Who is responsible
Pickado Enablement SRL is the controller for personal information used to operate this website, answer enquiries and assess applications. Our registered address, company details and privacy contact are in Company and contact. This notice concerns this website and the correspondence it creates, rather than every system used in client projects.
Website visits and security
Cloudflare hosts and protects this website. Technical processing can include your IP address, requested URL, time and browser or network information. The legal basis for this processing is our legitimate interest in operating a secure and reliable website, under Article 6(1)(f) GDPR.
The staging site and Brand Hub are restricted to Pickado members. Cloudflare Access processes your sign-in email address and authentication session to check membership and protect these areas, on the same legitimate-interest basis. Authentication cookies follow the configured access session; see the Cookie Notice. Public business pages do not require a member account.
Turnstile verifies form requests to help prevent automated abuse. Verification involves Cloudflare processing browser and network signals. We also apply short-lived rate limits and duplicate protection. Duplicate records contain a keyed fingerprint, a random reference and delivery status, rather than your message or Resume / CV, and expire after 24 hours. Form bodies, attachments and provider credentials are not written to application logs.
The website has no advertising pixels, visitor analytics, newsletter sign-up or marketing profiling. Cloudflare Web Analytics is disabled on this website. We do not make decisions about you solely through automated processing.
Email signature generator
The Brand Hub signature generator uses your required name, role, Pickado email username, international dialing code and phone number, city and country only in the current browser page. The email domain is fixed to @pickado.tech; the tool does not create or configure a mailbox. It does not send those values to Pickado, store them in browser storage or include them in the page URL. Copy and download happen only when you choose them. Downloads can contain HTML, plain text or an unsent EML draft with the logo attached inline; the generator does not send the draft. Clipboard contents and downloaded files then follow your device and email app settings. The company LinkedIn link is fixed; no meeting link is collected. Reset clears the current entries. Normal website delivery and security processing still apply.
Enquiries
The Contact form collects your name, email address, optional company and message. We use them to understand your enquiry and respond. You can also email us directly. Providing information is voluntary, but we need enough detail and a way to reply.
Steps you request before entering a contract may rely on Article 6(1)(b) GDPR. Ordinary business correspondence, including correspondence with a company’s representative, relies on our legitimate interest in responding under Article 6(1)(f). Legal obligations can apply to later contractual or accounting records. An enquiry does not subscribe you to marketing. A successful form submission means our email provider has accepted the message for processing; delivery to mailboxes may take longer.
Before sending an enquiry, you must acknowledge that you have read this notice. This acknowledgement is not consent to marketing and does not replace the legal bases described above.
Recruitment
Application forms collect your name, email, telephone number, country of residence, experience range, availability, LinkedIn profile, a portfolio link where required, optional immediate-start answer and a PDF, DOC, DOCX, PPT or PPTX Resume / CV (up to 5 MiB). The server derives the role from the published listing. We use this information to assess your application for that role, communicate with you and arrange any next steps.
Processing for recruitment steps you request relies on Article 6(1)(b) GDPR. Necessary administration, security and the establishment or defence of claims may rely on Article 6(1)(f); applicable legal obligations rely on Article 6(1)(c). Required fields provide the information needed to assess and contact you. An application does not guarantee an interview or engagement.
Applications are emailed to our recruitment mailbox. A successful website submission means our email provider has accepted the message for processing; mailbox delivery and confirmation emails may be delayed. The website does not keep a CV database or publish applicant information. CV files receive basic file-size, extension and file-header checks only. Document contents, embedded metadata and attachments are not inspected by the website, and no antivirus scan is performed by the website. Email attachment protection is provided by our receiving mail system. Please do not include unnecessary sensitive information. Access is restricted to people who need it for recruitment. There is no automated applicant ranking, general talent-pool collection or AI assessment through this website.
Before sending an application, you must acknowledge that you have read this notice. This is not marketing consent.
Delivery providers and recipients
Cloudflare processes requests and verification. SMTP2GO (Sand Dune Mail Ltd) processes enquiry and application emails, including attached CV files, and sends confirmation messages. Microsoft 365 hosts our receiving mailboxes. Email open and click tracking is disabled for website sending. A confirmation indicates acceptance for processing, rather than a hiring or contractual decision.
Information may also be accessed by authorised personnel, service providers operating these systems, and advisers or authorities where necessary under a lawful obligation or to handle a claim. We do not sell your personal information.
Providers operate international infrastructure and may process information outside the EEA. Applicable safeguards include contractual data-protection commitments and, where required, EU Standard Contractual Clauses or an applicable adequacy decision. You can request information or a copy of relevant safeguards through our privacy contact. See the Cloudflare DPA, SMTP2GO GDPR information and Microsoft Products and Services DPA. We do not promise that every processing operation remains within Romania or the EEA.
Retention
We retain ordinary enquiry correspondence while handling the request and normally for up to 12 months after the last substantive interaction. If a client relationship develops, relevant records follow the associated contract and legal obligations. A documented obligation or claim can justify retaining necessary records longer.
Unsuccessful applications are normally deleted within six months after the role closes. Successful applicants receive information about the separate employment or engagement process. A separate notice and appropriate legal basis would be needed for a future talent pool.
These mailbox periods are managed through periodic reviews, rather than by a website database. Deletion requests are assessed earlier where applicable. Records needed for an obligation or claim are restricted to that purpose. Provider backups and security records follow their service-specific deletion cycles and safeguards; deleted data may remain in protected backups until those cycles complete.
SMTP2GO states that email headers and its limited compliance samples can be retained for 35 days; paid email archiving is not enabled for website sending. Cloudflare’s standard Workers log retention depends on the service plan, currently three days on Free and seven days on Paid. Other necessary security records follow the provider’s applicable security purposes and retention criteria. Browser preferences remain until you reset, change or remove them; see the Cookie Notice.
Preferences, samples and external links
Theme and accessibility choices can be remembered locally in your browser. They are not sent to an analytics service. Local videos and documents load from this site. The captioned Home brand film can autoplay muted; its native controls allow pause, sound and fullscreen. Reduced-motion and shared animation-pause choices prevent automatic playback. Interactive samples run in isolated frames when requested; the website does not create learner accounts or store LMS scores, completion or progress.
Following a YouTube or social link opens that provider’s website, where its own terms and privacy practices apply. No YouTube player is embedded automatically.
Your rights
Depending on the processing and its legal basis, you may request access, correction, deletion, restriction or portability. You may withdraw consent for any consent-based processing without affecting the lawfulness of earlier processing. Rights have legal limits; we will explain any applicable exception.
Your right to object
Where we process your personal data based on our legitimate interests, you have the right to object to that processing on grounds relating to your particular situation.
Use the privacy contact below. We may request information needed to verify your identity. We normally answer within one month; if a lawful extension is necessary, we explain it within that month. You may complain to Romania’s ANSPDCP or another competent supervisory authority and seek a judicial remedy.
AI-assisted website content
Some website copy and illustrative images are prepared with AI assistance. This concerns website production and does not mean that enquiries or applications are automatically sent to a generative AI service or assessed by AI. Generated images do not represent real staff or clients.
Updates
We will update this notice to reflect changes in how we process personal data and will inform affected individuals where required by applicable data protection law. The date above identifies the latest version.