privacy.

01 Who is responsible.

Robert Vîja, a natural person resident in Bucharest, Romania, is the data controller for any personal data processed through robertvija.com. There is no company behind this site. For any privacy question, complaint, or rights request, email robert@robertvija.com.

Because data processing on this site is small-scale and not part of a commercial activity, I am not legally required to appoint a Data Protection Officer. I handle privacy questions personally.

02 What I collect and why.

Newsletter subscribers. When you submit the newsletter form, I collect:

• your email address
• the timestamp of the submission
• the page the form was submitted from (the source field)
• a record that you ticked the consent box (the GDPR audit trail)

Legal basis: your explicit consent under GDPR Art. 6(1)(a), which you give by ticking the consent box. Purpose: to send you the newsletter described next to the consent box, and nothing else. I do not enrich, profile, or score subscribers; I do not sell, rent, or share the list with anyone.

Contact email. If you email me at robert@robertvija.com, your message, email address, and any attached information sit in my inbox while the conversation is active. Legal basis: legitimate interest under GDPR Art. 6(1)(f) in being able to reply to people who contact me.

Technical logs. Vercel, the hosting provider, keeps short-lived server logs (IP address, user agent, requested path, timestamp) for operational and security reasons. These are not used to build a profile of you and are deleted on Vercel’s standard rotation. Legal basis: legitimate interest under GDPR Art. 6(1)(f) in keeping the site online and protected from abuse.

Google Analytics 4. If you accept statistics cookies, Google Analytics records aggregated traffic data (pages visited, country, device class, session activity) under the GA4 property G-8WJ0KXYD22. The site uses Google Consent Mode v2 with all consent categories set to denied by default; Cookiebot updates this state to granted only for the categories you accept. Ads data redaction is enabled and URL passthrough is disabled. Legal basis: your consent under GDPR Art. 6(1)(a).

Cookies and tracking. See section 03 for the full list, or visit /cookies for the live, always-current declaration generated by Cookiebot.

I do not run any other analytics, advertising pixels, fingerprinting, A/B testing tools, session recording, or AI chat tracking on this site.

03 Cookies and tracking.

On your first visit, Cookiebot shows a consent banner. Until you choose, no statistics or marketing cookies are set, and Google Analytics runs with Consent Mode v2 in its all-denied default state. Klaviyo’s onsite script does not load at all until you accept marketing cookies. The table below lists the main cookies; the live, always-current declaration lives at /cookies.

You can change your mind any time. Visit /cookies and use the renew link at the bottom of the declaration to re-open the banner and update your choice.

04 How long I keep things.

• Newsletter subscribers: until you unsubscribe, at which point Klaviyo suppresses the record and no further emails are sent. The suppressed record is retained only to honour the opt-out and prove the unsubscribe was processed.
• Inbox messages: kept as long as the conversation is active, deleted when no longer relevant. Tax-relevant correspondence is kept for the period required by Romanian law.
• Cookie consent record: 1 year, after which the banner reappears.
• Technical logs: Vercel’s standard rotation (typically a few days to a few weeks).

05 Who else sees your data.

The following service providers process data on my behalf as GDPR processors:

• Klaviyo (US) delivers the newsletter and powers the onsite tracking that loads only after you accept marketing cookies.
• Google (US/Ireland) provides Google Analytics 4 with Consent Mode v2. Data is processed only for the consent categories you accept; anonymous, all-denied pings may still be sent for aggregate measurement when consent is not granted.
• Cookiebot (Usercentrics, EU) runs the consent banner, stores your consent choice in the CookieConsent cookie, and propagates the state to Google and Klaviyo.
• Vercel (US) hosts the site and keeps the short-lived technical logs described above.

Transfers to providers based in the United States rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework as supplementary safeguards.

Data is not sold, rented, or shared for advertising purposes. I do not share data with third parties beyond the processors above, except where required by law.

06 Security.

The site runs over HTTPS only. Newsletter submissions travel over a TLS-encrypted connection to Klaviyo. The Klaviyo private API key used by the server stays on the server (it is never exposed to the browser). Klaviyo and Vercel each commit to industry-standard security practices in their privacy policies linked above.

No system is perfectly secure. If you suspect your data has been exposed, email me immediately so I can investigate and notify the Romanian Data Protection Authority within 72 hours if required.

07 Children.

This site is not directed at children under 16, and I do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe a child has subscribed to the newsletter, email me and I will delete the record.

08 Automated decision-making.

I do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Klaviyo’s engagement metrics may inform which segment of subscribers receives a given email, but no consequential decision about you is made automatically.

09 Your rights.

Under the GDPR, you have the right to:

• access the personal data I hold about you
• have it corrected if wrong
• have it erased
• restrict how it is processed
• object to processing based on legitimate interest (the technical logs and reply-to-emails cases above)
• receive a copy in a portable, machine-readable format
• withdraw any consent you have given, at any time, without affecting the lawfulness of processing carried out before the withdrawal
• lodge a complaint with the Romanian Data Protection Authority, ANSPDCP, at dataprotection.ro

To exercise any right, email robert@robertvija.com from the email address tied to the data so I can verify the request. I respond within 30 days, and usually within a few. There is no fee unless the request is manifestly unfounded or excessive, in which case the GDPR permits a reasonable charge or refusal.

To unsubscribe from the newsletter, use the one-click unsubscribe link in any email. You may also reply asking to be removed and I will do it manually.

10 Managing cookie consent.

Visit /cookies to see the live cookie inventory and use the renew link at the bottom of the declaration to re-open the Cookiebot banner and change your choice. Most browsers also let you delete cookies directly through their settings.

11 Whether providing data is required.

Nothing on this site requires you to give me personal data. You can read every page without submitting anything. If you choose not to subscribe to the newsletter, the only consequence is that I cannot email you. If you choose to reject cookies, the only consequence is that the newsletter follow-up engagement tracking does not work for you.

12 Changes to this policy.

If this policy changes in any material way, the new version is posted here with an updated date at the top. For minor wording or formatting fixes, the date is the only thing that moves. I do not re-trigger consent for non-material changes.

13 Contact.

Robert Vîja / Bucharest, Romania / robert@robertvija.com