email correspondence, form submissions | Art. 6(1)(b) - Contract performance | Client communication, project management |
| Marketing Preferences | Email subscription status, communication preferences | Art. 6(1)(a) - Consent | Sending newsletters, product updates (opt-in only) |
3. Data Security & Protection Measures
We implement appropriate technical and organisational security measures in accordance with Article 32 GDPR to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure.
๐ Encryption
All data transmitted via HTTPS/TLS 1.3. Sensitive data encrypted at rest using AES-256. Passwords hashed with bcrypt.
๐ก Access Controls
Role-based access control (RBAC). Multi-factor authentication for all staff systems. Principle of least privilege enforced.
๐ Procedures
Regular security audits. Staff GDPR training. Data breach notification procedure (72-hour reporting to ANSPDCP per Art. 33).
4. Data Retention Periods
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Contact form enquiries | 2 years | Follow-up, business relationship management |
| Client project data | 5 years after project completion | Legal, accounting & warranty obligations |
| Invoices & financial records | 10 years | EU accounting & tax compliance requirement |
| Website analytics data | 26 months (Google Analytics default) | Performance monitoring and improvement |
| Email marketing lists | Until unsubscribe or withdrawal of consent | Consent-based - immediately deleted on request |
| Support communications | 3 years | Service quality, dispute resolution |
5. International Data Transfers
Some of our third-party service providers may process data outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V.
Google (Analytics, Workspace)
Standard Contractual Clauses (SCCs) ยท EU-US Data Privacy Framework
Amazon Web Services
EU data residency (Frankfurt / Ireland regions) ยท SCCs for cross-region processing
Email Service Providers
GDPR-compliant Data Processing Agreements in place with all email providers
6. How to Exercise Your Rights
To exercise any of your GDPR rights, please contact us using the details below. We will respond within 30 days as required by Article 12 GDPR. In complex cases, we may extend this by a further 2 months and will notify you accordingly.
Submit a Data Rights Request
Email: contact@hswpro.com
ยท Subject: GDPR Data Request - [Your Name]
Please include: your full name, email address, the right you wish to exercise, and any relevant details. We may need to verify your identity before processing the request.
Please include: your full name, email address, the right you wish to exercise, and any relevant details. We may need to verify your identity before processing the request.
Verification Required
We may ask you to verify your identity to protect against unauthorised access requests. We will not charge a fee for requests unless they are manifestly unfounded or excessive.
30-Day Response Time
We will acknowledge your request within 72 hours and provide a substantive response within 30 calendar days, in line with Article 12 GDPR requirements.
Right to Complain
If you are unsatisfied with our response, you have the right to lodge a complaint with ANSPDCP at dataprotection.ro.
Legal Framework
Our data processing practices comply with the following legal instruments:
EU GDPR 2016/679
The primary regulation governing personal data processing for all EU/EEA residents, applicable from 25 May 2018.
EU GDPR Regulation 2016/679
The EU General Data Protection Regulation establishing rules on the protection, processing and free movement of personal data.
ePrivacy Directive 2009/136/EC
Governing electronic communications, cookies, and direct marketing. Being updated to the ePrivacy Regulation (in progress).