Privacy Policy.

1. Who we are

The data controller is Digital Image Agency, headquartered at 52 Timișoara Blvd., Bucharest, Romania. For any questions about your data, contact us at office@digitalimage.agency.

2. What data we collect

• Data you send us directly: name, email, phone number, message content — when you contact us via the form on this site, email, WhatsApp, or phone.
• Technical access data: IP address, browser type, timestamp — automatically collected by our hosting provider (Vercel Inc.) for security, debugging, and abuse prevention.

We do not collect sensitive data (health, religion, political views, etc.). We do not use tracking or advertising cookies — see our Cookie Policy.

3. Why we use it

• To answer your questions and deliver contracted services.
• To operate and secure the site.
• To comply with legal obligations (tax, accounting, reporting).

4. Legal basis

• Performance of a contract — when we have a commercial relationship with you.
• Legitimate interest — to answer inquiries, operate the site, and protect it.
• Your consent — when you voluntarily send us briefs or other materials.
• Legal obligation — for accounting and tax records.

5. Who we share data with

We rely on third-party providers to operate the site and our services:

• Vercel Inc. (USA) — site hosting, under Standard Contractual Clauses for international data transfers.
• Sanity Inc. (USA) — our content management system (does NOT store personal data about site visitors).
• Our email provider (Google Workspace / Microsoft 365) — for correspondence.

We do not sell or share your data with third parties for marketing purposes.

6. Our Facebook and Instagram publishing app

For clients who ask us to publish their posts, we use our own Meta app, digitalimage-social. It works only with the Facebook Pages and Instagram accounts that clients have given us to manage.

What it receives from Meta:

• the list of Facebook Pages we manage, with each Page's ID, name and access token;
• the Instagram professional account linked to each Page: its ID and username;
• after each publication: the post ID, its status (published or error) and its permalink.

What it does with them: it publishes the posts and stories the client has approved, at the date and time in the editorial calendar, and checks that publishing succeeded. Nothing else.

What it does not do: it does not read messages, comments, reactions, follower lists or insights, and it does not collect data about people who see or comment on the posts. It does not use the data for advertising, profiling or any other purpose, and does not sell or hand it to anyone.

Where it is kept: Page access tokens are stored encrypted in the secret variables of the services that run the publishing (Vercel Inc. and GitHub, Inc., USA). Post IDs and publishing times are written to the client's editorial calendar, a Google Sheets document (Google LLC, USA). We keep them for as long as we work together; when the collaboration ends we delete the access tokens within 30 days.

How to revoke access and request deletion: you can remove the app at any time from your Page settings (Facebook → Settings → Business integrations) or from Meta Business Suite; from then on the app can neither publish nor read anything. To have us delete the data already stored (access tokens and the post IDs in the calendar), email office@digitalimage.agency with the Page name. We delete it within 30 days and confirm by email. Posts already published stay on your Page; you can delete them yourself on Facebook or Instagram.

7. How long we keep data

• Correspondence (email, forms): up to 3 years after last contact.
• Contract and invoice data: 10 years (Romanian tax requirement).
• Server access logs: ~30 days.

8. Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your data.
• Rectify inaccurate data.
• Erase data ("right to be forgotten").
• Restrict processing.
• Data portability.
• Object to processing.

To exercise these rights, write to office@digitalimage.agency. We respond within 30 days at the latest.

If you're not satisfied with how we handle your request, you may file a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

9. Changes

We update this policy occasionally. The current version is the one dated at the top. Important changes will be announced here and, when relevant, by email.