Privacy policy

1. Data controller

The controller of the personal data processed through this site is:

• Name: BRUTALIS SOFTWARE & DIGITAL SOLUTIONS SRL
• Unique registration code (CUI): 52828732
• Trade Register number: J2025084406005 (EUID ROONRC.J2025084406005), registered on 3 November 2025
• Registered office: Scheia village, DC Scheia, postal code 727525, Suceava County, Romania
• Email: office@brutalis.ro
• Phone: +40 750 472 764

2. Legal framework

We process data in line with Regulation (EU) 2016/679 (GDPR), Law no. 190/2018 implementing the GDPR, Law no. 506/2004 on the processing of data in electronic communications (implementing Directive 2002/58/EC) and Law no. 365/2002 on electronic commerce.

We have not appointed a data protection officer (DPO) because we are not required to under art. 37 GDPR. For any question you can write to the email address above.

3. What data we process and why

Through the contact form:

• data: name, email address, phone number (optional), your message, the indicative budget chosen, the services ticked and your choice about receiving ideas and news;
• purpose: to answer your request and prepare an offer, which are steps before entering into a contract (art. 6(1)(b) GDPR);
• purpose: keeping the history of discussions and documents when a contract is concluded and the law requires it (art. 6(1)(c) GDPR);
• purpose: occasionally sending ideas about web design and SEO, only if you tick the dedicated box (separate from the message and unticked by default); the basis is your prior express consent (art. 6(1)(a) GDPR and art. 12 of Law no. 506/2004). We keep the date and time of consent as proof. Every message identifies us and shows how to unsubscribe; you can withdraw consent at any time, as easily as you gave it (write us an email), without affecting the lawfulness of earlier processing. We do not send commercial messages without this consent.

4. Technical data and security

• The IP address is used to limit abuse and automated messages (legitimate interest, art. 6(1)(f) GDPR). With us, the counter stays briefly in the server’s memory and is not stored in a database; the IP address also appears in the hosting provider’s technical logs.
• Your approximate city, derived from the IP address by the hosting network, may be shown only to you to personalise the page; we do not store it.
• We secure the site with an HTTPS connection, strict validation of submitted data, a limit on the number of messages and by keeping access keys only in server environment variables.

5. Who receives the data

Your data is not sold. It may be accessed by:

• our team;
• the site’s hosting provider (Vercel Inc., USA), which processes data as a processor; the server functions run in the Frankfurt (EU) region;
• the Telegram messaging service, through which form messages reach us in a private group that only the team can access (see section 6);
• public authorities, where the law requires it (for example the tax authority).

6. Transfers outside the EEA

When data is transferred outside the EEA, we rely on the mechanisms of Chapter V GDPR. For our US hosting provider the mechanism is the EU–US Data Privacy Framework (an adequacy decision) for certified providers.

Telegram has no adequacy decision. According to its privacy policy, data of users in the EEA is stored in data centres in the Netherlands, and transfers to its group entities (British Virgin Islands, Dubai) rely on the standard contractual clauses approved by the European Commission; Telegram also has an EU representative (art. 27 GDPR). We use Telegram only to receive your message, in a private group with limited access, and we delete messages within the periods in section 7. Please do not send sensitive data through the form (for example health data or passwords).

If you prefer not to use Telegram for your request, you can write to us directly at the email address on this page. You can ask for details about the transfer safeguards at the same address.

7. How long we keep data

• form messages and correspondence without a contract: up to 12 months after the last message, then we delete them;
• documents tied to a concluded contract: for the term of the contract and then for the periods required by law (for example those in Accounting Law no. 82/1991);
• consent for ideas and news: until withdrawn or up to 24 months without interaction; we keep proof of the consent and of its withdrawal for another 3 years (the general limitation period), so we can defend ourselves in a possible dispute;
• the hosting provider’s technical logs: under its policy, for short periods.

8. Your rights

Under the GDPR you have the right to:

• access your data and get a copy (art. 15);
• rectify inaccurate data (art. 16);
• erasure, the “right to be forgotten” (art. 17);
• restrict processing (art. 18);
• data portability (art. 20);
• object, especially to processing based on legitimate interest (art. 21);
• withdraw consent at any time (art. 7(3));
• not be subject to a decision based solely on automated processing; we make no such decisions and do no profiling.

9. How to exercise your rights and complaints

Write to us at the email address above. We answer within one month at most, a period that can be extended under art. 12 GDPR.

You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP): 28-30 G-ral Gheorghe Magheru Blvd., sector 1, Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro. Please give us the chance to solve the issue first, but you are not obliged to.

10. Minors

The site is not aimed at children under 16 (the age from which, in Romania, a minor can give their own consent to information society services under art. 8 of Law no. 190/2018). If you learn that a minor has sent us data, write to us for deletion.

11. Cookies

Details about cookies and local storage are in the Cookie Policy.

12. Changes

We may update this policy; the version in force is the one on this page, with its last-updated date. For important changes we also inform you in other ways where possible.