Privacy Policy
In force from 12 November 2026, version 1.0
1. Who we are
This is a translation; if it differs from the Romanian version, the Romanian version prevails.
This policy tells you what personal data we process when you use the ayt.ro website and the AYT hosting services, why we process it, how long we keep it and what rights you have under Regulation (EU) 2016/679 ("GDPR") and Law no. 190/2018.
Controller: DCA ENGINEERING HUB SRL, registered office com. Miroslava, sat Valea Adâncă, str. Vulturilor nr. 4, cam. 1, Iași County, Romania, J22/3502/2022, tax ID (CUI) 46816709, phone +40 786 565 579.
Data protection contact: [email protected]. Send any request about personal data to this address. We have not appointed a data protection officer (DPO).
2. Two different roles
- We are the controller for data about you as a visitor of ayt.ro, an account holder or a customer: name, email, billing data, tickets, security logs. Most of this policy is about that data.
- We are the processor (Art. 28 GDPR) for the personal data you host in the websites and email accounts of your hosting account. Examples: the orders, comments or users of a WordPress site, the messages in mailboxes. For that data, you are the controller. The terms are summarised in section 11. If you visit a website hosted at AYT, contact the owner of that website.
3. What data we process, why and on what basis
| Data | Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|---|
| Name, email, password (we store it only in cryptographic form, as a hash), two-factor authentication data | Creating and managing the ayt.ro account, signing in, messages about the account and services | performance of the contract (b) |
| Billing profile: name or company name, tax ID (CUI), address, Trade Register number and the result of the tax ID check with ANAF or VIES | Invoicing, accounting records, RO e-Factura | legal obligation (c); performance of the contract (b) |
| Payment data: amount, date, payment status, card type, last digits of the card and the identifiers received from Stripe. For bank transfers: the payer's name and the account the payment came from | Collecting payments, automatic renewal, refunds | performance of the contract (b); legal obligation (c) |
| The order and acceptance of the terms: version of the terms, date and time, the request to start the service immediately | Proof that the contract was concluded and that you made the request required by GEO no. 34/2014 | legal obligation (c); legitimate interest (f) |
| Hosting usage logs: website access and error logs, email logs, resource usage | Operating the service, diagnosing problems, preventing abuse | performance of the contract (b); legitimate interest (f) |
| Security logs: IP address, browser, successful and failed sign-ins | Security of accounts and servers, fraud prevention | legitimate interest (f) |
| Support tickets and emails you send us, including complaints | Answering requests, solving problems, handling complaints | performance of the contract (b); legal obligation (c) |
| Contact form messages: name, email, message, IP address | Answering your question | legitimate interest (f); steps prior to entering into a contract (b) |
| Status page subscriptions: email address | Notices about incidents and maintenance | consent (a) |
| Reports of illegal content and appeals | Obligations under Regulation (EU) 2022/2065 on digital services | legal obligation (c) |
| Technical signals for the anti-bot check (Cloudflare Turnstile): IP address, browser characteristics | Protecting forms against bots and abuse | legitimate interest (f) |
| Browsing data collected through Google Analytics | Statistics on how the website is used | consent (a), only if you accept analytics cookies |
We do not sell personal data and do not use it for personalised advertising.
Automated decisions. We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The exceptions below are necessary for the performance of the contract (Art. 22(2)(a) GDPR) or for security:
- we suspend the hosting account at expiry if the renewal is not paid, and delete it after 14 days, under the Terms and Conditions;
- we delete the free account after 37 days without a sign-in, after warning you by email at 30 and 35 days;
- we automatically block attack or abusive traffic (firewall, rate limits, blocking IP addresses), run the anti-bot check and isolate files detected as malware.
You can ask at any time for a person to review the decision, express your point of view and contest the decision. Write to [email protected] or open a ticket.
4. Who we share data with
| Recipient | What it does | Where |
|---|---|---|
| Data centres in the European Union | Host the servers we run | EU |
| Stripe Payments Europe, Limited | Processes card payments and keeps the card data | Ireland; transfers to Stripe, Inc. (USA), under section 5 |
| Oblio (oblio.eu) | Issues invoices and sends them to RO e-Factura | Romania |
| Cloudflare, Inc. | DNS and proxy for ayt.ro (traffic to ayt.ro passes through the Cloudflare network) and the Turnstile anti-bot check | global network, under section 5 |
| Our transactional email provider | Sends emails about the account, orders, invoices, tickets and status | EU |
| Google Ireland Limited (Google Analytics) | Statistics on how the website is used, only with your consent | EU, with possible transfers to Google LLC (USA), under section 5 |
| ANAF and VIES (European Commission) | RO e-Factura and verifying companies' tax IDs | Romania / EU |
| Our accountant or accounting firm | Keeps the accounting records | Romania |
| Public authorities | Receive data only when the law requires us to | Romania |
All providers are bound by contract to protect the data.
5. Transfers outside the European Economic Area
We host data in the European Union. The exceptions are data processed by Stripe, by Cloudflare and, only if you accept analytics cookies, by Google. For these transfers we rely on the standard contractual clauses adopted by the European Commission. Where the provider is certified, we also rely on the EU-US Data Privacy Framework.
6. How long we keep data
| Data | Period |
|---|---|
| Financial and accounting documents (invoices, proformas, payment records) | 10 years, under accounting law |
| The ayt.ro account, the billing profile and support tickets | while the account exists and for a reasonable period after it is closed |
| Proof of acceptance of the terms and of the request for immediate start | for the duration of the contract and, after it ends, as long as it may be needed as evidence |
| Data in the hosting account (websites, databases, email) | until the hosting account is deleted, under the Terms and Conditions; in backups, until the plan's retention period expires |
| Hosting usage logs and security logs | about 90 days |
| Contact form messages | 2 years |
| Unconfirmed status page subscriptions | 7 days |
| Confirmed status page subscriptions | until you unsubscribe |
7. Your rights
You have the right to request access to your data, its rectification, erasure, restriction of processing and portability. You can object to processing, including processing based on legitimate interest. You can withdraw your consent at any time, and the withdrawal does not affect the processing carried out before. Send your request to [email protected]. We reply within one month.
You can also lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.
8. Security
We encrypt traffic (TLS) and store passwords only as hashes. We use two-factor authentication, a firewall and malware scanning. Hosting accounts are isolated from one another. We make daily backups, and administrative access follows the principle of least privilege.
9. Minors
The AYT services are for people aged at least 18. We do not knowingly collect data about minors.
10. Cookies
You can read more about cookies in the Cookie Policy.
11. The data you host: summary of the data processing agreement
For the personal data you host in the websites and email accounts of your hosting account, you are the controller and we are the processor (Art. 28 GDPR). In short, the terms are:
| Element | Description |
|---|---|
| Subject matter | Hosting and technically operating the websites, databases and email accounts in your hosting account |
| Duration | The duration of the contract, until the hosting account is deleted; for backups, until the plan's retention period expires |
| Nature | Storage, copying for backup, network transmission, restoration, security scanning, deletion |
| Purpose | Only providing the hosting services |
| Categories of data and data subjects | You determine them through the websites and email accounts you host (for example your customers, subscribers or website visitors). We do not check the content |
We undertake:
- to process the data only on your documented instructions (the contract, the settings in the control panel and written instructions you give us later) and to tell you if an instruction breaches the law;
- to make sure the persons authorised to process the data keep it confidential;
- to apply the security measures in section 8;
- to use sub-processors (the EU data centres that host the servers) only if they have equivalent data protection obligations, and to notify you before any change so that you can object;
- to help you, as far as we can, with data subject requests and with the obligations in Art. 32 to 36 GDPR;
- to notify you of any security breach that affects this data without undue delay and within 48 hours of discovering it; you, as controller, notify the authority and the data subjects;
- to delete the data when the contract ends, under the Terms and Conditions;
- to give you the information you need to check that we meet these obligations.
Hosted data stays in the European Union. We send you the full data processing agreement if you ask for it at [email protected].
12. Changes
We publish every new version on this page, with its effective date. We notify you by email of significant changes, with a summary and the reason for them.