Privacy Policy
Last updated: 16 October 2026This Privacy Policy explains how TURN IT LABS SRL ("Turn It Labs", "we", "us") processes personal data when you visit turnitlabs.com, contact us, do business with us, or when data relating to you is processed as part of our audience data services. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR"), Romanian Law no. 190/2018 and other applicable data protection laws.
1. Data controller
The controller responsible for the processing of personal data described in this policy is:
- Company name
- TURN IT LABS SRL
- Trading name
- Turn It Labs
- VAT
- OR46917738
- Registered address
- St. Mihail Sebastian, Nr. 37C, Bucharest, Romania
- mngt@turnitlabs.com
- Website
- turnitlabs.com
For any question about this policy or about how we handle personal data, you can contact us at mngt@turnitlabs.com.
2. Data we process
2.1 Website visitors
When you visit our website, our hosting infrastructure automatically processes technical data needed to deliver the website securely: IP address, date and time of the request, requested page, browser type and version, operating system and referring URL. These server logs are kept for a limited period for security and troubleshooting purposes. We do not use analytics or advertising cookies on this website and we do not build visitor profiles from your use of it.
2.2 People who contact us
When you contact us by email, we process the information you provide, such as your name, email address, company, job title and the content of your message, in order to respond to your request and, where relevant, to prepare or carry out a business relationship.
2.3 Business partners and customers
For our customers, suppliers, data providers and other partners, we process the business contact details of the relevant contact persons (name, work email, phone number, company, role) and the information necessary to negotiate, perform and administer our contracts, including invoicing and accounting data.
2.4 Audience data
As part of our services, we receive data from third-party data providers, such as mobile operators, app publishers, location services and content platforms. This data may include pseudonymous identifiers (for example, mobile advertising IDs), approximate or precise location signals, app and content usage signals, and contextual information. We use this data to build aggregated audience segments and insights, and to deliver and measure advertising campaigns.
We do not seek to identify individuals by name, and we do not process special categories of personal data (such as health, religion, political opinions or sexual orientation) to build segments. Our segments and insights describe groups of people rather than individuals.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing a secure and functional website | Legitimate interests, Art. 6(1)(f) |
| Answering your enquiries | Steps prior to entering into a contract, Art. 6(1)(b), or legitimate interests, Art. 6(1)(f) |
| Managing contracts with customers and partners | Performance of a contract, Art. 6(1)(b) |
| Accounting, tax and other statutory obligations | Legal obligation, Art. 6(1)(c) |
| Building audience segments and delivering and measuring advertising based on location and device data | Consent collected by the data provider or publisher, Art. 6(1)(a), and, where applicable, Art. 5(3) of the ePrivacy Directive as implemented in Romanian Law no. 506/2004 |
| Establishing, exercising or defending legal claims | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You may object to such processing at any time, as described in section 8.
4. How we work with data providers
- We only work with data providers that collect data lawfully and obtain clear, informed and freely given consent from users where required.
- Our agreements with data providers include contractual obligations on lawful collection, consent, transparency and the honoring of opt-outs and withdrawals of consent.
- We review each data source before we start working with it, and periodically afterwards.
- We apply data minimization, pseudonymization and aggregation, and we exclude sensitive locations and special categories of data from segmentation.
5. Recipients of data
We share personal data only where necessary and on an appropriate legal basis, with:
- service providers acting on our behalf as processors, such as hosting, cloud infrastructure, email and IT providers, under data processing agreements;
- advertising technology partners, such as demand-side platforms, supply-side platforms and measurement providers, to deliver and measure campaigns;
- customers and partners, to whom we provide aggregated insights or audience segments under contracts that restrict their use of the data;
- professional advisers, auditors, and public authorities where required by law.
We do not sell lists of names, email addresses or other directly identifying contact information.
6. International transfers
Some of our service providers and partners may be located outside the European Economic Area. Where personal data is transferred to a country without an adequacy decision from the European Commission, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses, together with additional measures where needed.
7. Data retention
- Server logs: up to 30 days, unless longer retention is needed to investigate a security incident.
- Enquiries: up to 2 years after our last communication, unless a business relationship follows.
- Contract and accounting records: for the duration of the contract and afterwards for the periods required by Romanian tax and accounting law.
- Audience data: device-level data is retained for no longer than 13 months from collection, after which it is deleted or irreversibly aggregated.
8. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request deletion of your data;
- request restriction of processing;
- receive your data in a portable format;
- object to processing based on legitimate interests, and to processing for direct marketing at any time;
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, email us at mngt@turnitlabs.com. If your request concerns audience data, please include the advertising identifier of your device, so that we can locate the relevant records. You can also limit advertising tracking at any time by resetting or disabling your advertising ID in your device settings, or by withdrawing consent in the app that collected it.
We will respond within one month of receiving your request. This period may be extended by two further months for complex requests, in which case we will inform you. We may need to verify your identity before acting on a request.
9. Right to lodge a complaint
If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro. You may also contact the supervisory authority in the EU member state where you live or work.
10. Security
We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls based on the least-privilege principle, pseudonymization, logging and regular reviews of our security practices.
11. Automated decision-making
We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing.
12. Children
Our services are not directed at children. We do not knowingly process data of children under 16 for audience segmentation or advertising purposes.
13. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always available on this page, with the date of the last update shown at the top.