Privacy policy.

02What data we collect

We only collect what you give us and what is technically needed to show you this website:

• Contact form and email: your name, email address, company name (optional), and whatever you write in your message — usually a description of your space or project.
• Technical data: when you visit, your browser sends your IP address, browser and device type, the page requested and the time. Our hosting provider processes this to deliver the site and protect it from abuse.

We do not use analytics, advertising or social media tracking, and we do not build profiles of visitors.

03Why we use it, and on what legal basis

• To answer your enquiry and, if you ask for one, to prepare a proposal — necessary to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR), or our legitimate interest in replying to messages sent to us (Art. 6(1)(f)).
• To run the website and keep it secure — our legitimate interest in a working, protected site (Art. 6(1)(f)).
• To meet legal obligations, such as keeping accounting records if you become a client (Art. 6(1)(c)).

We do not use your data for automated decision-making, and we will not send you marketing unless you have asked for it.

04Cookies

This website does not place cookies and does not store anything in your browser to track you. The site picks a language from the settings your browser sends with each request, without remembering anything. If we ever add cookies that are not strictly necessary, we will ask for your consent first and update this policy.

05Who receives your data

We do not sell or rent your data. We share it only with service providers that process it on our behalf, under a data processing agreement:

• Cloudflare, Inc. — hosting and content delivery for this website, and delivery of contact-form messages to our inbox.
• Sanity AS — stores the project content and delivers the project images you load.
• Microsoft Ireland Operations Ltd. (Microsoft 365) — hosts our mailbox, where your messages are stored.

We may also disclose data where the law requires it, for example to a public authority.

06Transfers outside the EU

Some of these providers, or their sub-processors, may process data outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.

07How long we keep it

• Enquiries: as long as needed to handle your request, and at most two years after our last contact, unless the conversation leads to a contract.
• Client records: for as long as Romanian accounting and tax law requires.
• Technical logs: kept by our hosting provider for a short period, normally days, for security purposes.

08Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have it corrected if it is inaccurate, or erased;
• restrict or object to how we process it;
• receive it in a portable format;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these, email us. We will reply within one month. You also have the right to complain to a data protection authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), or the authority in the country where you live, such as the Autoriteit Persoonsgegevens in the Netherlands.

09Security

The website is served over an encrypted connection (HTTPS), and access to messages and content is limited to the people who need it. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

10Changes to this policy

We may update this policy when the website or the law changes. The date at the top of this page shows when it was last revised.