Privacy Policy

2. What data we collect and why

2.1 Analytics (only if you consent)

We use Google Tag Manager to load Google Analytics on our Site. If you accept analytics cookies in our cookie banner, we collect:

• Pages visited, time on site, referring pages
• Approximate location (derived from IP address)
• Device and browser type

Legal basis: Consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via the "Cookie settings" link in the footer.

Third party: Google Ireland Limited processes this data. Data may be transferred to Google servers outside the EEA, including the US, under the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

Retention: 60 months

2.2 Contact form and email signup

When you submit our contact form or sign up for our newsletter, we collect:

• Name (if provided)
• Email address
• The content of your message

Legal basis: Consent (Art. 6(1)(a)) when you sign up for emails, and legitimate interest or pre-contractual steps (Art. 6(1)(b)/(f)) when you contact us with a question.

Third party: We use Resend to send and manage these emails. Resend may process and store this data on our behalf, including transfers outside the EEA (covered by Standard Contractual Clauses).

Retention: We keep this data for 60 months, or until you ask us to delete it / unsubscribe.

3. Cookies

See our [Cookie Policy / cookie banner] for a full list of cookies used on the Site and how to manage your preferences.

4. Your rights under GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict how we use your data
• Object to processing based on legitimate interest
• Data portability — receive your data in a portable format
• Withdraw consent at any time, without affecting past processing

To exercise any of these rights, contact us at info@oncaworks.com. We will respond within one month as required by GDPR.

You also have the right to lodge a complaint with your local data protection authority. In Romania, this is:

Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București
anspdcp.ro

5. Data security

We take reasonable technical and organizational measures to protect your data against unauthorized access, loss, or misuse. No method of transmission over the internet is 100% secure.

6. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be highlighted on the Site.