Website privacy policy

For website visitors, version updated: 27 July 2026

This English version is provided for convenience. In case of any discrepancy, the Romanian version prevails.

1. The controller

PSK Solution SRL is the personal data controller as defined by EU Regulation 2016/679 (GDPR) and Law 190/2018 on the measures for applying the GDPR in Romania.

2. Scope

This policy applies to any person who visits the public pages of https://articole.psk.ro without being logged into an account, such as:

• The main page (homepage).
• The Client or Publisher account registration page.
• The login page.
• The public API documentation (/api/docs).
• The pages with legal information (terms, policies).

The policy does not cover activities inside the authenticated account; for those, see the Privacy policy for platform users.

3. Data collected while browsing

While you browse the website, we automatically collect the following categories of data:

• IP address, for the approximate identification of the country/region (geolocation at city level, no more precise).
• User-Agent: the browser type, operating system and device used.
• Pages accessed and the moment of access (timestamp).
• Referrer: the website from which you reached us (Google, social media, direct link).
• Browser language, for displaying the interface in your preferred language.
• Interactions: clicks, scrolling, time on page (through Google Analytics, if you accept analytics cookies).

If you fill in the account registration form (even without completing it), the data entered (email, phone, company name, tax ID) is processed according to the Privacy policy for platform users.

4. Cookies and similar technologies

The website uses cookies for basic operation (session, CSRF, locale) and for traffic analysis (if you accept). Full details about each cookie are in the Cookie policy.

On your first visit, a consent banner lets you accept or refuse non-essential cookies. You can change your preferences at any time through the link in the footer.

5. Purposes of processing

6. Legal basis (GDPR)

• Art. 6(1)(b), performance of a contract or pre-contractual steps (account registration).
• Art. 6(1)(c), legal obligation (keeping security logs, fraud prevention).
• Art. 6(1)(f), legitimate interest of the Controller (ensuring the operation of the website, security, anonymous aggregated statistics).
• Art. 6(1)(a), explicit consent, for analytics and marketing cookies (given through the banner).

7. Recipients and transfers

Browsing data may be accessed by:

• Infrastructure providers: Hostriver (cPanel hosting) and CloudFlare (CDN/DDoS), processing in the EU (Romania, Germany).
• Google LLC: Google Analytics and Google Tag Manager for traffic statistics, if you accept analytics cookies (transfer to the USA, under Standard Contractual Clauses + Data Privacy Framework).
• Meta Platforms Ireland Ltd.: Facebook Pixel for remarketing, if you accept marketing cookies (EU to USA transfer on the basis of SCC).
• Competent authorities, upon legal request from the police, prosecutors, courts or ANSPDCP.

We do not sell or rent your data to third parties for commercial purposes.

8. Retention period

9. Visitors' rights

Under the GDPR (art. 15-22), you have the following rights:

• Right of access (art. 15): to obtain confirmation that we process data about you and a copy of it.
• Right to rectification (art. 16): to correct inaccurate or incomplete data.
• Right to erasure (art. 17), the "right to be forgotten", under the conditions provided by the regulation.
• Right to restriction of processing (art. 18).
• Right to portability (art. 20): to receive the data in a structured, commonly used and machine-readable format.
• Right to object (art. 21): to object to processing based on legitimate interest.
• Right not to be subject to a decision based solely on automated processing (art. 22).
• Right to withdraw consent (art. 7(3)), at any time, for analytics and marketing cookies.

To exercise these rights, write to contact@psk.ro. We reply within 30 days (extendable by another 60 days for complex requests, with notice).

10. Data security

We implement reasonable technical and organizational measures to protect personal data:

• Enforced HTTPS on the whole website (HSTS preload).
• Security headers (X-Content-Type-Options, X-Frame-Options, Content-Security-Policy).
• Bcrypt hashing for passwords (adapted cost factor).
• Optional two-factor authentication (2FA).
• Anti-brute-force request rate limiting (throttling).
• Security logs with 12-month retention.
• Regular dependency updates (composer audit).

11. Complaint to ANSPDCP

If you consider that your rights have been violated, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing:

12. Changes to the policy

This policy may be changed periodically to reflect legislative changes or changes in our practices. The current version is indicated in the header ("Last updated"). Visiting the website afterwards amounts to acknowledging the changes.