GDPR & Data Protection

This notice explains, in GDPR terms, how Cristian Marian Bursasiu PFA processes your personal data and what rights you have. It sits alongside our Privacy Policy — the Privacy Policy describes what we collect; this notice focuses on the legal framework (lawful bases, transfers, your rights, and how to complain).

1. Data controller

The data controller is Cristian Marian Bursasiu PFA, a sole trader (Persoană Fizică Autorizată) registered in Romania. We have not appointed a Data Protection Officer (we are not required to), but you can reach the person responsible for data protection at support@trackmaxima.com.

2. Lawful bases for processing

We only process personal data where we have a lawful basis under Article 6 (and Article 9 for special-category data) of the GDPR:

What we process	Purpose	Lawful basis
Waitlist email & platform preference	Tell you when a product launches	Consent — Art. 6(1)(a)
Account email & credentials (apps)	Provide the app you signed up for	Contract — Art. 6(1)(b)
Optional Nutrition Profile (body/health data)	Calculate your nutrition targets	Explicit consent — Art. 9(2)(a)
Subscription & trial status	Provide paid access and honour your trial	Contract — Art. 6(1)(b)
Security, abuse prevention, product improvement	Keep the Services safe and working	Legitimate interests — Art. 6(1)(f)
Accounting & legal record-keeping	Meet legal obligations	Legal obligation — Art. 6(1)(c)

Where we rely on consent, you can withdraw it at any time (see §4) — withdrawal does not affect processing already carried out.

3. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data — the “right to be forgotten” (Art. 17);
• Restrict processing in certain circumstances (Art. 18);
• Data portability — receive your data in a portable format (Art. 20);
• Object to processing based on legitimate interests, and to direct marketing at any time (Art. 21);
• Withdraw consent at any time where processing is based on consent (Art. 7(3));
• Not be subject to automated decision-making — we do not carry out automated decision-making or profiling that produces legal or similarly significant effects (Art. 22).

4. How to exercise your rights

• Waitlist: click unsubscribe in any email, or email us — we will remove you.
• Apps: use the in-product Export my data and Delete account features, or email us. Export does not require an active subscription — your right to portability is not conditioned on paying us.
• Anything else: contact support@trackmaxima.com.

We respond to requests without undue delay and within one month (extendable by two further months for complex requests, as Art. 12 allows). Exercising your rights is free unless a request is manifestly unfounded or excessive.

5. International data transfers

Your data is primarily processed within the EEA (our hosting and email delivery use EU regions). Where a sub-processor processes data outside the EEA, we rely on an adequacy decision or Standard Contractual Clauses (SCCs) with appropriate safeguards. Our sub-processors are listed in the Privacy Policy (Vercel, Resend/Amazon SES, Zoho Mail, Convex, RevenueCat, Apple/Google).

6. Retention

We keep personal data only as long as needed for the purpose it was collected:

• Waitlist email: until you unsubscribe or we close the waitlist.
• Account & app data: for as long as your account exists. We do not delete or expire your data because a subscription ended — in TrackMaxima Logger a lapsed subscription removes access to logging, not your logs, so that you can still export them and so they are intact if you resubscribe. Data is deleted or anonymised after account deletion, which is under your control, except where law requires us to retain certain records (e.g. accounting).

7. Cookies & tracking

This website uses no advertising cookies. The calculators run entirely in your browser and store nothing on our servers.

We show a one-time privacy notice on your first visit. When you accept it, we store a single flag in your browser’s local storage (not a cookie) so the notice does not reappear, and we load Vercel Web Analytics — a cookieless, aggregate page-view counter (no personal profiles, no cross-site tracking). If you dismiss without accepting, analytics does not load. Calculator inputs are never sent to analytics.

8. Right to complain

If you believe we have mishandled your data, you can lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro — or with the supervisory authority in your country of residence.

9. Contact

Cristian Marian Bursasiu PFA (Romania) — support@trackmaxima.com