This policy explains what personal data we process when you visit the website or contact us, why, how long we keep it and what your rights are, under Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018. The Romanian version prevails in case of discrepancy.
1. Who we are
The data controller is:
- WHY DESIGN EXCLUSIVE SRL
- Address: str. Anul 1907 nr. 49, Sibiu
- Email: office@whydesign.ro
- Phone: 0748 122 078
For any question about your data, write to us at office@whydesign.ro.
2. What data we process
- When you fill in the contact form: name, email address, phone (optional), the service you need, project type, city and approximate area.
- When you email or call us: the data you choose to share and the content of the conversation.
- Technical data: IP address, browser type and pages visited appear in the hosting server logs, and the website uses the strictly necessary cookies described in the Cookie policy.
- Proof of your cookie choice: a random code, your choice, the policy version and the date. We do not store your IP address and cannot link this record to your name.
We do not use traffic analytics tools, we do not profile visitors and we do not show ads.
3. Why we process it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your request and preparing an offer | Art. 6(1)(b) — steps taken at your request before entering into a contract |
| Performing the design contract, if we work together | Art. 6(1)(b) — performance of a contract |
| Accounting and tax records (invoices, contracts) | Art. 6(1)(c) — legal obligation |
| Website security, preventing automated messages and abuse | Art. 6(1)(f) — our legitimate interest in protecting the website |
| Proof of cookie consent | Art. 6(1)(c) together with Art. 7(1) |
| Playing YouTube videos on the Media page | Art. 6(1)(a) — your consent, which you can withdraw at any time |
Providing your data is not mandatory, but without a name and email we cannot answer your request. We do not make decisions based solely on automated processing.
4. How long we keep the data
- Contact form requests: 24 months from receipt, then deleted automatically. If we sign a contract, the necessary data becomes part of the project file.
- Contracts and accounting documents: the period required by tax and accounting law (usually 10 years, under Law no. 82/1991).
- Proof of cookie choice: 3 years, then deleted automatically.
- Server logs: the period set by the hosting provider, strictly for security.
5. Who we share the data with
We do not sell or rent your data. Only to the extent necessary, it may be accessed by:
- our web and email hosting provider, acting as a processor under a contract;
- our accountant and advisers, who are bound by confidentiality;
- public authorities, only when the law requires it;
- YouTube (Google Ireland Limited), only if you choose to play a video on the Media page.
6. Transfers outside the European Economic Area
We do not transfer data outside the EEA. If you accept YouTube videos, Google may transfer data to Google LLC (USA), which is certified under the EU-U.S. Data Privacy Framework, recognised by the European Commission's adequacy decision of 10 July 2023.
7. Your rights
You have the right:
- to access your data and receive a copy of it;
- to have inaccurate data rectified;
- to have your data erased (the "right to be forgotten");
- to restrict processing;
- to data portability;
- to object to processing based on legitimate interest;
- to withdraw your consent at any time, without affecting processing carried out before (for cookies, using the "Cookie settings" button in the page footer).
To exercise your rights, write to us at office@whydesign.ro. We reply within one month of receiving your request.
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., sector 1, Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro.
8. How we protect the data
The website uses an encrypted connection (HTTPS), security headers that block code from other sources, protection against forged form submissions (CSRF) and a limit on the number of submissions. Access to received requests is restricted to the people who handle them.
9. Children
The website is not aimed at people under 16 and we do not knowingly collect data about them.
10. Changes
We may update this policy when the law or the way we work changes. The date of the last update is shown at the top of the page.