Privacy Policy
Last updated: 18 September 2026
1. Data Controller
Source of Quality Solutions SRL (trading as "Carpathia Tech")
CUI: 46339200 · J12/3716/2022
Strada Alexandru Vaida Voevod, Nr. 68, Sc. 1, Et. 3, Ap. 11, Cluj-Napoca, Cluj, Romania
Email: [email protected]
2. Data We Collect
We collect only the data strictly necessary to provide our services:
Contact form
Name, email address, company (optional), and your message. This data is processed through our server and stored solely to respond to your inquiry.
Analytics data
Through Google Analytics and Meta Pixel we collect pseudonymous data about site usage (pages visited, traffic source, device, country). The session identifier does not contain your name, but it can be linked to a contact enquiry, as described below. These tools are activated only after you accept cookies via the consent banner.
Technical data
Our server may automatically log your IP address, browser type, and access time in server logs, necessary for security and troubleshooting.
Enquiries via WhatsApp, email or phone
When you press a contact button, we record a random reference of the form CT-8F3K — the same one that appears in the prefilled message — together with the page you left from, the button's text, the site language, and the campaign parameters you arrived with (utm_source, utm_medium, utm_campaign and the referring page). Your session's Google Analytics identifier is added only if you accepted analytics cookies. We do not record your name, phone number or the content of your message: those stay in the app you write to us in. The reference is a random token, not something derived from you. Ordinary external links, such as ANPC or SOL, are not recorded.
If you accepted analytics cookies, the button press is also sent to Google Analytics as an event, together with the reference, the page, the button's text and the campaign parameters. And if your enquiry later becomes an offer or a contract, we send that outcome to Google Analytics as well — the stage (offer sent, contract signed), the estimated or actual value in euros, the reference and the campaign parameters — linked to the Google Analytics identifier recorded at the click. That is how we learn which pages and campaigns bring clients, not just clicks. Meta Pixel receives only the standard contact event, without the reference.
3. Purpose and Legal Basis
Responding to inquiries — we process contact form data to reply to your message (legal basis: legitimate interest, Art. 6(1)(f) GDPR).
Web analytics and advertising — we use Google Analytics and Meta Pixel to understand traffic and measure ad performance (legal basis: consent, Art. 6(1)(a) GDPR).
Website functionality — essential cookies (language preference, consent state) are required for the site to function properly (legal basis: legitimate interest, Art. 6(1)(f) GDPR).
Contact enquiries — we record a press of a contact button so that we can answer the enquiry you started and know which page and which campaign produced it (legal basis: legitimate interest in handling a commercial enquiry you initiated, Art. 6(1)(f) GDPR). The Google Analytics identifier is added to that record only on the basis of your consent (Art. 6(1)(a) GDPR); on the same consent we also send the outcome of the enquiry (offer, contract) and its value to Google Analytics.
4. Cookies
We use the following cookies:
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| carpathia_cookie_consent | Carpathia Tech | Stores your cookie preference | Persistent |
| i18n_redirected | Carpathia Tech | Stores your language preference | Persistent |
| ct_ref | Carpathia Tech | Stores the contact enquiry reference (CT-XXXX) | 90 days |
| cw_attribution | Carpathia Tech | The campaign parameters you arrived with (utm) and the referring page; stored only after you accept cookies | 90 days |
| _ga, _ga_* | Web analytics — traffic and behaviour | 2 years | |
| _fbp | Meta | Advertising — conversion measurement | 3 months |
Analytics and advertising cookies (Google Analytics, Meta Pixel) are activated only after you accept via the consent banner. You can change your preference at any time by clearing your browser cookies.
5. Third-Party Processors
Your data may be processed by the following third-party providers:
Google Ireland Limited — Google Analytics, for web analytics and for measuring the outcome of contact enquiries (offer, contract), as described in section 2. Google Privacy Policy
Meta Platforms Ireland Limited — Meta Pixel, for ad conversion measurement. Meta Privacy Policy
Slack Technologies (Salesforce) — Notifications from the contact form, the fit questionnaire and contact button presses (reference, page, button text, language and traffic source) are delivered via Slack. Slack Privacy Policy
All processors are GDPR-compliant and process data within the EU/EEA or under adequate safeguards (Standard Contractual Clauses).
6. Data Retention
Contact form data is kept for the duration necessary to respond to your inquiry and deleted within 12 months. Google Analytics data is retained according to Google's settings (default 14 months). Meta Pixel cookies expire after 3 months.
Contact enquiry records are deleted automatically after 24 months if they did not become a contract. Those that did become a contract are kept for 10 years from the date they were marked as such, because they are the record of that contract and of the related accounting obligations, and are then deleted automatically. The ct_ref cookie in your browser expires after 90 days.
7. Your Rights
Under the GDPR, you have the following rights:
- Right of access — you may request a copy of your personal data.
- Right to rectification — you may request correction of inaccurate data.
- Right to erasure — you may request deletion of your data.
- Right to restriction of processing.
- Right to data portability.
- Right to withdraw consent at any time (without affecting the lawfulness of prior processing).
To exercise any right, contact us at [email protected]. We will respond within 30 days.
If you are unsatisfied with how we process your data, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.
8. Data Security
We use encrypted HTTPS connections, secure servers, and restricted access to protect your data. However, no internet transmission is 100% secure.
9. Changes to This Policy
We reserve the right to update this policy. The last updated date is shown at the top of the page. We recommend checking this page periodically.