PixHub

Privacy Policy

Last updated: 28 January 2026

Protecting your personal data is a priority for us. This policy describes what data we collect, how we use it, and what rights you have, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Romanian Law No. 190/2018 on measures implementing the GDPR in Romania.

1. Data Controller

If you have any questions regarding the processing of your data, you can contact our Data Protection Officer (DPO) through the form on the Contact page.

2. What Data We Collect and Why

2.1. Registration and Account Data

  • Data: username, email address, password (stored encrypted), registration date.

  • Purpose: creating and managing your account, authentication, account-related communications.

  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

  • Retention period: for the lifetime of the account plus 30 days after deletion (to resolve any disputes); billing data is retained for 10 years pursuant to Romanian Accounting Law No. 82/1991.

2.2. Uploaded Content

  • Data: files (images, videos), associated metadata (title, description, tags), upload date and time.

  • Purpose: providing the hosting and distribution service.

  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

  • Retention period: for the lifetime of the account or until manual deletion of the file; anonymous (accountless) files are retained according to the expiry policy set at upload time.

2.3. Log and Technical Data

  • Data: IP address, browser type, operating system, pages visited, timestamps.

  • Purpose: security, abuse prevention, technical diagnostics, and legal compliance.

  • Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR) — securing the platform and preventing fraud; legal obligation for certain logs (Art. 6(1)(c) GDPR).

  • Retention period: 90 days.

2.4. Contact Form

  • Data: name, email address, subject, message content.

  • Purpose: responding to inquiries and managing communication.

  • Legal basis: consent (Art. 6(1)(a) GDPR) or legitimate interest.

  • Retention period: 2 years from the last communication.

2.5. Email Notifications

  • Data: email address, notification preferences.

  • Purpose: sending account-related notifications (comments, activity, security alerts).

  • Legal basis: performance of a contract (Art. 6(1)(b) GDPR) or consent for optional notifications.

  • Retention period: for the lifetime of the account.

2.6. Statistical Analysis (Matomo)

  • Data: anonymized IP address, pages visited, session duration, device type, anonymized visitor identifier.

  • Purpose: understanding how the platform is used and improving the service.

  • Legal basis: consent (Art. 6(1)(a) GDPR) — analytics is only performed if you have accepted analytics cookies.

  • Retention period: 13 months (aggregated data). Matomo is self-hosted on our own servers; data is not shared with any third parties.

2.7. Content Reports

  • Data: name and email of the reporting party, reported URL, description, electronic signature.

  • Purpose: handling notices concerning illegal content (DSA Art. 16).

  • Legal basis: legal obligation (Art. 6(1)(c) GDPR).

  • Retention period: 6 years (to document moderation decisions as required by the DSA).

3. Data Recipients

Your data is accessible exclusively to the PixHub team and a limited set of service providers (processors), who process data solely on our instructions and under data processing agreements (DPAs):

  • Cloud storage provider — cloud file storage (USA; transfer governed by Standard Contractual Clauses under Art. 46 GDPR).

  • Email service provider — sending notifications and transactional emails.

  • Hosting/CDN provider — server infrastructure.

We do not sell, rent, or transfer personal data to third parties for commercial purposes.

We may disclose data to competent authorities (police, prosecutors, courts) when legally required to do so, or in the case of manifestly illegal content (e.g., CSAM).

4. International Data Transfers

File storage uses cloud services with servers located in the USA. The transfer is safeguarded through Standard Contractual Clauses (SCCs) adopted by the European Commission, in accordance with Art. 46(2)(c) GDPR. You may request a copy of these safeguards at [email protected].

5. Your Rights

Under the GDPR, you have the following rights, which you may exercise by sending a request to [email protected]:

  • Right of access (Art. 15) — to obtain confirmation that your data is being processed and a copy of that data.

  • Right to rectification (Art. 16) — to correct inaccurate or incomplete data.

  • Right to erasure (“right to be forgotten”) (Art. 17) — to request deletion of your data, under the conditions set out by law.

  • Right to restriction of processing (Art. 18) — to request that processing be limited in certain situations.

  • Right to data portability (Art. 20) — to receive the data you provided in a structured, commonly used, machine-readable format.

  • Right to object (Art. 21) — to object to processing based on the controller's legitimate interest.

  • Right not to be subject to automated decision-making (Art. 22) — PixHub does not use processes that involve decisions based solely on automated processing with legal effects.

  • Right to withdraw consent (Art. 7(3)) — withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

You will receive a response within 30 calendar days of receipt of your request (this period may be extended by a further 60 days in complex cases, with prior notice to you).

6. Right to Lodge a Complaint

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest 010336, Romania
Phone: +40 318 059 211
Email: [email protected]
Web: dataprotection.ro

7. Data Security

We implement appropriate technical and organizational measures to protect your data (encryption in transit via HTTPS/TLS, encrypted password storage using bcrypt, role-based access restrictions, logging, and monitoring). In the event of a security incident affecting your data, we will notify you in accordance with Art. 33-34 GDPR.

8. Processing of Minors' Data

PixHub does not knowingly collect personal data from individuals under the age of 16. If we become aware that we have processed such data without a valid legal basis, we will delete it immediately.

9. Changes to This Policy

Any significant change will be announced by email or through a visible notice on the Platform at least 15 days before it takes effect. The updated version will be available on this page along with its revision date.

10. Contact

For any question or to exercise the rights granted under the GDPR, you can contact us through the form on the Contact page.