Cookie Policy

1. Introduction

2. Data Controller

The controller responsible for the personal data processed via cookies on the Platform is:

• Go ASK Me S.R.L.
• Alexandru Serbanescu 48, Bucharest, Romania
• Privacy contact: privacy@goask.me
• General contact: ask@goask.me

3. What Are Cookies and Similar Technologies

4. Legal Basis for Using Cookies

We process personal data through cookies under the following legal bases set out in the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the ePrivacy Directive 2002/58/EC, Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, and Romanian Law no. 190/2018 implementing the GDPR:

• Strictly necessary cookies: Stored under our legitimate interest (GDPR Art. 6(1)(f)) and the express exemption in Art. 5(3) of the ePrivacy Directive — these cookies are required to provide a service explicitly requested by you (signing in, navigating securely, remembering consent choices).
• All other cookies (preferences, analytics, marketing): Stored only with your prior, freely given, specific, informed, and unambiguous consent (GDPR Art. 6(1)(a) and Art. 7; ePrivacy Art. 5(3)). You may withdraw consent at any time via our Cookie Preferences Centre, without affecting the lawfulness of processing carried out before withdrawal.
• Profiling and automated decision-making: Where any cookie produces legal effects or significantly affects you through automated decision-making, we rely additionally on the safeguards in GDPR Art. 22 and offer the right to obtain human intervention, express your point of view, and contest the decision.

5. Categories of Cookies We Use

Below are the categories of cookies we use on the Platform, with the specific cookies in each category, their providers, purposes, retention periods, and legal basis.

6. Third-Party Cookies and Service Providers

Some cookies are set by third parties whose services we use. These third parties act as independent controllers (not our processors) for the data they collect through their cookies. Below we list them, the categories of data they receive, their place of establishment, and a link to their own privacy notice.

• Google LLC / Google Ireland Ltd
  Google Analytics 4 (analytics), Google Ads (marketing), Google Tag Manager (tag delivery), Firebase Authentication (necessary).
  United States and European Economic Area
  https://policies.google.com/privacy
• Meta Platforms Ireland Ltd
  Meta Pixel for measuring the effectiveness of ads and building remarketing audiences.
  Ireland (with onward transfers to the United States)
  https://www.facebook.com/privacy/policy
• Hotjar Ltd
  Heatmaps, session recordings, and behavioural analytics.
  Malta (European Union)
  https://www.hotjar.com/legal/policies/privacy
• Cloudinary Ltd
  Delivery and optimisation of images and media; sets necessary cookies on its CDN domain only.
  Israel and United States
  https://cloudinary.com/privacy
• Functional Software, Inc. (Sentry)
  Capturing application errors for diagnostics; does not set cookies but processes IP address and user-agent data.
  United States
  https://sentry.io/privacy/
• Tidio LLC
  Live chat widget that enables real-time customer support on certain pages; sets first-party cookies to preserve conversation state and visitor identity.
  Cyprus and United States
  https://www.tidio.com/privacy-policy/

We do not control these third parties' cookies and the data they collect. Please read their privacy policies for full details. If you withdraw consent for a category in our Cookie Preferences modal, we instruct the corresponding script not to load and, where supported by our consent library, automatically clear that category's first-party cookies on our domain — but cookies already set on third-party domains may need to be cleared via your browser or via the provider's own opt-out tools.

7. International Data Transfers

Some of our cookie providers (notably Google, Meta, and Cloudinary) are established in or transfer personal data to countries outside the European Economic Area, including the United States. Where data is transferred to a country that does not have an adequacy decision from the European Commission, we rely on the following safeguards:

• the EU–U.S. Data Privacy Framework adequacy decision of 10 July 2023 where the recipient is self-certified (Google LLC and Meta Platforms, Inc. are both certified);
• Standard Contractual Clauses (SCCs) approved by the European Commission under Implementing Decision (EU) 2021/914;
• supplementary technical and organisational measures, including encryption in transit and at rest, pseudonymisation, and access controls, where assessed as necessary following a Transfer Impact Assessment.

You may obtain a copy of the safeguards in place by writing to privacy@goask.me. UK transfers rely on the UK International Data Transfer Addendum issued under the UK GDPR. Switzerland transfers rely on the Swiss Federal Data Protection Act recognition of the SCCs.

8. How to Manage Your Cookies

You have several ways to manage cookies on the Platform:

• Our Cookie Preferences Centre: Open the Cookie Preferences modal at any time by clicking "Manage cookie preferences" at the top of this page or by clicking "Manage preferences" in the cookie banner footer when it is displayed. You can grant or withdraw consent for each category individually.
• Browser controls: Most browsers let you block, delete, or be notified about cookies. See the help pages for Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge, Opera, and Brave for instructions.
• Mobile device controls: iOS (Settings → Privacy → Tracking) and Android (Settings → Google → Ads) allow you to limit ad tracking and reset your advertising identifier.
• Industry opt-outs: You can opt out of interest-based advertising from many companies via the Network Advertising Initiative (optout.networkadvertising.org), the Digital Advertising Alliance (optout.aboutads.info), the European Interactive Digital Advertising Alliance (youronlinechoices.eu), and the Digital Advertising Alliance of Canada (youradchoices.ca).
• Global Privacy Control: We honour the Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale and sharing of personal information for cross-context behavioural advertising under U.S. state privacy laws.

Refusing or withdrawing consent for non-essential cookies will not prevent you from accessing the Platform, but certain features (such as personalised content, analytics-based recommendations, session-recording quality assurance, and remarketing offers) may be limited or unavailable.

9. Your Rights Under EU, UK, and Romanian Law

Under the GDPR, the UK GDPR, and Romanian Law no. 190/2018, you have the following rights regarding personal data we collect through cookies:

• Right of access (Art. 15): Obtain confirmation of whether we process personal data about you and a copy of that data.
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to erasure / 'right to be forgotten' (Art. 17): Request deletion of your data where the legal grounds in Art. 17 apply.
• Right to restriction of processing (Art. 18): Request that we limit how we use your data in defined circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Right to object (Art. 21): Object to processing based on legitimate interest, including profiling for direct marketing — which we will always honour.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time via our Cookie Preferences Centre, without affecting the lawfulness of prior processing.
• Right not to be subject to solely automated decisions (Art. 22): Where applicable, obtain human intervention, express your point of view, and contest a decision based solely on automated processing.
• Right to lodge a complaint: Lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, or with your local EU/EEA supervisory authority. UK residents may complain to the Information Commissioner's Office (ICO).

To exercise any of these rights, contact us at privacy@goask.me. We will respond within one month of receiving a verifiable request, in line with GDPR Art. 12(3). We may extend this period by up to two further months where necessary, taking into account the complexity and number of requests, and we will inform you of any such extension within one month.

10. California Residents — Your CCPA / CPRA Rights

If you are a resident of California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), grants you the following rights with respect to personal information collected through cookies:

• the right to know what personal information we collect, use, disclose, and "sell" or "share";
• the right to delete personal information we have collected from you, subject to lawful exceptions;
• the right to correct inaccurate personal information;
• the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising;
• the right to limit our use and disclosure of sensitive personal information;
• the right to non-discrimination for exercising your CCPA rights.

We do not sell personal information for monetary consideration. However, certain marketing cookies may constitute "sharing" under the CCPA. You can opt out at any time via our Cookie Preferences Centre or by enabling the Global Privacy Control signal in your browser. To exercise CCPA rights, email privacy@goask.me with the subject line "California Privacy Request". We will verify your identity using the information already associated with your account before responding. Authorised agents may submit requests on your behalf with a written authorisation.

11. United Kingdom Residents — UK GDPR and PECR

Cookie use for visitors in the United Kingdom is governed by the UK GDPR (the GDPR as retained in UK domestic law) and the Privacy and Electronic Communications Regulations 2003 (PECR). The rights and consent rules described above apply equally to UK visitors. Complaints may be addressed to the UK Information Commissioner's Office (ICO) at https://ico.org.uk.

12. Children

The Platform is not directed at, and we do not knowingly collect personal information through cookies from, children under the age of 16 (or under the applicable age of digital consent in the user's country, which is 13 years for users in the United States under the Children's Online Privacy Protection Act, COPPA). If you believe we have collected information from a child without verifiable parental consent, please contact privacy@goask.me and we will delete the data without undue delay.

13. Retention

Cookie retention periods are listed in section 5 above. Personal data collected via cookies is retained for the duration of the cookie or for the period necessary to fulfil the purposes set out in our Privacy Policy, whichever is shorter. Aggregated and fully anonymised statistics may be retained indefinitely as they no longer identify you. We periodically review and delete data that is no longer required for the purposes for which it was collected.

14. Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in technology, applicable law, or our practices. Material changes will be communicated by re-displaying the cookie consent banner so that you may review and re-confirm your choices. The "Last updated" date at the top of this page indicates when the latest changes took effect. We encourage you to review this Cookie Policy periodically. Continued use of the Platform after changes become effective constitutes your acknowledgment of the updated Cookie Policy and, where applicable, fresh consent collected via the banner.

15. Contact Us

Questions, requests, or complaints about this Cookie Policy or our use of cookies should be sent to:

• Go ASK Me S.R.L.
• Alexandru Serbanescu 48, Bucharest, Romania
• Privacy: privacy@goask.me
• Support: ask@goask.me
• Romanian Data Protection Authority (ANSPDCP): https://www.dataprotection.ro