Notice
Privacy Policy
Last updated: 6 October 2026
Who processes your data
The data controller is the company below. For any request about your data, write to the email address shown.
- BRAND MENTORS S.R.L.
- CUI: RO39117856
- Trade Register: J40/4425/2018
- Registered office: Intrarea Cosmina nr. 54-62, scara 2, etaj 2, ap. 31, Sectorul 5, București
- hello@selfdezign.ro · +40 721 528 448
What we collect and why
| Where | What data | Why |
|---|---|---|
| Contact form | Name, email, phone (optional), project type, city, budget, message. If you write from the chat and leave the box ticked, the chat conversation too. | To answer your request. Basis: pre-contractual measures, Art. 6(1)(b). Without an email or a phone number we cannot answer your request. |
| Request source | Campaign parameters in the page address (utm_source, utm_medium, utm_campaign) and the site you came from | Sent with your request, so we can measure which campaigns bring requests. Basis: legitimate interest, Art. 6(1)(f). |
| Ad click identifiers | fbclid (Meta) and gclid (Google), when present in the page address | Sent with your request only if you accepted marketing in the banner. Basis: consent, Art. 6(1)(a). |
| Request classification | The message, project type, budget and city. Your name, email, phone and IP address are not sent for classification. | Runs only if you accepted marketing in the banner. An automatic model gives the request a score. The classification score does not decide whether you get an answer. A person reads every request. The score is kept together with the request. Basis: consent, Art. 6(1)(a). |
| Bookings | Name, email, chosen time | Through Calendly, to set up the conversation. Calendly loads only after you press the booking button. Basis: pre-contractual measures, Art. 6(1)(b). |
| Newsletter signup | Email address, name (optional), IP address | To send you articles and confirm your subscription. Basis: consent, Art. 6(1)(a). Unsubscribe from any message. |
| Chat assistant | The messages you write, the page and its title, the site you came from, the language, a session identifier, an excerpt of the answer | To answer your question. The messages go to Google (Gemini) and pass through the TypeSafe abuse check. The questions are saved in our CMS. Basis: legitimate interest, Art. 6(1)(f). Do not enter sensitive data in the chat. |
| Statistics | Google Analytics cookies, on-site behaviour | Only if you accept statistics in the banner. Basis: consent, Art. 6(1)(a). |
| Marketing | Meta Pixel cookies, device identifiers | Only if you accept marketing in the banner. Basis: consent, Art. 6(1)(a). |
| Technical logs | IP address, browser type, request time | Security and abuse limiting. Basis: legitimate interest, Art. 6(1)(f). |
Who we share it with
We do not sell your data to anyone. We share it only with the providers below, strictly for the stated purposes. Requests are copied into our internal project management application (SD Business Hub), in the same database. The consent banner has two categories, chosen separately: statistics and marketing. Providers marked «only with your consent» receive nothing if you decline their category. The contact form does not depend on that consent: your request reaches us and you receive the email confirmation whatever you choose in the banner. If you decline, Google and Meta do not receive the signal that you submitted a request. Without consent to marketing, we do not send fbclid and gclid with your request and we do not classify your request through TypeSafe. For transfers to the USA we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and on standard contractual clauses where it is not.
| Provider | For what | Where |
|---|---|---|
| Supabase | database: contact requests, classification score, newsletter subscribers | EU (Ireland) |
| Our own CMS (cms.selfdezign.ro) | chat questions | EU (Germany), on a Contabo server |
| MailerLite | sending the newsletter, confirming the subscription | EU (MailerLite Limited, Ireland); data stays in the EU |
| Resend | sending emails | USA, Data Privacy Framework |
| Vercel | site hosting and technical logs | EU / USA, Data Privacy Framework |
| Cloudflare Turnstile | anti-bot form verification; loads only when you start filling in the form | EU / USA, Data Privacy Framework |
| Calendly | booking conversations; loads only after you press the booking button | USA, Data Privacy Framework |
| Google Analytics 4 | traffic statistics, only with your consent to statistics | EU / USA, Data Privacy Framework |
| Meta | campaign measurement, only with your consent to marketing | EU / USA, Data Privacy Framework |
| Google (Gemini) | chat assistant answers | USA, Data Privacy Framework |
| TypeSafe (Jev), via OpenRouter | abuse check on chat messages; classification of contact requests, only with your consent to marketing | USA, standard contractual clauses. The data passes through OpenRouter, which forwards it to TypeSafe. |
How long we keep it
Contact requests, with their source and score: 3 years from the last exchange. Newsletter signups: until you unsubscribe; after you unsubscribe we keep the address, so we do not write to you again. Chat conversations: 12 months. Technical logs: 30 days. Billing data: 10 years, as accounting law requires.
Your rights
Under Articles 15-22 of Regulation (EU) 2016/679, you have the right of access, rectification, erasure, restriction, portability and objection, plus the right to withdraw consent at any time. Withdrawal does not affect processing carried out before it. We reply within 30 days.
How to withdraw consent: from the footer, under «Cookie settings», or write to hello@selfdezign.ro. When you withdraw, we delete the statistics and marketing cookies.
If you are not satisfied
You have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP), Bd. Gheorghe Magheru 28-30, Bucharest, anspdcp.ro.