Last updated: 18.08.2026
We consider safeguarding the right to the protection of personal data a fundamental commitment of SMARKETING LAB TEAM S.R.L. We therefore dedicate all the resources and efforts necessary to process your data in full compliance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”), as well as with any other legislation applicable in Romania. Since transparency is one of the essential principles of this legal framework, we have prepared this document to inform you how we collect, use, transfer and protect your personal data when you interact with us in connection with our products and services, including through our website.
We reserve the right to update and amend this Privacy Policy periodically, in order to reflect any changes in the way we process your personal data or any changes in legal requirements. In the event of any such amendment, we will publish the amended version of the Privacy Policy on our website, which is why we ask you to check the content of this Privacy Policy from time to time.
Who we are and how you can contact us
SMARKETING LAB TEAM S.R.L. is a legal entity managed by Pană Adrian and Eugeniu Topolschi as administrators.
As we are always open to hearing your views and to providing you with any additional information you may need regarding the processing of your data, we encourage you to contact us at info@smarketinglab.eu or by post or courier at Bucharest, strada Amilcar C. Sandulescu nr. 6-10, tronson A, et.1, ap.17, sector 6, Romania.
What categories of personal data we process
In general, we collect your personal data directly from you, so that you remain in control of the type of information you provide to us. By way of example, we receive information from you as follows:
When you request certain information, you send us: your e-mail address, telephone number, first name and last name;
We may also collect and subsequently process certain information about your behaviour while visiting our website, in order to personalise your online experience and to provide you with offers tailored to your profile. We invite you to find out more in this respect by consulting the section on the purposes of processing below.
On our website we may store and collect information in cookies and similar technologies, in accordance with the Cookie Policy.
We do not collect or otherwise process sensitive data, which the General Data Protection Regulation includes in the special categories of personal data. We also do not wish to collect or process data relating to minors under the age of 18.
What the purposes and legal grounds for processing are
We will use your personal data for the following purposes:
To provide services for your benefit
This general purpose includes the ability to get in touch with you in order to send you any necessary information.
In addition, certain processing operations falling under these purposes are required by applicable legislation, including tax and accounting legislation.
1. To improve our services
We constantly strive to offer you the best online booking experience. To this end, we may collect and use certain information about your behaviour as a Client, we may invite you to complete satisfaction surveys after an order is completed, or we may carry out market studies and research, either directly or with the help of partners.
We base these activities on our legitimate interest in carrying out commercial activities, always taking care that your fundamental rights and freedoms are not affected.
2. For marketing
We want to keep you informed about the best offers for the services you are interested in. To this end, we may send you any type of message (such as: e-mail/SMS/telephone/mobile push/web push/etc.) containing general and thematic information, information about products similar or complementary to those you have purchased, and information about offers or promotions. In order to provide you with information of interest to you, we may use certain data about your behaviour as a client (for example, photographs viewed). We always ensure that this processing is carried out in compliance with your rights and freedoms and that decisions taken on this basis have no legal effects on you and do not similarly affect you to a significant extent.
In certain situations, we may base our marketing activities on our legitimate interest in promoting and developing our commercial activity. In any situation in which we use information about you for a legitimate interest of ours, we take care and adopt all necessary measures so that your fundamental rights and freedoms are not affected. Nevertheless, you may ask us at any time, by the means described above, to stop processing your personal data for marketing purposes, and we will comply with your request.
3. To defend our legitimate interests
There may be situations in which we use or disclose information in order to protect our rights and our commercial activity. These may include:
– Measures to protect the website against cyber attacks;
– Measures to prevent and detect attempted fraud, including the transmission of information to the competent public authorities;
– Measures to manage various other risks.
The general basis for these types of processing is our legitimate interest in defending our commercial activity, it being understood that we ensure that all the measures we take guarantee a balance between our interests and your fundamental rights and freedoms.
In addition, in certain cases we base our processing on legal provisions, such as the obligation to ensure the security of goods and valuables provided for by the applicable legislation in this area.
How long we keep your personal data
The contact details of persons who request offers from us are kept for 3 years from the last interaction, or longer if a legal obligation requires it (for example, accounting documents, 10 years under tax legislation). You may ask us at any time to delete certain information or to close your account, and we will comply with such requests, subject to the retention of certain information even after the account is closed, in situations where applicable legislation or our legitimate interests require it.
To whom we transmit your personal data
Where applicable, we may transmit or grant access to certain of your personal data to the following categories of recipients:
– courier service providers;
– payment/banking service providers;
– marketing/telemarketing service providers;
– market research service providers;
– insurance companies;
– IT service providers;
– other companies with which we may develop joint programmes for offering our goods and services on the market.
Where we are under a legal obligation, or where it is necessary in order to defend a legitimate interest, we may also disclose certain personal data to public authorities.
We ensure that access to your data by third parties governed by private law takes place in accordance with the legal provisions on data protection and confidentiality of information, on the basis of contracts concluded with them.
To which countries we transfer your personal data
At present, we store and process your personal data in Romania.
Nevertheless, we may transfer certain of your personal data to entities located in the European Union or outside the Union, including to countries for which the European Commission has not recognised an adequate level of personal data protection.
We will always take measures to ensure that any international transfer of personal data is carefully managed in order to protect your rights and interests. Transfers to service providers and other third parties will always be protected by contractual commitments and, where appropriate, by other safeguards, such as the standard contractual clauses issued by the European Commission.
You may contact us at any time, using the contact details set out above, to find out more about the countries to which we transfer your data, as well as the safeguards we have put in place in respect of those transfers.
How we protect the security of your personal data
We are committed to ensuring the security of personal data by implementing appropriate technical and organisational measures, in accordance with industry standards.
Your personal data is transmitted using state-of-the-art encryption algorithms and we store it on secure servers, while also ensuring data redundancy.
Despite the measures taken to protect your personal data, we draw your attention to the fact that the transmission of information over the Internet in general, or through other public networks, is not completely secure, and there is a risk that data may be seen and used by unauthorised third parties. We cannot be held responsible for such vulnerabilities in systems that are not under our control.
What rights you have:
The General Data Protection Regulation grants you a number of rights in relation to your personal data. You may request access to your data, the correction of any errors in our records and/or you may object to the processing of your personal data. You may also exercise your right to lodge a complaint with the competent supervisory authority or to bring the matter before the courts. Where applicable, you may also benefit from the right to request the erasure of your personal data, the right to restriction of processing of your data and the right to data portability.
More information about each of these rights can be obtained by consulting the table presented below.
In order to exercise your rights, you may contact us using the contact details set out above. Please note the following aspects if you wish to exercise these rights:
Identity. We take the confidentiality of all records containing personal data seriously. For this reason, please send us your requests regarding such records using the e-mail address smarketing.agency.ro@gmail.com. Otherwise, we reserve the right to verify your identity by requesting additional information intended to confirm your identity.
Fees. We will not charge a fee for you to exercise any right in respect of your personal data, unless your request for access to information is unfounded, repetitive or excessive, in which case we will charge a reasonable amount in such circumstances. We will inform you of any fees applied before dealing with your request.
Response time. We aim to respond to any valid request within a maximum of one month, unless the matter is particularly complicated or you have made several requests, in which case we will respond within a maximum of two months. We will let you know if we need more than one month. We may ask you whether you can tell us exactly what you wish to receive or what concerns you. This will help us act more quickly and shorten the response time to your request.
Third-party rights. We do not have to comply with a request where doing so would adversely affect the rights and freedoms of other data subjects.
Rights concerned. Description. Access. You may ask us:
- to confirm whether we process your personal data;
- to provide you with a copy of that data;
- to give you other information about your personal data, such as the data we hold, what we use it for, to whom we disclose it, whether we transfer it abroad and how we protect it, how long we keep it, what rights you have, how you can make a complaint, and where we obtained your data from, to the extent that the information has not already been provided to you through this notice.
Rectification You may ask us to rectify or complete your inaccurate or incomplete personal data. We may seek to verify the accuracy of the data before rectifying it.
Erasure of data You may ask us to erase your personal data, but only where:
- it is no longer necessary for the purposes for which it was collected; or
- you have withdrawn your consent (where the processing was based on consent); or you exercise a legal right to object; or it has been processed unlawfully; or we are under a legal obligation to do so.
We are not obliged to comply with your request to erase your personal data where the processing of your personal data is necessary: for compliance with a legal obligation; or for the establishment, exercise or defence of a legal claim. There are certain other circumstances in which we are not obliged to comply with your erasure request, although these two are the most likely circumstances in which we might refuse such a request.
Restriction of processing You may ask us to restrict the processing of your personal data, but only where:
- its accuracy is contested (see the rectification section), to allow us to verify its accuracy; or the processing is unlawful, but you do not want the data to be erased; or it is no longer necessary for the purposes for which it was collected, but you need it in order to establish, exercise or defend a legal claim; or
- you have exercised your right to object, and verification of whether our rights prevail is ongoing.
We may continue to use your personal data following a restriction request where:
- we have your consent; or in order to establish, exercise or defend a legal claim.
Data portability You may ask us to provide you with your personal data in a structured, commonly used and machine-readable format, or you may request that it be “ported” directly to another data controller, but in each case only if: the processing is based on your consent or on the conclusion or performance of a contract with you; and the processing is carried out by automated means.
Objection You may object at any time, on grounds relating to your particular situation, to the processing of your personal data based on our legitimate interest, where you consider that your fundamental rights and freedoms prevail over that interest. You may also object at any time to the processing of your data for direct marketing purposes (including profiling), without giving any reason, in which case we will cease such processing as soon as possible.
Automated decision-making You may request not to be subject to a decision based solely on automated processing, but only where that decision:
- produces legal effects concerning you; or similarly affects you in another way and to a significant extent.
This right does not apply where the decision reached through automated decision-making: is necessary for us to enter into or perform a contract with you; is authorised by law and adequate safeguards exist for your rights and freedoms; or is based on your explicit consent.
Complaints You have the right to lodge a complaint with the supervisory authority regarding the processing of your personal data. In Romania, the contact details of the data protection supervisory authority are as follows: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, postal code 010336, Bucharest, Romania. Telephone: +40.318.059.211 or +40.318.059.212; E-mail: anspdcp@dataprotection.ro. Without prejudice to your right to contact the supervisory authority at any time, we ask you to contact us beforehand, and we promise that we will make every effort to resolve any issue amicably.
Processing of data from advertising platforms
SMarketing Lab manages advertising campaigns on behalf of its clients on the Meta (Facebook and Instagram) and Google platforms. To deliver these services we use our own applications, connected to the application programming interfaces (APIs) of these platforms.
What data we process.
From the advertising accounts and pages that our clients make available to us, our applications read exclusively aggregated advertising performance data: amounts spent, impressions, clicks, results and cost per result, the structure of campaigns, ad groups and ads, the identifiers of pages and Instagram accounts, as well as the content and number of interactions of posts published by the client’s page itself.
What we do NOT process.
Our applications do not read or store personal data about the people who see the ads or interact with them: we do not collect names, e-mail addresses, telephone numbers or the content of contact forms through these interfaces.
In what capacity.
For this data, our client remains the data controller: they own the advertising account and the page, and we administer them on their behalf, as a processor, exclusively for the purpose of the contracted services.
Where the data goes.
Performance data is written to Google Sheets files hosted in SMarketing Lab’s Google Workspace, which only the company’s employees and the client to whom the data belongs can access. Google acts as a storage service provider. We do not sell, license or transfer this data to any other third party, and we do not use it for any purpose other than reporting to the client whose account it comes from and managing that client’s advertising.
How long we keep it.
Advertising performance data is kept for the duration of the contract with the client and for 12 months after its termination, in order to allow comparisons between periods. At the client’s request, we delete it sooner.
Security.
Access to the platforms is carried out through system accounts created in Business Manager, with rights limited strictly to our clients’ accounts. Access keys are stored encrypted, on equipment controlled by the company, and are rotated periodically.
Erasure requests.
Any client or data subject may request the erasure of data by writing to info@smarketinglab.eu. We respond within a maximum of 30 days.
We remind you that you can contact us at any time regarding data protection by sending your request through any of the following means:
– by e-mail at: info@smarketinglab.eu or
– by post or courier at: Bucharest, strada Amilcar C Sandulescu nr 6-10, et. 1, ap 17, sector 6, Romania.
The company SMARKETING LAB TEAM S.R.L. is registered with the Romanian National Supervisory Authority for Personal Data Processing under no. 12335 of 21/07/2022.
