Last updated 3 November 2026
Privacy and cookies
This notice explains what personal data Nvision Data Solutions SRL processes across nvision-data.com, our communication channels, and our self-hosted social publishing service at social.nvision-data.com, why we process it, and how you can exercise your rights.
Who is responsible (Data Controller)
Nvision Data Solutions SRL, a Romanian limited liability company registered with the Trade Registry under no. J40/4857/07.05.2020, tax identification number (CUI) RO42482410, is the data controller for the processing described on this page.
Because our scale and core activities do not require the mandatory appointment of a Data Protection Officer under Article 37 GDPR, privacy enquiries, Data Subject Requests (DSRs), and opt-outs are handled directly by Andy Nastasa at andy@nvision-data.com or +40 750 404 005. We answer verified Data Subject Requests within 30 days.
Project briefs, direct contact, and interactive demos
When you email or call us, we process your name, contact details, company information, and message to reply and, if we work together, to prepare a commercial proposal and contract. The legal basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Article 6(1)(f) GDPR).
When you submit a project brief on nvision-data.com (/api/enquiries), we store your email address, selected services, project goal, indicative budget preference, preferred timing, and page locale (en or ro) in a private Supabase database table (nvision_enquiries) so we can review and respond. A unique request reference (UUID) and SHA-256 payload hash prevent duplicate submissions. To protect the endpoint against automated abuse, a signed time-bound challenge token and a keyed hash of the request IP address support temporary hourly rate limits (up to 5 requests per IP hash and 100 globally per hour); the stored enquiry record does not contain your raw IP address.
The measurement readiness self-check keeps your answers inside the current browser page and generates its plain-text download locally on your device without sending answers to our servers. The Looker Studio demonstration report, when available, connects to Google only after you choose to load it and uses synthetic demonstration data. Preparing or copying an email message in your browser does not transmit data to our servers unless you submit the brief or send the email.
WhatsApp Business intake
When you message our WhatsApp Business number, Meta's WhatsApp Cloud API forwards the message event to our webhook (/api/whatsapp). After verifying Meta's cryptographic signature, we store inbound messages addressed to our number in a private Supabase database table (nvision_whatsapp_messages): the WhatsApp message ID (wamid), your sender phone number / WhatsApp ID (wa_id), your WhatsApp profile name (if provided), message type, text body (up to 4,096 characters), and message timestamps. Delivery and read status updates are ignored.
If we have not recorded a message from your WhatsApp number in the preceding 24 hours, our webhook sends a single bilingual automated acknowledgement reply through the Meta Graph API confirming receipt before we follow up personally. The legal basis is taking steps at your request before a contract (Article 6(1)(b) GDPR) and our legitimate interest in acknowledging and answering enquiries (Article 6(1)(f) GDPR).
Website analytics and measurement cookies
The site uses Vercel Web Analytics to count page views in aggregate without setting cookies or persistent user identifiers. The legal basis is our legitimate interest in understanding aggregate website traffic and performance (Article 6(1)(f) GDPR).
On our production domain (nvision-data.com), Google Tag Manager (GTM-K6S29LNK) loads with Google Consent Mode v2 default states set to denied worldwide (analytics_storage, ad_storage, ad_user_data, and ad_personalization all start as denied, with ads_data_redaction enabled). Before you make a choice in the banner — or when you select Necessary only — Google tags send only cookieless pings without setting analytics or advertising cookies, and Hotjar does not load.
When you select Accept all in the consent banner, Google Analytics 4 (G-DP1PHWRNWY), Google Ads conversion tags, and Hotjar (site ID 6568853) set first-party measurement cookies and record how the site is used: pages viewed, clicks on contact and service links, device and browser type, and approximate geographic region. The legal basis is your consent (Article 6(1)(a) GDPR and Article 4(5) of Romanian Law no. 506/2004), which you can withdraw at any time via the Cookie settings button in the footer.
B2B outreach to businesses
We conduct business-to-business (B2B) research and outreach to companies using publicly available corporate and commercial information (such as public company registries, company websites, and published business contact details) together with technical observations of publicly accessible web pages (for example, checking whether a public website has working analytics or consent signals).
Every B2B outreach email is individually reviewed and hand-approved by a human before sending; we do not send unreviewed automated bulk mailings. The legal basis is our legitimate interest in B2B commercial communication and presenting relevant analytics and engineering services to businesses (Article 6(1)(f) GDPR).
Every business contact can object or opt out at any time by replying to the email or writing to andy@nvision-data.com. We honour opt-out requests immediately and keep only a minimal suppression entry so that no further outreach is sent to that address or domain.
Who else processes data (Processors and recipients)
We share personal data only with infrastructure and service providers acting as data processors under written data processing terms to run the service, or with external platforms when you or an authorized operator interact with them:
- Vercel Inc. — website hosting, edge delivery, and cookieless aggregate Vercel Web Analytics (processes technical request data such as IP addresses and HTTP headers to serve and protect nvision-data.com).
- Supabase, Inc. — managed PostgreSQL database infrastructure providing private database storage for website enquiries, inbound WhatsApp messages, and operational records.
- Resend, Inc. — transactional email delivery for operational notifications and hand-approved business correspondence.
- Oracle Corporation (Oracle Cloud Infrastructure, EU home region) — cloud compute and storage hosting our self-hosted Postiz instance (https://social.nvision-data.com), its local PostgreSQL database, media uploads volume, and encrypted on-server backups (with Amazon Web Services EMEA SARL in the EU designated solely as a contingency fallback host if ever required, and Cloudflare, Inc. providing DNS and tunnel edge routing).
- Connected social media platforms (independent controllers) — when an authorized human operator publishes content from https://social.nvision-data.com, post data is transmitted via API to the connected platforms: LinkedIn Ireland Unlimited Company (LinkedIn API), Meta Platforms Ireland Limited (Meta Graph API for Facebook & Instagram), TikTok Technology Limited (TikTok API), and X Internet Unlimited Company / X Corp. (X API).
- Meta Platforms Ireland Limited — WhatsApp Business Cloud API for receiving and acknowledging inbound WhatsApp messages, and Meta Graph API for connected Facebook and Instagram pages.
- Google Ireland Limited — Google Tag Manager, Google Analytics 4, Google Ads conversion measurement (subject to your consent choice), and Looker Studio demonstration embeds (loaded only on request).
- Hotjar Ltd — website behaviour analytics (loaded only after you accept measurement cookies).
International data transfers
Our self-hosted Postiz server on Oracle Cloud is provisioned in a European Union home region. Where our processors or connected platforms (such as Vercel, Supabase, Resend, Cloudflare, Google, Meta, LinkedIn, TikTok, or X) process personal data outside the European Economic Area (EEA), including in the United States, transfers are safeguarded by European Commission adequacy decisions (such as the EU–U.S. Data Privacy Framework for certified US providers) and/or Standard Contractual Clauses (SCCs) under Article 46 GDPR, together with technical measures including TLS encryption in transit and restricted access controls.
How long we keep data
Website enquiries, WhatsApp messages, and direct email enquiries are retained while needed to reply, follow up, and manage any resulting collaboration; if no engagement follows, enquiry records are periodically reviewed and deleted when no longer needed (typically within 24 months). Hourly rate-limit windows (nvision_enquiry_rate_windows) are purged automatically after 24 hours.
Client contracts, accepted proposals, invoices, and accounting records are retained for the statutory periods required by Romanian accounting and tax law (Law no. 82/1991 and fiscal regulations, generally 5 to 10 years).
B2B outreach records are kept while relevant for legitimate business contact or until you object; if you opt out, we delete your outreach profile and keep only a minimal suppression record so we do not contact you again.
For first-party social scheduling on https://social.nvision-data.com: OAuth tokens and connected channel metadata are retained until channel disconnection and are purged immediately upon channel disconnection or a verified deletion request; post text, media, and aggregate post analytics are retained for 24 months; approval audit logs are retained for 36 months; owner account records in Postiz are kept for the life of the account plus 30 days; and encrypted on-server database backups on Oracle Cloud (EU region) follow a rolling 7-daily and 4-weekly retention schedule. Website analytics data is retained for the period set in our Google Analytics 4 property, and browser cookies expire as listed below.
Your GDPR rights and complaints to ANSPDCP
Under the General Data Protection Regulation (GDPR), you have the right to request access to your personal data (Article 15), rectification of inaccurate data (Article 16), erasure / deletion (Article 17), restriction of processing (Article 18), data portability (Article 20), and to object at any time to processing based on legitimate interests, including B2B outreach (Article 21). Where processing is based on your consent, you may withdraw that consent at any time via the Cookie settings button without affecting the lawfulness of processing before withdrawal (Article 7(3)). We do not carry out automated decision-making or profiling producing legal or similarly significant effects (Article 22).
To exercise any of these rights or submit a Data Subject Request (DSR), write to andy@nvision-data.com. We answer Data Subject Requests within 30 days (one month) in accordance with Article 12(3) GDPR.
You also have the right to lodge a complaint with the Romanian data protection supervisory authority — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania, website dataprotection.ro, email anspdcp@dataprotection.ro — or with the supervisory authority in the EU member state of your habitual residence or place of work.
- Step-by-step data deletion and social token revocation instructions
Explains how to request erasure by email and how to revoke OAuth access on LinkedIn, Meta (Facebook & Instagram), TikTok, and X.
Social media publishing (https://social.nvision-data.com)
We operate a self-hosted instance of Postiz on Oracle Cloud infrastructure (European Union home region) for first-party social scheduling on https://social.nvision-data.com to prepare, schedule, and publish social media content for our own brands and pages we administer (such as nVision Data and Spotivibly, in separate brand workspaces).
When an authorized operator connects a social media account or page via OAuth, our Postiz instance processes data received via the LinkedIn API (Sign In with LinkedIn using OpenID Connect, Share on LinkedIn, and Community Management API), Meta Graph API (Facebook & Instagram — Facebook Login for Business, Facebook Pages API, and Instagram Graph API), TikTok API (Login Kit and Content Posting API), and X API (OAuth and X API v2):