Website: mindiaries.com
Operator (Data Controller): individual (Romania, EU)
Hosting provider: Romarg (server location: Romania)

The purpose of this Privacy Policy is, based on Regulation (EU) 2016/679 (GDPR), as well as the data protection rules applicable in Romania related to electronic communications (in particular the provisions on cookies), to explain what personal data the Data Controller processes when operating the website, for what purposes, on what legal basis, for how long, and what rights data subjects have. The basis of Romanian cookie regulation is Law no. 506/2004. The website has a magazine/blog nature (marketing, digital world, film/books, public life, pop culture, lifestyle, mental health), and may also contain entertaining, fictional content (The literary works (books, short stories) on the website may contain age-restricted, erotic scenes. Viewing such content is recommended only for adults. By opening the content, the user declares that they have acknowledged the warning.) The nature of the content does not change the fact that personal data may be processed during the technical operation of the website and during user functions.

1.Definitions

Personal data: any information relating to an identified or identifiable natural person (GDPR Article 4).
Data subject: the website visitor, commenter, person initiating contact, and the logged-in user.
Data Controller: the party who determines the purposes and means of processing (in this case, the Operator).
Processor: the party who processes data on behalf of the Data Controller (e.g., hosting, analytics/advertising provider).
Cookie: a small data file stored in the browser, which may be technically necessary or used for statistical/marketing purposes.

2. Identification and contact details of the Data Controller

Data Controller (Operator): Ujfalusi Alexandra – individual
Registered office / mailing address: Fughiu, Bihor, Romania
E-mail (data protection contact): office@mindiaries.com
Data Protection Officer (DPO): based on the nature of the activities, the Data Controller is generally not required to appoint a DPO. If one is appointed, their details will be indicated here.

3. Principles of processing

The Data Controller processes personal data in accordance with the GDPR principles:
lawfulness, fairness, transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability.

4. Categories of data subjects

This Notice applies in particular to the following categories of data subjects:
Website visitors (readers, browsers)
Commenters
People initiating contact (form, e-mail)
Logged-in users (e.g., Google account login)

5. Processing activities in detail (purpose, data categories, legal basis, duration, recipients)

5.1. Server logs and technical operation (hosting/server)

Purpose:
operating the website, troubleshooting, ensuring system stability; IT security; preventing/detecting unauthorized access and attacks.

Processed data (typically):
IP address; browser type, version, user-agent; technical data indicating the operating system; visit time, requested resource (URL), response codes; possible errors, system messages.

Legal basis:
legitimate interest (GDPR Article 6(1)(f)) – secure operation of the website.

Retention period:
generally short, for the period defined by the provider/configuration (e.g., days-weeks); in the event of a security incident, for as long as necessary to investigate the event.

Recipients / access:
hosting provider (processor)
the Data Controller (with administrative access)
Google (data logger)

5.2. Security logging and brute force protection (Wordfence)

The website uses a security plugin: Wordfence.

Purpose:
preventing brute force (password-guessing) attacks; filtering and blocking malicious traffic; protecting the login interface and admin environment. (The nature of brute force protection is also described in Wordfence documentation.)

Processed data (typically):
IP address; time and frequency of failed login attempts; technical identifiers of the browser/client (e.g., user-agent); blocking events, security log entries.

Legal basis:
legitimate interest (GDPR Article 6(1)(f)) – protection of the website and users, abuse prevention.

Retention period:
security logs and blocks for as long as necessary, according to the plugin settings;
in the event of an incident, for as long as needed for investigation and legal claims.

Consequence if processing is prohibited:
security logging is essential to protect the service; the website’s admin functions cannot be safely operated without logging.

5.3. Cookie consent management (CookieYes / Complianz)

The website uses a cookie banner and consent management solution: CookieYes and/or Complianz.

Purpose:
managing consent by cookie categories; proving that non-essential cookies are activated only after obtaining appropriate consent; remembering preferences.

Processed data (typically):
consent status (accepted/rejected categories); timestamp (when it was given/withdrawn); consent identifier (consent ID) or similar technical identifier;
language setting; in some cases an IP address in hashed/shortened form (settings-dependent) to prove consent.

Legal basis:
legitimate interest (GDPR Article 6(1)(f)) – accountability and compliance (e.g., proving consent); where the consent log is expressly necessary to comply with a legal obligation: GDPR Article 6(1)(c) (compliance obligations).

Romanian cookie regulatory principle (particularly important):
In Romania, placing/reading non-technically necessary cookies is subject to prior, informed consent under Law no. 506/2004. Based on Romanian supervisory authority practice, it may be sanctionable if non-essential cookies are activated before consent. Under GDPR, consent must be “freely given, specific, informed and unambiguous” – this is detailed in European Data Protection Board guidance.

Retention period:
the consent log for the configured period and/or as long as necessary to enforce legal claims. 6-12 months, excluding session cookies, which are deleted immediately when leaving the website.

5.4. Language preference cookie (Polylang)

The website is multilingual; Polylang may use a cookie to remember the selected language (HU/RO/EN).

Purpose:
remembering the language selected by the user and displaying the website accordingly.

Processed data:
language preference (e.g., “hu”, “ro”, “en”) in cookie form.

Legal basis:
legitimate interest (GDPR Article 6(1)(f)) to ensure user experience and functionality;
in certain cases it may be considered an “explicitly requested service” (language selection), and thus may qualify as technically necessary.

Retention period:
according to the cookie lifetime (6-12 months, excluding session cookies, which are deleted immediately when leaving the website), or until the user deletes it.

5.5. Performance and caching (LiteSpeed)

The website may use LiteSpeed Cache for speed optimization.

Purpose:
speeding up page loading, resource optimization; efficient delivery of images and static content.

Processed data (typically):
technical cookies/cache identifiers; device/browser compatibility indicators.

Legal basis:
legitimate interest (GDPR Article 6(1)(f)) – ensuring service quality; if it uses only technically necessary cookies, consent may not be required.

Retention period:
until the cache/cookie expires or is deleted (from a few hours to a few days)

5.6. Analytics: Google Site Kit + Google Analytics (GA4)

The website integrates Google Analytics (GA4) measurement via Google Site Kit.

Purpose:
creating traffic statistics; improving content and user experience; analyzing website usage patterns (in aggregated, typically pseudonymized form).

Processed data (typically, depending on settings):
cookie identifiers / measurement identifiers; pageviews, events (e.g., scroll, clicks – if configured); device and browser data; approximate geographic data (e.g., region-level); source/medium campaign data (if UTM parameters exist).

IP address processing (GA4):
According to Google information, GA4 does not log and does not store IP addresses, and for EU users it drops IP addresses before logging. The Data Controller assumes no responsibility in this regard, as Google LLC is a private-type enterprise and the Data Controller can access its storage and logging policies only partially.

Legal basis:
consent (GDPR Article 6(1)(a)) – statistical cookies / analytics only after consent.

Retention period:
according to Google Analytics data retention settings: [e.g., 2 months / 14 months / custom] (defined by the Data Controller; to be specified here).

Recipients / processor:
Google provider (processing roles are settings-dependent; Google systems are involved during measurement).

Withdrawal of consent:
at any time in cookie settings; after withdrawal, analytics does not run (depending on technical implementation, further data collection stops).

5.7. Advertising: Google AdSense

The website may display Google AdSense ads.

Purpose:
displaying ads; generating revenue; measuring ad performance, frequency capping, fraud prevention; (with consent) personalized ads.

Processed data / technologies (typically):
third-party cookies; advertising identifiers, device identifiers; ad display and interaction data; interest inferences (profiling) – in the case of personalized ads; cross-site information: Google and its partners may, via cookies, be able to show ads based on the user’s previous visits, including by taking into account browsing on other websites.

Highlighted information – cross-site tracking:
Google AdSense help explicitly states that third-party providers, including Google, may use cookies to serve ads based on a user’s prior web visits, including on other websites.

Legal basis:
consent (GDPR Article 6(1)(a)) – marketing/advertising cookies, personalized ads;
in the absence of consent, only solutions that lawfully operate without non-essential cookies may be used (depending on actual settings).

Automated decision-making / profiling:
in the case of personalized ads, profiling may occur (interest categories). You can withdraw your consent at any time and request the termination of marketing processing.

Retention period:
for the period defined by advertising cookies and AdSense/Google settings (may also be determined by a third party). Standard advertising cookies: Typically remain valid for 13 months (approx. 390-400 days). This is Google’s global setting, consistent with Chrome’s 400-day technical limit.

Conversion measurement cookies:

These are shorter-lived, often stored for only 30 days.
Non-personalized ads: Even if you turn off personalization, Google may use “frequency capping” cookies so you do not see the same ad too often. Their expiration also varies, but is generally short-term.

5.8. Social login: Nextend Social Login (Google account)

The website may allow login with a Google account via Nextend Social Login.

Purpose:
user identification and easier login; creating/managing a user account.

Processed data (based on data received from the Google API):
name; e-mail address; profile picture (avatar). The Data Controller does not store passwords.

Legal basis:
performance of a contract / provision of a service (GDPR Article 6(1)(b)) – processing necessary to provide the login function; for additional technologies (e.g., non-essential cookies) consent.

Retention period:
for as long as the user account exists, and until the deletion request is fulfilled;
security logs for as long as necessary.

Deletion / unlinking:
the user may request deletion of their account and thereafter does not use login; managing permissions on the Google account page may also be relevant.

5.9. Comments

Purpose:
publishing and moderating comments; community interaction; preventing and handling abuse, spam, and unlawful content.

Processed data:
name (display name or provided name); e-mail address (not public, for administrative purposes); comment content; technical data (e.g., IP address, browser identifier) – especially for abuse prevention and security purposes (if the system records it). Not public.

Legal basis:
consent (GDPR Article 6(1)(a)) – by submitting the comment; legitimate interest (GDPR Article 6(1)(f)) – moderation, abuse prevention, protection of legal claims.

Retention period:
for as long as the comment is displayed, or until deletion/moderation;
in the event of legal claims, for as long as necessary.

5.10. Contact (form / e-mail)

Purpose:
responding to inquiries; communication and case handling; handling possible complaints.

Processed data:
name; e-mail address; message content; technical data related to communication (e.g., sending time).

Legal basis:
consent (GDPR Article 6(1)(a)) – voluntary submission of an inquiry; legitimate interest (GDPR Article 6(1)(f)) – handling complaints and legal claims.

Retention period:
until the case is closed, then at most for the necessary period aligned with limitation periods for legal claims.

6. Cookies and similar technologies – legal framework and operation

6.1. When is consent required?

In Romania, placing/reading non-technically necessary cookies is, as a general rule, subject to prior consent under Law no. 506/2004. Romanian authority practice also shows that it may be sanctionable if non-essential cookies are activated before consent.

6.2. What cookies may be present on the website?

They appear by category in the website’s cookie manager interface (CookieYes/Complianz), typically:
Essential cookies: security, basic operation, load management, cache
Preference cookies: language (Polylang)
Statistical cookies: GA4 (only with consent)
Marketing cookies: AdSense (only with consent)

6.3. Consent requirements

Under GDPR, consent must be an unambiguous, informed, specific, and freely given decision; European Data Protection Board guidance details this.

Accordingly:
non-essential cookies must not be activated in advance; the user must be given a real choice (accept / reject / settings); consent can be withdrawn at any time.

7. Processors, recipients, data transfers

7.1. Processors (typically)

hosting provider: Romarg
security: Wordfence (plugin, logging)
analytics/ads: Google Analytics, Google AdSense, Google Site Kit

7.2. Transfers outside the EU (Google services)

For Google services, it may occur that the processing of personal data involves recipients/servers outside the EU/EEA. Google’s international data transfer mechanisms include relevant transfer frameworks and – in some cases – contractual safeguards. Standard Contractual Clauses (SCC) are a general EU mechanism to support the lawfulness of transfers outside the EU/EEA.

8. Limitation of liability for third-party service providers

To operate and finance the website, we use third-party services, in particular hosting services (Romarg) and services provided by Google (especially: Google AdSense, Google Analytics / Site Kit). These providers operate under their own technical, business, and data processing rules. The Operator does not accept liability for the availability, interruptions, or errors of third-party providers’ systems, nor for content provided by those providers (in particular: ad content, offers, landing pages), nor for any damages arising from the use of or access to third-party services. This provision does not affect the Operator’s obligation to provide the relevant privacy and cookie information about third-party services used on the website and, where necessary, to manage consent lawfully.

9. Data security

The Data Controller applies appropriate technical and organizational measures to prevent unauthorized access, alteration, disclosure, destruction, in particular:
protecting admin access, permissions management;
brute force protection, logging, blocking;
updates, backups (configuration-dependent);
incident response procedures.

10. Data subject rights (GDPR Articles 12-22)

You have the following rights:

Right of access (what data we process about you)
Right to rectification (correction of inaccurate data)
Right to erasure (“right to be forgotten”) – subject to legal conditions
Right to restriction of processing
Right to data portability (if applicable)
Right to object (especially against processing based on legitimate interest)
Withdrawal of consent (at any time; processing before withdrawal remains lawful)
Lodging a complaint with a supervisory authority
Submitting requests: office@mindiaries.com
Response deadline: as a general rule within 1 month (under GDPR, may be extended in justified cases).

11. Right to complain in Romania

10.1. Data protection complaint (supervisory authority: ANSPDCP)

For lodging a complaint related to the processing of personal data, the procedure of the Romanian supervisory authority applies; the authority informs data subjects about the method and conditions for submitting a complaint.

10.2. Consumer-protection type complaints (ANPC)

If the data subject’s question/complaint is expressly consumer-protection related (e.g., commercial practices, consumer-protection assessment of advertising/commercial communication), the consumer protection authority (ANPC) contact details and online case-handling interface may be relevant.
(This document is primarily a data protection notice.)

12. Minors

The literary works (books, short stories) on the website may contain age-restricted, erotic scenes. Viewing such content is recommended only for adults. By opening the content, the user declares that they have acknowledged the warning.
The website is not specifically intended for minors. If a minor nevertheless contacts us or uses an account, age and consent requirements under GDPR and relevant Romanian rules apply. (If in the future a feature or campaign specifically aimed at minors appears on the website, this Notice will be updated accordingly.)

13. Amendments to the Notice

The Data Controller is entitled to amend this Notice, in particular in the event of legal changes, the introduction of a new feature/plugin, or changes to data processing processes. The version in force will be published on the website, indicating the “Effective” date.

13.1 Liability disclaimer regarding content

Disclaimer of liability for decisions resulting from use of the content
Articles, posts, opinions, guides, tool and software recommendations, and marketing/business-related content published on the website are for general informational purposes only and do not constitute individualized professional advice (in particular legal, financial, tax, investment, or business management advice).
Users make decisions and take actions based on information on the website entirely at their own responsibility. To the fullest extent permitted by law, the Operator does not accept liability for any direct or indirect damage, lost profit, financial loss, or business loss resulting from the use, application, or misinterpretation of information published on the website.