GDPR & Data Protection
Last updated: July 14, 2026
This notice explains, in GDPR terms, how Cristian Marian Bursasiu PFA processes your personal data and what rights you have. It sits alongside our Privacy Policy — the Privacy Policy describes what we collect; this notice focuses on the legal framework (lawful bases, transfers, your rights, and how to complain).
1. Data controller
The data controller is Cristian Marian Bursasiu PFA, a sole trader (Persoană Fizică Autorizată) registered in Romania. We have not appointed a Data Protection Officer (we are not required to), but you can reach the person responsible for data protection at support@trackmaxima.com.
2. Lawful bases for processing
We only process personal data where we have a lawful basis under Article 6 (and Article 9 for special-category data) of the GDPR:
| What we process | Purpose | Lawful basis |
|---|---|---|
| Waitlist email & platform preference | Tell you when a product launches | Consent — Art. 6(1)(a) |
| Account email & credentials (apps) | Provide the app you signed up for | Contract — Art. 6(1)(b) |
| Optional Nutrition Profile (body/health data) | Calculate your nutrition targets | Explicit consent — Art. 9(2)(a) |
| Accountability partner status (Logger, Premium) | Share a daily status with a partner you choose | Consent — Art. 6(1)(a) |
| Security, abuse prevention, product improvement | Keep the Services safe and working | Legitimate interests — Art. 6(1)(f) |
| Accounting & legal record-keeping | Meet legal obligations | Legal obligation — Art. 6(1)(c) |
Where we rely on consent, you can withdraw it at any time (see §4) — withdrawal does not affect processing already carried out.
3. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you (Art. 15);
- Rectify inaccurate or incomplete data (Art. 16);
- Erase your data — the “right to be forgotten” (Art. 17);
- Restrict processing in certain circumstances (Art. 18);
- Data portability — receive your data in a portable format (Art. 20);
- Object to processing based on legitimate interests, and to direct marketing at any time (Art. 21);
- Withdraw consent at any time where processing is based on consent (Art. 7(3));
- Not be subject to automated decision-making — we do not carry out automated decision-making or profiling that produces legal or similarly significant effects (Art. 22).
4. How to exercise your rights
- Waitlist: click unsubscribe in any email, or email us — we will remove you.
- Apps: use the in-product Export my data and Delete account features, or email us.
- Anything else: contact support@trackmaxima.com.
We respond to requests without undue delay and within one month (extendable by two further months for complex requests, as Art. 12 allows). Exercising your rights is free unless a request is manifestly unfounded or excessive.
5. International data transfers
Your data is primarily processed within the EEA (our hosting and email delivery use EU regions). Where a sub-processor processes data outside the EEA, we rely on an adequacy decision or Standard Contractual Clauses (SCCs) with appropriate safeguards. Our sub-processors are listed in the Privacy Policy (Vercel, Resend/Amazon SES, Zoho Mail, Convex, RevenueCat, Apple/Google).
6. Retention
We keep personal data only as long as needed for the purpose it was collected:
- Waitlist email: until you unsubscribe or we close the waitlist.
- Account & app data: while your account is active; deleted or anonymised after account deletion, except where law requires us to retain certain records (e.g. accounting).
7. Cookies & tracking
This website uses no advertising cookies. The calculators run entirely in your browser and store nothing on our servers.
We show a one-time privacy notice on your first visit. When you accept it, we store a single flag in your browser’s local storage (not a cookie) so the notice does not reappear, and we load Vercel Web Analytics — a cookieless, aggregate page-view counter (no personal profiles, no cross-site tracking). If you dismiss without accepting, analytics does not load. Calculator inputs are never sent to analytics.
8. Right to complain
If you believe we have mishandled your data, you can lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro — or with the supervisory authority in your country of residence.
9. Contact
Cristian Marian Bursasiu PFA (Romania) — support@trackmaxima.com