Privacy
What data we use when you visit or contact us, why we need it, and how to exercise your rights.
Last updated:
Who is responsible
The data controller is GLITZ&GRAF AGENCY SRL, CUI 49445834, J2024001076400, Calea Moșilor 88, 030152, Sector 3, București, România.
Contact gdpr@glitzandgraf.com about personal data. For project enquiries, use contact@glitzandgraf.com.
Cloudflare Turnstile form protection
Cloudflare hosts the site and checks form requests to limit spam and abuse. Turnstile processes technical connection and browser information. The check runs in the background and may request interaction when necessary. We do not send the message fields to Turnstile.
Abuse prevention uses counters separate from email messages, based on a cryptographic fingerprint of the IP address and a 10-minute time window. Expired counters are removed on subsequent requests. These protections are separate from optional traffic analytics.
Data we receive
Do not include passwords, payment details or sensitive information that is unnecessary for the enquiry.
- Through the form or email: your name, email, company (optional) and message.
- To deliver and protect the site: connection data such as IP address, browser information and server requests. This is separate from traffic analytics.
- With your Analytics consent: online identifiers, pages visited and site interactions. We do not send form contents to Analytics.
Purposes and legal bases
- Enquiries and project discussions: steps requested before a contract, or our legitimate interest in managing professional enquiries, depending on the circumstances.
- Project delivery: performance of the contract and related communication.
- Legally required records: the applicable legal obligation.
- Operation, abuse prevention and security: our legitimate interest in protecting the service and correspondence.
- Traffic analytics: your consent, which can be withdrawn in cookie preferences.
The form and our providers
The form sends the message through the site server to our mailbox using Microsoft 365. It does not create a separate message database; messages remain in email correspondence.
People handling your enquiry and infrastructure, hosting, security and email providers may access data as necessary. Google receives analytics data only when configured and accepted. Data may be disclosed to authorities where legally required.
Some providers may process data outside the European Economic Area. Locations and transfer arrangements depend on the services and configuration used. Contact our privacy address for information about the recipients and safeguards applicable to your data.
How long we keep data
We keep an enquiry as needed to answer it and continue the discussion. If a project starts, relevant information is kept for its delivery and related legal obligations.
Retention depends on the enquiry, the progress of discussions, legal duties and the need to document rights or claims. We do not use one fixed period for every message. You may ask for details or deletion; we will explain if some records must be retained.
Your rights and how to use them
Send requests to gdpr@glitzandgraf.com. Rights depend on the circumstances and legal basis. We normally respond within one month; if a lawful extension is needed, we tell you within that month. We may request only the information needed to verify identity.
You may complain to ANSPDCP, the Romanian data protection authority, without contacting us first.
- Request access to your data and correction of inaccurate information.
- Request deletion or restriction and, where applicable, data portability.
- Object to processing based on legitimate interests, subject to GDPR conditions.
- Withdraw analytics consent at any time without affecting earlier lawful processing.
What is optional
Analytics consent is not required to use the site or form. Company is optional. Name, email and message are required to handle a form enquiry; you can also email us directly.
We do not use form data for solely automated decisions with legal or similarly significant effects, or sell personal data. Social media and other external links lead to services with their own policies.