Privacy Policy
Last updated:
This policy explains how we process personal data when you visit php2shell.ro, use the online site check or send us a request, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and Romanian Law no. 190/2018. This is a translation of the Romanian version; in case of any discrepancy, the Romanian version prevails.
1. Who the data controller is
Easy Media SRL
Calea Giulești 337B, Sector 6, Bucharest, Romania, postal code 060269
VAT: RO21295559 · Trade Reg.: J2024003967401
Email: [email protected] · Phone: +40 37 279 1997
We have not appointed a Data Protection Officer (DPO), as this is not mandatory in our case. For any question about your data, you can write to us at the address above.
2. What data we process, why and on what legal basis
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, company, email, phone (optional), website address, hosting type, requested service, urgency, message, online check result (if you ran one) | To answer you and prepare the contract, NDA and quote | Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract. For company representatives, Art. 6(1)(f): our legitimate interest in communicating with clients | 12 months from submission if no contract is concluded. Deletion is automatic. |
| Online site check | The website address you enter, your IP address (pseudonymised only) | Real-time analysis of the given site and abuse prevention (limiting the number of checks) | Art. 6(1)(f) GDPR: our legitimate interest in providing the service and protecting it against abuse | The website address is not stored. The IP is kept only as a keyed cryptographic hash and deleted after at most 24 hours. |
| Web server technical logs | IP address, date and time, page accessed, browser type | Security and operation of the site, incident investigation | Art. 6(1)(f) GDPR: our legitimate interest in keeping the site secure | At most 30 days |
| Client contracts | Identification and contact details of the client and contact persons, billing data | Performing the contract, invoicing, accounting records | Art. 6(1)(b) and (c) GDPR: performance of the contract and legal obligations (tax and accounting law) | For the duration of the contract and afterwards as long as required by accounting law and limitation periods |
Providing the form data is voluntary. Without an email and the website address we cannot answer your request.
3. Data on client servers (contract, NDA and DPA)
Before any check on your servers, any access to them or any intervention, we sign with you:
- a service agreement, setting out what we do, when and within which limits;
- a non-disclosure agreement (NDA), covering any information we have access to, including the vulnerabilities identified;
- a data processing agreement (DPA) under Art. 28 GDPR.
During the intervention we may have access to personal data of your customers or users (for example in the site's databases). For this data you are the controller and Easy Media SRL acts as a processor. We process it only on your documented instructions and only to the extent needed for the intervention. We do not copy it off the server unless you explicitly ask us to, and we delete any temporary copy when the work is finished. If we discover a personal data breach, we inform you without undue delay so you can assess the obligation to notify the supervisory authority within 72 hours.
4. Cookies and similar technologies
php2shell.ro does not use analytics or marketing cookies: no Google Analytics, no tracking pixels, no advertising networks. Fonts and all other resources are hosted on our own server, so your visit sends no data to third parties.
We use a single, strictly necessary item stored in your browser, which does not require consent under Art. 5(3) of Directive 2002/58/EC (ePrivacy) and Art. 4(5) of Romanian Law no. 506/2004:
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
php2shell_consent | Local storage (localStorage) | Remembers your cookie choice so we don't ask you on every visit | 6 months | Strictly necessary |
The optional categories (analytics and marketing) are disabled by default and currently contain no services. If we ever introduce such tools, we will add them to the table above and enable them only after you give your consent through the cookie banner. You can withdraw or change your consent at any time, as easily as you gave it.
You can delete stored data at any time from your browser settings (the “Privacy” or “Site data” section).
5. Who has access to the data
We do not sell or rent your data. It may only be received by:
- our web hosting and email providers, as processors, under contracts compliant with Art. 28 GDPR;
- our accounting, legal or tax advisers, when necessary and under a duty of confidentiality;
- public authorities, only when required by law.
6. Transfers outside the European Economic Area
Data is stored and processed in the European Union. We do not transfer your data outside the European Economic Area. If such a transfer becomes necessary, we will only make it with the safeguards provided by Chapter V of the GDPR (for example standard contractual clauses approved by the European Commission) and we will inform you.
7. Your rights
Under the GDPR, you have the following rights:
- right of access: to find out what data we hold about you and receive a copy (Art. 15);
- right to rectification: to correct inaccurate data (Art. 16);
- right to erasure: to request deletion of your data (Art. 17);
- right to restriction of processing (Art. 18);
- right to data portability: to receive your data in a structured format (Art. 20);
- right to object: to object to processing based on legitimate interest (Art. 21);
- right not to be subject to a decision based solely on automated processing (Art. 22). We make no such decisions: the online check only provides indicative information, with no legal effects on you.
To exercise your rights, write to us at [email protected]. We reply free of charge, within one month of receiving your request. We may ask for additional information to confirm your identity.
You also have the right to lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, postal code 010336, www.dataprotection.ro, [email protected], or with the supervisory authority in your EU country of residence.
8. How we protect data
- the site is available exclusively over HTTPS;
- requests are stored outside the site's public directory, with restricted access;
- we collect only the data we need: we do not store the IP address with your request, and for abuse prevention we only use a keyed hash;
- we automatically delete data when the retention period expires;
- access to client systems happens only after the contract, NDA and DPA are signed, through secure and logged channels.
9. Children
Our services are aimed at companies and individuals who manage websites or servers. We do not knowingly collect data about people under 16.
10. Changes
We may update this policy when our services or the law change. The date of the last update is shown at the top of the page. Significant changes will be announced on the site.