Privacy policy

This policy explains what personal data BetterBuyBase collects, why, the legal basis for it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Romanian data-protection law. We collect as little as possible and we never sell your personal data.

Who is responsible for your data

The data controller for this site is:

Ciprian Jitaru

B-dul Bucureștii Noi, 136, et. Parter, ap. 5, Sector 1, București, Romania

Email: contact@betterbuybase.com

What we collect, why, and our legal basis

• Reviews: when you sign in with Google to leave a review, we receive your name, email address and Google account user ID (we do not receive or store your profile photo), and we record the IP address the review was sent from. Your display name, not your email, appears publicly next to your review. We use this to attribute, publish and moderate reviews and to catch spam and fake reviews. You can ask us to edit or remove your review at any time. Reviews are checked before they appear. Legal basis: your consent and the performance of the review service you request.
• Price-drop alerts: the email address you provide, so we can notify you. Legal basis: your consent. You can unsubscribe from any alert email at any time.
• Contact & product-suggestion forms: your name, email and message, plus the IP address it was sent from (kept with the message to block spam), so we can reply and act on your request. Legal basis: your consent and our legitimate interest in responding to enquiries.
• Security & anti-spam: your IP address and bot-check signals (via Cloudflare Turnstile) to protect the forms and the site from abuse. Legal basis: our legitimate interest in keeping the service secure.
• Site security (Wordfence): we use Wordfence Security, provided by Defiant, Inc., to help protect the website against malicious traffic, unauthorized access, brute-force login attempts, malware and other security risks. For this purpose, Wordfence may process technical and security-related data such as IP addresses, browser and user-agent information, request data, login and security events, and firewall activity. Legal basis: our legitimate interest in keeping the website secure and preventing abuse.
• Server logs: like any website, our web server logs each request it receives: the IP address, the date and time, the page requested, the referring page and your browser’s user-agent. We use these logs only to run the site, fix errors and stop abuse. Legal basis: our legitimate interest in keeping the site working and secure.
• Analytics: we use Ahrefs Web Analytics to see which pages get read and where visitors arrive from. It is cookieless: it stores nothing on your device and does not follow you across sites, devices or days. Your IP address is used only to derive an approximate location (country and city) and, combined with your browser’s user-agent and a salt that is thrown away every 24 hours, to produce a one-way hash that counts a device once per day. The raw address itself is never stored. It also records the page address, the referring address, your browser and device type, your language preference and basic interactions such as link clicks. We see totals, never individuals. Legal basis: our legitimate interest in understanding how the site is used and improving it.
• Google Analytics, only with your consent: if you allow it (in Google’s consent message when you visit from the EEA, the UK or Switzerland, and in our consent banner elsewhere), we also use Google Analytics 4, provided by Google Ireland Limited, to count visits and see how the site is used. It sets two cookies holding a random identifier (listed in our cookie policy) and records the pages you view, how you arrived (the referring page or search), how long you stay, your device type, browser, language and screen size, and your approximate location (country and city), which Google derives from your IP address. Google Analytics 4 does not log or store IP addresses. We have turned off Google signals and ad personalization and we do not use User-ID, so the data is not linked to a Google account and is not used to personalize ads. Without your consent, Google Analytics does not load at all. Legal basis: your consent, which you can withdraw at any time from the cookie settings button.
• Advertising (Google AdSense): this site is set up to show ads from Google AdSense, provided by Google Ireland Limited. No ads appear until Google approves the site. The AdSense script loads on every page. If you visit from the EEA, the UK or Switzerland, it first shows Google’s consent message, a Google-certified consent platform that follows the IAB Transparency and Consent Framework, and Google and its advertising partners use cookies or similar technologies only for the purposes you allow there. Once ads run, third-party vendors, including Google, use cookies to serve ads based on your prior visits to this site and other websites. Legal basis: your consent in the EEA, the UK and Switzerland; elsewhere, our legitimate interest in funding the site.
• Affiliate links: when you click a “View deal”, “Check price” or other retailer link, you leave this site for the retailer, either directly or through an affiliate network’s tracking link. The retailer (and the network, if there is one) receives that click, with your IP address, browser details and the page you came from, and may set cookies on its own site to credit us with a sale. We pass on no personal data of our own, and the commission reports we receive do not identify you. Legal basis: our legitimate interest in funding the site.
• Embedded videos and posts: an article can embed content from YouTube, Vimeo, TikTok, Instagram, Spotify, X or Reddit. Nothing is loaded from those services until you click the placeholder. When you do, your browser connects to that provider, which receives your IP address, browser details and the address of the page, and may set its own cookies under its own privacy policy. YouTube videos load in YouTube’s privacy-enhanced mode (youtube-nocookie.com). If you allow functional cookies and tick “Always display content from …”, we remember that choice in a cookie on your device. Legal basis: your consent, given by the click.

Who we share it with

We use a small number of trusted processors to run the site: Bluehost (hosting: its server holds the site, its database and the messages you send us, and our contact replies and price-alert emails go out from that server rather than through an email-marketing provider), Google for the optional Google sign-in used to post reviews, and Cloudflare (the Turnstile bot-check that protects our forms). Each processes data under its own terms and only as needed for that feature. We do not sell your data or share it for unrelated advertising.

Retailers and the affiliate programs we work with, such as Amazon Associates, receive your click when you follow one of our price or deal links, as described above. They act under their own privacy policies, not as our processors.

Video and social-media providers receive data only when you click to load their embedded content, and handle it under their own privacy policies.

We also use Defiant, Inc. as a security processor: its Wordfence Security service filters malicious traffic and blocks attacks before they reach the site, processing the security data described above solely for that purpose.

Ahrefs Pte Ltd acts as our analytics processor. It handles the cookieless usage data described above solely to produce our traffic reports, and does not use it to build advertising profiles or to identify you.

Google Ireland Limited provides Google Analytics to us as a processor, under Google’s data processing terms, and receives the usage data described above only when you allow analytics cookies. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Google and the advertising partners named in Google’s consent message receive data for advertising only as described above, and act as independent controllers under their own policies. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and other sites. You can turn off personalized advertising in Google’s My Ad Center (myadcenter.google.com), and opt out of some other vendors’ personalized advertising at www.aboutads.info.

International transfers

Several of these providers process data outside the European Economic Area, mainly in the United States, and each transfer rests on a safeguard the GDPR recognises.

The server this site runs on is operated by Bluehost (Newfold Digital, Inc.) in the United States, so what the site stores (reviews, messages, price alerts and server logs) is held there. Newfold relies on the European Commission’s Standard Contractual Clauses for these transfers.

Google LLC (Google sign-in) and Cloudflare, Inc. are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as giving adequate protection.

This includes Defiant, Inc. (Wordfence), which processes security data in the United States and offers the European Commission’s Standard Contractual Clauses as a safeguard for such transfers.

It also includes Ahrefs Pte Ltd, which is incorporated in Singapore and stores analytics data in the United States, relying on the European Commission’s Standard Contractual Clauses as the safeguard for those transfers.

Google Analytics data may also be processed by Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google’s data processing terms add the European Commission’s Standard Contractual Clauses.

Advertising data may be processed by Google LLC and other advertising partners outside the EEA. Google LLC is certified under the EU-U.S. Data Privacy Framework.

How long we keep it

We keep personal data only as long as needed for the purpose it was collected, then delete or anonymise it. In practice: reviews are kept while they remain published and are removed on request, price-alert emails are kept until you unsubscribe or the alert is discontinued, and contact and product-suggestion messages are kept for up to 12 months after your enquiry is resolved. Where the law requires us to retain certain records for longer, we keep them only for that required period.

Security logs collected by Wordfence are kept for up to 30 days, and only as long as necessary for website protection, troubleshooting, abuse prevention and security investigations.

Raw web-server logs on our hosting account are rotated within days, and we do not archive them.

Analytics data carries no identifier that can be traced back to you (the daily hash cannot be reversed once its salt is deleted), so it is kept in aggregate in our analytics account for as long as we use the service.

Google Analytics keeps the event data linked to its cookie identifier for 14 months and then deletes it automatically. After that, our reports hold only aggregated totals. The Google Analytics cookies expire 13 months after your last visit, and withdrawing consent deletes them straight away.

Google’s advertising cookies last up to 13 months. The record of your choices in Google’s consent message also lasts up to 13 months, after which the message asks again.

How we protect it

The whole site is served over encrypted HTTPS connections only. Access to the hosting account and the WordPress admin is limited to the people who run the site, and the Wordfence firewall screens traffic before it reaches the site.

Cookies

We use only a small number of cookies: to remember your consent choices and to keep the site secure. Google Analytics cookies, which help us understand how the site is used, are set only if you allow them. Functional cookies, which sign you in to post a review and remember embedded content you chose to always display, are set only if you allow them. Google’s advertising cookies are set only when ads are shown, and in the EEA, the UK and Switzerland only with the consent you give in Google’s consent message. See our cookie policy for the full list and how to control them.

Our other analytics tool, Ahrefs Web Analytics, is cookieless, so it sets nothing on your device and needs no entry in the consent banner.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these, email contact@betterbuybase.com and we will respond within one month.

Automated decisions

We make no decisions about you by automated means and build no profiles of visitors ourselves. Google Analytics shows us traffic in aggregate, never a named person. If you consent to personalized ads, Google and its partners may use data about your visits to choose the ads you see, as Google’s consent message explains. The scores on this site rate products, not people.

Right to complain

If you believe we have mishandled your data, you can lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), at www.dataprotection.ro, or with the authority in your own EU country.

Children

The site is intended for general audiences and is not directed at children under 16. We do not knowingly collect their data.

Contact

Questions about privacy or your data? Email us at contact@betterbuybase.com.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change affects what you agreed to in the cookie banner, the banner asks you again.

We keep this policy up to date as the site evolves. It is written to reflect our actual practices but is not a substitute for tailored legal advice.