Legal
Privacy Policy
Version 2026-10-05 · Last updated: 5 October 2026
This policy explains what personal data we process when you use CyberXscore, why we process it, how long we keep it and what rights you have.
This English version is provided for convenience. If it differs from the Romanian version, the Romanian version prevails.
1. Who we are
CyberXscore (cyberxscore.ro, cyberxscore.com) is a free cybersecurity self-assessment tool aimed mainly at Romanian small and medium-sized businesses. It is developed in partnership with Babeș-Bolyai University.
The controller of your personal data under Regulation (EU) 2016/679 (“GDPR”) is:
- BITUP TECHNOLOGY S.R.L.
- Tax ID (CUI): RO42613248
- Trade Register No.: J12/1556/2020
- Registered office: Str. Lazăr Gheorghe nr. 60, Câmpia Turzii, jud. Cluj, 405100, România
- Email for personal data requests: [email protected]
We have not appointed a Data Protection Officer (DPO). You can send any data protection question to the address above.
In this policy, “we” means BITUP TECHNOLOGY and “you” means the individual using the platform, for example an owner or employee who completes the assessment on behalf of a company.
2. In short
- We use your data to calculate your score, send you the report and run your account (if you create one).
- The questionnaire does not ask for passwords or sensitive data.
- We fill in public company data from ANAF (the Romanian tax authority) based on the company tax ID (CUI). We use this data internally only. It is not shown to you or sent to anyone, including Meta.
- Meta Pixel and server-side events sent to Meta run only on cyberxscore.ro and only if you accept marketing cookies. We do not use Meta tools on cyberxscore.com.
- We do not sell your data.
- You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw your consent.
3. What data we process and where it comes from
3.1. Assessment answers (from you)
Your answers to questions about your company’s security practices (mostly yes/no). We do not ask for passwords, credentials or other sensitive information. If you have no account, the assessment is linked to a random session identifier kept in your browser (localStorage), so you can resume it.
3.2. The form at the end of the assessment (from you)
If you have no account, we ask for the following at the end of the assessment:
- first name and last name;
- company tax ID (CUI); the company name is filled in automatically from the public ANAF register;
- work email (free email addresses are accepted; we only record whether the address belongs to a free email provider);
- phone number (stored in international format);
- whether the company has an IT team (internal, outsourced or none);
- the date and time of your consent and the policy version in force at that time.
3.3. Public company data from ANAF (from public sources)
Based on the tax ID you enter, we retrieve from the public services of the Romanian National Agency for Fiscal Administration (ANAF) the company’s name, registration status and CAEN (activity) code. From its published annual financial statements, we also retrieve net turnover, the financial year and the average number of employees.
This is mainly data about the company, not about you. It may become personal data in some cases, for example when the entity is a sole trader or when it is linked to the form you submitted. We tell you about it under Art. 14 GDPR. We use it internally only, to assess the relevance of the request and to measure the effectiveness of our advertising campaigns (request segmentation). It is never shown to you and never shared with third parties, including Meta. We send only the tax ID to ANAF to run the lookup.
3.4. Results and report (generated by us)
Your overall score, scores per category and the recommendations generated from your answers. We email the PDF report to the address you provide. Results can also be reached through a unique, hard-to-guess link. Anyone who has the link can view the results, so only share it with people you trust.
3.5. User account (optional, from you)
If you create an account, we process your email address, your password (stored only as a bcrypt hash, never in plain text), your company name and your acceptance of the terms. We verify your email address and send password-reset emails when you ask for them. With an account you can redo assessments and see your history. Assessments and forms you submitted earlier with the same email are attached to your account only after the address is verified (or after you log in).
If you tick the separate opt-in box, we may email you security tips and product news. This is optional.
3.6. Technical and attribution data (collected automatically)
- the campaign parameters of the link that brought you to the site (UTM parameters) and the Meta click identifier (
fbclid), if present. Without consent to marketing cookies we only keep them in the page’s memory while you browse; with consent we also keep them in your browser (localStorage). They are stored with the form you submit; - your IP address and browser/device type (user-agent), stored with the form you submit;
- server logs needed to run and secure the platform.
3.7. Data processed through Meta tools (only with your consent)
On cyberxscore.ro, if you accept marketing cookies, we load the Meta Pixel on the assessment result page. It uses the _fbp and _fbc cookies. Only in that case, for some submitted forms, our server also sends a conversion event to Meta through the Meta Conversions API. The event contains your email, phone, first name and last name as SHA-256 hashes, an internal request ID, your IP address, your user-agent and the fbp/fbc values.
Hashing does not make the data anonymous: Meta can use it to match the data with accounts on its platforms. We do not send Meta your company’s turnover, number of employees, tax ID or your score.
Do you have to provide this data?
There is no legal obligation. Your answers are needed to calculate the score, and the form data is needed to send you the report. An account, informational emails and marketing cookies are optional. You can still use the assessment if you decline them.
4. Purposes and legal bases
For each purpose we list the data used and the legal basis under Art. 6(1) GDPR.
Running the assessment, calculating the score, showing results and sending the PDF report
- Data:
- answers, form data, results, session token / results link
- Legal basis:
- Art. 6(1)(b): steps taken at your request and provision of the service under our Terms. Where you act on behalf of a company, we also rely on our legitimate interest (Art. 6(1)(f)) in providing the service the company requested.
Creating and running your account (email verification, password reset, assessment history)
- Data:
- email, password hash, company name, terms acceptance, assessments
- Legal basis:
- Art. 6(1)(b): performance of a contract (Terms of Use)
Contacting you about your request and assessment result
- Data:
- name, email, phone, company, results
- Legal basis:
- Art. 6(1)(b) and (f): steps at your request / our legitimate interest in following up on requests from companies. You can object at any time.
Assessing the relevance of the request and internal segmentation of requests
- Data:
- public ANAF company data, CAEN code, email type (free or not), whether there is an IT team
- Legal basis:
- Art. 6(1)(f): our legitimate interest in organising our B2B commercial activity
Internal measurement of advertising campaign effectiveness (attribution)
- Data:
- UTM parameters, fbclid, request segment
- Legal basis:
- Art. 6(1)(f): our legitimate interest in understanding which campaigns bring relevant requests
Meta Pixel and Meta Conversions API (ad measurement and optimisation)
- Data:
- _fbp/_fbc cookies, hashed data (email, phone, name), internal ID, IP, user-agent
- Legal basis:
- Art. 6(1)(a): your consent, collected through the cookie banner (and Art. 4(5) of Romanian Law no. 506/2004)
Emails with security tips and product news
- Data:
- Legal basis:
- Art. 6(1)(a): your consent, given by ticking the dedicated box
Platform security and preventing abuse and fraud (e.g. rate limiting)
- Data:
- IP address, user-agent, server logs, account data
- Legal basis:
- Art. 6(1)(f): our legitimate interest in protecting the platform and its users (and Art. 32 GDPR)
Proof of consent and of acceptance of the terms
- Data:
- consent date and time, policy version
- Legal basis:
- Art. 6(1)(c) together with Art. 7(1) GDPR: the obligation to be able to demonstrate consent
Handling requests from data subjects and authorities; defending legal claims
- Data:
- data relevant to the request
- Legal basis:
- Art. 6(1)(c): legal obligations; Art. 6(1)(f): establishing, exercising or defending legal claims
5. Who receives the data
We do not sell or rent your data. The platform and its database run on our own infrastructure, in the BITUP private cloud, in Romania, so the data is not hosted by a third-party hosting provider. It may be received only by:
- Resend, Inc. (United States), the provider that delivers the report and the email-confirmation and password-reset emails, as a processor. It receives only what is needed for delivery: the email address, the name, the message content and the attached PDF report. See the Resend privacy policy.
- ANAF, which receives only the tax ID you enter so we can query the public register.
- Cloudflare, Inc. (USA), through which the site's traffic passes: it protects the platform against attacks and delivers the pages, so it sees your IP address and the requests made to the site, as a processor. Cloudflare also checks, through Turnstile, that the forms (assessment result, account sign-up, log-in, forgotten password) are submitted by a human rather than a bot, based on technical signals from your browser, without advertising profiling. Basis: our legitimate interest in protecting the platform and its users (art. 6(1)(f) GDPR). See the Cloudflare privacy policy.
- Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, D04 X2K5, Ireland), only if you accepted marketing cookies. For collecting data through the Meta Pixel on our site and transmitting it to Meta, we and Meta may be joint controllers (Art. 26 GDPR; CJEU judgment in Case C-40/17, Fashion ID). Our respective responsibilities are set out in the Meta Controller Addendum: we are responsible for informing you and obtaining your consent. Meta’s further processing (for example, delivering and measuring ads) is Meta’s own responsibility under the Meta Privacy Policy. Data sent through the Conversions API is processed by Meta under its Business Tools terms. You can exercise your rights with us or directly with Meta.
- Public authorities (courts, law enforcement, ANSPDCP), only where the law requires it.
- Professional advisers (e.g. lawyers, auditors) bound by confidentiality, only where necessary.
Access to the admin panel and platform data is restricted to the operator’s authorised staff.
6. Transfers outside the European Economic Area
The platform server and database are located in Romania. Our email provider, Resend, Inc., is based in the United States: the data needed to send an email (address, name, content and attachment) is transferred under the Standard Contractual Clauses approved by the European Commission in Decision (EU) 2021/914 (Art. 46 GDPR), included in the Resend Data Processing Addendum.
Cloudflare, Inc. is based in the USA: the technical data of requests (IP address, requests, Turnstile check signals) may be processed outside the EEA, under the standard contractual clauses in the Cloudflare Data Processing Addendum.
Data collected through Meta tools (only with your consent) may be transferred to Meta Platforms, Inc. in the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, which is covered by a European Commission adequacy decision (Art. 45 GDPR). For transfers outside that framework, Meta uses the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR). See the Meta Privacy Policy for details.
7. How long we keep data
| Data category | Retention period |
|---|---|
| Anonymous assessments that were not finished or had no form submitted | 6 months from last activity, then deleted or anonymised |
| Form data, linked assessments and results, ANAF data, attribution parameters, IP and user-agent stored with the form | 24 months from your last interaction with us (e.g. last assessment or last email exchange), unless you ask for earlier erasure |
| Account data and assessments in the account | While the account is active. After account deletion: up to 30 days. Accounts inactive for 36 months may be deleted after prior email notice |
| Proof of consent and of acceptance of the terms | For the duration of the processing plus 3 years (the general limitation period), so we can defend legal claims |
| Email verification and password-reset links | Until used or expired |
| Server logs | Up to 30 days, except logs needed to investigate a security incident |
| Cookies and local storage | See the table in section 11 |
| Data received by Meta | According to Meta’s policy |
When these periods end, the data is deleted or irreversibly anonymised (for example, for aggregate statistics). Deleted data may remain for a short time in backups, if any, until they are overwritten.
8. Your rights
Under Articles 15–22 GDPR, you have the right to:
- Access: find out what data we hold about you and get a copy of it.
- Rectification: have inaccurate data corrected or incomplete data completed.
- Erasure (“right to be forgotten”): have your data deleted where the law allows. You can also delete your account and the associated data yourself, at any time, from your account page (History), using your password.
- Restriction of processing: for example, while we check whether your data is accurate.
- Data portability: receive the data you gave us, processed on the basis of contract or consent, in a structured, commonly used format (e.g. JSON or CSV).
- Object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest, including relevance assessment and request segmentation. If you object to direct marketing, we will stop that processing unconditionally.
- Withdraw consent at any time, without affecting the lawfulness of earlier processing. For marketing cookies (Meta Pixel / Conversions API), use the cookie banner settings or delete the cookies in your browser. For informational emails, use the unsubscribe link or write to us.
- Not be subject to a decision based solely on automated processing (see section 9).
To exercise your rights, write to [email protected]. We reply without undue delay and within one month of receiving your request. For complex or numerous requests, this may be extended by two further months, and we will let you know. Exercising your rights is free of charge. To protect your data, we may ask for information to confirm your identity, for example asking you to write from the email address you used on the platform.
You also have the right to lodge a complaint with the supervisory authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, cod poștal 010336, București, România, [email protected], www.dataprotection.ro. Please contact us first, so we can try to resolve the issue directly.
9. Automated decisions and profiling
The security score and recommendations are calculated automatically from your answers. They are for information only and do not produce legal effects or similarly significantly affect you.
Internal segmentation of requests (based on public ANAF data and the form information) helps us organise our work and measure campaigns. It does not lead to any decision with legal or similar effects on you and does not limit access to the service. You can object to it (section 8).
10. Data security
We apply technical and organisational measures appropriate to the risk, including:
- encrypted connections (HTTPS) between your browser and the platform;
- passwords stored only as hashes (bcrypt);
- short-lived HttpOnly authentication cookies;
- rate limiting to prevent abuse;
- access control: the admin panel is restricted to the operator’s authorised staff;
- results links based on random, hard-to-guess identifiers.
No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will inform you as required by Art. 34 GDPR.
12. Children
The platform is intended for businesses and the people who represent them. It is not directed at children under 16, and we do not knowingly collect their data. If you learn that a minor has sent us data, write to us and we will delete it.
13. Changes to this policy
We may update this policy when the platform or the law changes. The current version is always published on this page with its last-updated date. We will tell you about significant changes through the platform or by email. If a change requires your consent, we will ask for it again.
14. Contact and complaints
For any question or request about your personal data, write to [email protected] or to BITUP TECHNOLOGY’s registered office: Str. Lazăr Gheorghe nr. 60, Câmpia Turzii, jud. Cluj, 405100, România.
You can lodge a complaint with ANSPDCP (www.dataprotection.ro), as described in section 8.