Last updated: 16 October 2026

Zephyr Privacy SRL is the controller of the personal data collected and processed through this website. This means we decide why and how your data is used, and we are responsible for it. This Notice explains what we collect, why, who we share it with, how long we keep it, and what rights you have. If we make significant changes, we will update the date above and, where we have your contact details and the change affects you, tell you directly.

1. Introduction and Identity of the Controller

Zephyr Privacy SRL ("we", "us", "our") processes personal data through this website, and for the purposes set out in this Notice, in line with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Romanian law that applies it (Law 190/2018).

This Notice covers personal data processed through zephyr-privacy.com and the communication channels linked to it, such as e-mail and our contact form.

2. Where Your Personal Data Comes From

We collect personal data from the following sources:

• Directly from you: through our website contact form, e-mail, telephone, or during visits to our premises.
• Referrals: clients or partners who recommend us may pass on your contact details to us.
• Automatically, when you visit our website: technical data such as your IP address and browser type, collected by our hosting provider to run and protect the site (see 3.4).

3. Why We Use Your Data, on What Legal Basis, and for How Long

We use your personal data only for the purposes listed below. Each one has a legal basis under Article 6 GDPR, and we keep data only for as long as we need it (Article 5(1)(e) GDPR).

Giving us your data is your choice. If you don't give us your contact details, we can't reply to you or send you our newsletter. If you become a client, some data, such as billing details, is required by law and by our contract, and without it we can't provide our services.

We do not use your data to make decisions about you by automated means only.

3.1 Responding to Requests and Enquiries

Purpose

We use your personal data to reply to questions and requests sent through our contact form, e-mail or other channels. We may keep a record of your request and contact you with an answer or to ask for more details.

Personal data collected

First name, company name, e-mail address, telephone number, your message, and any other information you choose to share with us.

Legal basis

Our legitimate interest in answering and managing the requests we receive (Article 6(1)(f) GDPR). We have assessed this interest against your rights. Where your enquiry is about becoming a client, the processing is also needed to take steps at your request before entering into a contract (Article 6(1)(b) GDPR).

Recipients

Our website hosting and e-mail providers, who process data only on our instructions. Public authorities, where the law requires it.

Retention period

For as long as our communication lasts, plus 3 years afterwards. This matches the general time limit for legal claims under Romanian law.

3.2 Marketing E-mails and Newsletters

Purpose

We send e-mails about events, offers and news related to our services. We do this if you have agreed to receive them, or if you are an existing client and the e-mail is about services similar to those we have already provided to you. Every e-mail includes a link to unsubscribe.

Personal data collected

Name and e-mail address.

Legal basis

Your consent (Article 6(1)(a) GDPR). You can withdraw it at any time, as easily as you gave it. For existing clients, our legitimate interest in telling you about similar services (Article 6(1)(f) GDPR), as allowed by Romanian electronic communications law (Law 506/2004). You can object at any time, and we will stop straight away, with no questions asked (Article 21(2)-(3) GDPR).

Recipients

Our website hosting provider and our e-mail marketing provider, who process data only on our instructions. Public authorities, where the law requires it.

Retention period

Until you unsubscribe or withdraw your consent. For existing clients, until you object, or at the latest 3 years after our last contract with you ends. After you unsubscribe, we keep a record of your opt-out so we don't contact you again, and a record of your consent for 3 years so we can prove it was given.

3.3 Providing Our Services

Purpose

When we sign a contract with you or provide you with services, we use the personal data needed to deliver them, including invoicing, managing our relationship and follow-up support.

Personal data collected

Full name, e-mail address, telephone number, billing address, payment details, signature.

Legal basis

Performing our contract with you, for everything strictly needed to provide the services, including invoicing and account management (Article 6(1)(b) GDPR). Complying with our legal obligations under tax, accounting and record-keeping laws (Article 6(1)(c) GDPR).

Recipients

Our website hosting and e-mail providers. Independent professionals such as accountants or lawyers. Public authorities, where the law requires it.

Retention period

Contract data: for the duration of the contract, plus 3 years after it ends. Accounting records, such as invoices: 5 years from 1 July of the year after the financial year ends, as required by Romanian accounting law (Law 82/1991).

3.4 Running and Protecting Our Website

Purpose

When you visit our website, our hosting provider automatically processes some technical data so the site can load, work properly and be protected against attacks and misuse.

Personal data collected

IP address, browser and device type, pages requested, and the date and time of your visit.

Legal basis

Our legitimate interest in keeping our website working and secure (Article 6(1)(f) GDPR).

Recipients

Our website hosting provider, Wix.com, which processes data on our instructions.

Retention period

For a limited period set by our hosting provider, in line with its security practices.

4. Transfers Outside the European Economic Area

Some of our service providers, such as our website host, may process your personal data outside the European Economic Area ("EEA"). We only allow this when your data stays protected, as required by Chapter V GDPR. In practice, this means that:

• the country has been officially recognised by the European Commission as protecting personal data to a standard essentially equivalent to the EU's (Article 45 GDPR), or
• where there is no such recognition, the transfer is covered by the standard contract clauses approved by the European Commission, together with a check of the laws of the destination country and, where needed, extra technical or contractual safeguards.

You can ask us for details of the safeguards used for any transfer, or a copy of them, at dpo@zephyr-privacy.com.

5. How We Keep Your Data Secure

We use technical and organisational security measures suited to the risks involved, taking into account current technology, cost, the type of data, and how serious any harm to you could be (Article 32 GDPR).

These measures include:

• Encryption of personal data when stored and when sent.
• Access limited to the people who need it for their role.
• Physical access controls to places where personal data is stored.
• Procedures for detecting, reporting and investigating security incidents. Where the law requires it, we notify the Romanian data protection authority and the people affected (Articles 33-34 GDPR).

6. Cookies and Tracking Technologies

Our website only uses cookies in order to properly display the website; we do not track or do analytics for the website. In accordance with the ePrivacy Directive (2002/58/EC as amended), if we ever consider implementing any form of tracking, you will be properly informed and asked to consent to it prior to any action being taken.

You can rest assured: we practice what we preach.

7. Your Rights (Articles 15-22 GDPR)

To use any of the rights below, contact us at dpo@zephyr-privacy.com. We will reply within one month of receiving your request. If your request is complex, or we receive many requests, we may extend this by up to two more months, and we will tell you within the first month if we do (Article 12(3) GDPR).

Right of access (Article 15)

You can ask us to confirm whether we process your personal data and, if we do, get a copy of it. We will also tell you why we use it, what kind of data it is, who receives it, how long we keep it, and how it is protected if it is sent outside the EEA. The first copy is free of charge.

Right to rectification (Article 16)

If the personal data we hold about you is wrong or incomplete, you can ask us to correct or complete it. We will also tell anyone we shared it with about the correction, unless this is impossible or would take disproportionate effort (Article 19 GDPR).

Right to erasure (Article 17)

You can ask us to delete your personal data where: we no longer need it for the purpose we collected it for; you withdraw your consent and we have no other legal basis; you object and we have no overriding legitimate grounds; the processing is unlawful; or the law requires us to delete it. We may refuse where we need to keep the data to meet a legal obligation, or to establish, exercise or defend legal claims.

Right to restriction of processing (Article 18)

You can ask us to pause the use of your data, so that we only store it, while: you contest its accuracy; the processing is unlawful but you prefer us not to delete it; you need the data for a legal claim; or we are considering your objection. We will tell you before we lift the restriction (Article 18(3) GDPR).

Right to data portability (Article 20)

Where we process your data based on your consent or a contract, and by automated means, you can ask us to give it to you in a structured, commonly used and machine-readable format, or to send it directly to another organisation where technically possible.

Right to object (Article 21)

Where we rely on our legitimate interests, you can object at any time for reasons relating to your situation. We will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for legal claims. If you object to marketing, we will always stop, straight away and without needing a reason.

Rights related to automated decisions (Article 22)

You have the right not to be subject to a decision based only on automated processing, including profiling, that has legal or similarly significant effects on you. We do not make such decisions.

Right to withdraw consent (Article 7(3))

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it. We will stop the relevant processing without undue delay.

8. Your Right to Complain to a Data Protection Authority

If you believe we are processing your personal data in breach of data protection law, you have the right to complain to a data protection authority. You can do this in the EU country where you live, where you work, or where the breach happened (Article 77 GDPR). In Romania, the authority is: