Cookie policy

Effective date and last updated: 18 October 2026

1. Who operates Harmoniq#

The Harmoniq presentation website and the Harmoniq application are operated by:

• SYNCDEV S.R.L.
• Romanian Trade Register no.: J2014000164361
• EUID (European Unique Identifier): ROONRC.J2014000164361
• CUI / fiscal identification code: 33129339
• Registered office: Str. Fetițelor nr. 4, camera nr. 1, 820035 Tulcea, Tulcea County, Romania
• Email: hello@harmoniq.ro (general questions), privacy@harmoniq.ro (privacy)

This Policy should be read with the Harmoniq Privacy Policy, available at https://harmoniq.ro/en/legal/privacy.

2. Scope#

This Policy applies to cookies and similar technologies used:

• on the public website https://harmoniq.ro (including the English version under https://harmoniq.ro/en), where SYNCDEV acts as controller; and
• in the Harmoniq application, at each company's address (in the form <company>.harmoniq.ro) and on the custom domains a company connects to its account, described in section 9.

3. What cookies and similar technologies are#

A cookie is a small text file that a website stores in a browser or on a device and reads during the current or a later visit. Similar technologies include local storage (localStorage), session storage (sessionStorage), pixels, tags, scripts and device or browser identifiers.

Under Article 4(5) of Romanian Law no. 506/2004 and Article 5(3) of Directive 2002/58/EC, storing information on a user's terminal equipment, or accessing information already stored there, generally requires the user's prior informed consent. Under Article 4(6) of the same law, consent is not required where the storage or access is solely for the purpose of transmitting a communication or is strictly necessary to provide a service expressly requested by the user.

Where a technology also processes personal data, Regulation (EU) 2016/679 (GDPR) applies as well.

4. Our approach#

• Strictly necessary technologies operate without consent (Article 4(6) of Law no. 506/2004).
• Preference storage is used only to remember choices you have requested (for example, the display theme).
• The public website's own statistics set no cookie and do not use local storage to recognise you (section 6).
• Optional measurement and advertising technologies, where configured, are never downloaded, executed or read from your device before you actively accept the matching category (section 7). Their legal basis is your consent (Article 6(1)(a) GDPR).
• Refusing is offered on equal terms with accepting: refusing every optional category is a single action, exactly like accepting all of them, and refusal leaves the site fully usable.
• When no optional technology is configured, the banner shown on your first visit is an information notice only.
• The Harmoniq application (after sign-in) uses only strictly necessary technologies and preferences requested by the user (section 9).

5. First-party technologies used#

The technologies in the table below are our own (first party), are limited to the address you use and are not accessible to third parties. The only exception is the web push subscription, through which notifications reach the browser via the browser maker's notification service.

6. Cookieless own statistics#

To know which pages of the public website are read, each page sends a page-view request to our server without setting a cookie and without storing an identifier on your device. For each view we record:

• the page path, without its query string, the language and the kind of page;
• the domain of the website you came from, if any, its general category (search engine, social network, other site or direct visit) and campaign parameters (utm_source, utm_medium, utm_campaign);
• the general device type (desktop, mobile or tablet), the browser family and the operating system family;
• the country, looked up from the IP address in a geolocation database kept on our own server;
• a visitor code obtained through a hash function from the IP address and the browser identifier, combined with a random secret value created each day; the code changes every day, so we cannot follow you from one day to the next; and
• the visit: views with the same code that follow each other within 30 minutes count as one visit, without anything being stored on your device.

The IP address and the browser identifier are not stored as such. Requests from indexing robots are not recorded. Views are not recorded either when your browser sends the Do Not Track or Global Privacy Control signal: the page no longer sends the request, and the server does not record a request carrying either signal.

The legal basis is our legitimate interest in understanding how the website is used (Article 6(1)(f) GDPR). The retention period is the one stated in the Privacy Policy.

You may object at any time: when the banner is shown as a notice, tick "Don't count my visits", an option also available through "Cookie settings" in the page footer; when the banner asks for your consent (section 7), refusing the "Statistics" category, including through "Reject all", also stops these statistics. The choice is kept in your browser (hq.stats-objection) and, so that the server can honour it too, in the hq_stats_objection cookie (section 5); the page no longer sends the page-view request, and the server does not record a request coming from a browser that objected. You may also exercise your right to object as described in the Privacy Policy.

7. Optional measurement and advertising technologies on the public website#

SYNCDEV may advertise Harmoniq on third-party platforms. To measure use of the website and the effectiveness of that advertising, the public website can be configured by the Harmoniq team to load the following providers:

• Google Tag Manager, Google Analytics 4 and Google Ads, provided by Google Ireland Limited;
• Meta Pixel, provided by Meta Platforms Ireland Limited;
• TikTok Pixel, provided by TikTok Information Technologies UK Limited; and
• LinkedIn Insight Tag, provided by LinkedIn Ireland Unlimited Company.

Google Analytics 4 falls under the Statistics category. Google Ads, Meta Pixel, TikTok Pixel and LinkedIn Insight Tag fall under the Advertising category. Google Tag Manager is the container through which Google tags can be loaded; it loads only after you accept the Statistics category, and the advertising tags inside it follow the advertising signals described below, so they do not work unless you accept the Advertising category.

None of these providers is downloaded, executed or permitted to read from your device before you accept the matching category. Harmoniq uses Google's Basic Consent Mode (version 2): before a choice is made, all consent signals are set to denied, at the top of the page, before any other tag, and no Google tag library is loaded, so no signal of any kind is sent before consent; after your choice, Google tags receive only the categories you accepted: the statistics signal follows the "Statistics" category, and the advertising signals (advertising storage, user data sent for advertising and ad personalisation) follow the "Advertising" category. Providers without an equivalent mechanism are simply not injected into the page until consent is given.

These providers set their own cookies and identifiers once loaded, may combine what they observe with data they hold about you from other websites and their own services, and act as independent or joint controllers for that processing. Their own notices govern it. Their processing may involve transfers outside the European Economic Area, carried out under the European Commission's adequacy decision for the EU-US Data Privacy Framework or, where that does not apply, standard contractual clauses.

Some pages mark a few steps of the journey on the website (starting the signup, submitting the signup form and sending a message through the contact form) with an event added to the tags' data layer. The event contains no personal data and is read by the tags only if they are loaded, that is, only after you have accepted the matching category; otherwise it does not leave the page.

The providers actually configured may vary over time. When none is configured, the banner does not ask for your consent; it only informs you about the strictly necessary technologies and the cookieless statistics.

Refusing these categories, or making no choice at all, prevents them from loading and does not limit your use of the website.

8. Visit source, campaign attribution and conversion reporting#

When you arrive at the public website through a link carrying campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) or an advertising click identifier issued by the platform (gclid, gbraid, wbraid from Google, fbclid from Meta, msclkid from Microsoft), or from another website, we record on the first page you visit, in the server-side session carried by the strictly necessary harmoniq-session cookie, these values, the referring website and the page you landed on. Only the first source of the visit is kept; for a visit without a campaign, nothing campaign-related is kept. We do not place a separate advertising or attribution cookie for this purpose, and we do not read one.

The campaign parameters, the domain of the referring website and the landing page are attached to a message only if you write to us through the contact form, so that we know which campaign or website brought you to us. If, in the same session, you sign up a company to Harmoniq, the campaign values and click identifiers, the landing page and the referring website are kept with the company's account, together with your choice for the "Advertising" category in the banner (accepted, refused or not expressed), so that we know which campaigns bring customers. If you neither write to us nor sign up a company, this information disappears with the session. Its processing after signup is described in the Privacy Policy.

Reporting a conversion to the advertising platform. Only if you accepted the "Advertising" category before signing up, we may report that a company was signed up — and, later, its first paid subscription, with its value and currency — to Google Ads (offline click conversion import, with enhanced conversions) and to Meta (the Conversions API). This is done from our servers rather than from your browser. What is sent is the click identifier from the visit, the type and time of the event, the value and currency for a subscription, and the account owner's email address as an irreversible SHA-256 hash, used solely for matching; the email address is never sent in clear. Each report is sent only once. If you did not accept the "Advertising" category, or if there is no click identifier or email address that can be matched, nothing is sent.

Click identifiers are erased 120 days after signup, which is past the point at which the advertising platforms will accept a conversion for them (90 days from the click). Campaign names such as utm_campaign identify a campaign rather than a person and are kept with the account for our own acquisition reporting.

9. The Harmoniq application#

In the Harmoniq application (the company's address, in the form <company>.harmoniq.ro, or the company's custom domain), used after sign-in, we use only the strictly necessary cookies and the preferences described in section 5. The application loads no measurement or advertising tags, does not use the statistics in section 6 and shows no consent banner.

The content in the application belongs to the company that uses it. Where a company includes a YouTube or Vimeo video in its own content (for example, in a course), the video loads only on that page, through YouTube's privacy-enhanced player (youtube-nocookie.com) or through the Vimeo player with the "Do Not Track" signal on. Once loaded, the video provider may store or read information on your device under its own notice. Embedded videos from other providers are not allowed.

When a company chooses a subscription or manages its payment, it is redirected to Stripe's pages. The technologies used on those pages are Stripe's and are governed by Stripe's notice.

10. How to manage your choices#

On the public website, use "Cookie settings" in the footer of any page to review, narrow or withdraw a choice at any time. The same controls are offered on equal terms: refusing every optional category is a single action, exactly like accepting all of them. Withdrawing consent stops future loading of the relevant technologies (the page reloads to unload them); it does not affect the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR). To stop conversion reporting for an account already signed up (section 8), you may also write to privacy@harmoniq.ro; reports already sent are not affected. Cookies already set by a third-party provider can be deleted in your browser settings.

When the version of the consent choices changes (for example, because the providers or purposes described in this Policy change), an earlier choice is treated as no choice: the banner reappears and nothing optional loads until you choose again.

You may also reset the stored choice by deleting the hq.consent and hq.stats-objection entries from your browser's local storage and the hq_stats_objection cookie, or by clearing site data.

You may delete or block cookies in your browser settings. Blocking strictly necessary cookies can prevent sign-in, forms or other requested functions from working.

Browser controls do not always stop server-side security logs or the cookieless statistics described in section 6. For those statistics, use the "Don't count my visits" option, refuse the "Statistics" category, turn on the Do Not Track or Global Privacy Control signal in your browser, which we honour, or object as described in the Privacy Policy.

11. Consent records#

When optional technologies are configured on the public website and you make your choice in the banner, we keep, as proof of consent (Article 7(1) GDPR), a minimised record containing: a keyed hash of the random identifier generated by your browser, the categories accepted or refused, the action taken (accepting all, refusing all, a custom choice or withdrawing consent), the version of the consent choices, the language and the time of the choice. When the banner is only an information notice, no such record is made. We do not record your IP address or any other data that directly identifies you in this record. The record is accountability evidence, not permission to use refused categories, and it is retained for the limited period stated in the Privacy Policy.

12. Changes and contact#

We update this Policy and its effective date when the technologies or providers used change.

Questions:

• SYNCDEV S.R.L.
• General questions: hello@harmoniq.ro
• Privacy and cookie questions: privacy@harmoniq.ro