Privacy Policy
Version 1.1 · Effective 2026-08-28
This policy explains what personal data we collect, why we collect it, how long we keep it and what you can do about it. It covers this website and the work we do for clients.
Cookies and similar technologies are described in more detail in the Cookie Policy. Where we handle personal data on behalf of a client rather than for ourselves, the Data Processing Agreement governs instead.
Who Is Responsible for Your Data
FORMA DIGITAL S.R.L., registered office Str. Ghimbavului nr. 68, Hălchiu, Brașov 507080, Romania, unique registration code (CUI) 50645445, is the controller of the personal data described in this policy. That means we decide why it is processed and how.
For anything to do with data protection, including a request about your own data, write to privacy@forma.marketing. That address reaches the people who run the studio directly.
We have not appointed a Data Protection Officer, because none of the criteria in Art. 37 of the GDPR apply to us. We are not a public authority, our core activity is not regular and systematic monitoring of people on a large scale, and we do not process special category data on a large scale. Data protection enquiries go to the address above.
What We Collect
What we hold about you depends on how you come into contact with us.
Visitors to this website Your IP address, browser user agent, the pages you request and the time you request them, recorded in server logs. If, and only if, you accept analytics in the cookie banner, Google Analytics also sets identifiers that let us count visits and see which pages get read.
People who email us Whatever your message contains. Usually that is your name, your email address, the organisation you work for and a description of what you want built. We do not ask for more than you choose to send.
People who use the contact form Your name, email address, company, the country you select, the budget range you select and your message. The submission is relayed to our inbox by Web3Forms, a form-backend service described in the table below, and the form sends nothing else.
People who book a call Your name, email address, time zone and the slot you choose, collected through Cal.com when you book a discovery call.
Clients Billing identity, including registered name, registered address and CUI or tax number; contact details for the people we work with on your side; credentials and access you grant us to your systems; and the copy, images, data and other content you supply for the project.
Where a client gives us contact details for their own staff, we receive that data from the client rather than from the individual concerned. This policy is the information we provide to those individuals under Art. 14 of the GDPR, and we ask the clients who nominate them to make them aware of it.
We do not knowingly collect special category data under Art. 9 of the GDPR, such as health data, biometric data, or information about political opinions, religion or trade union membership. Please do not send us any. If you do, we delete it unless we are legally required to keep it.
We sell to businesses and this site is not directed at children. We do not knowingly collect personal data from anyone under 16.
Why We Use It, and Our Legal Basis
Every purpose we process personal data for is listed below, with the ground under Art. 6(1) of the GDPR that permits it. If a purpose is not in this table, we are not processing your data for it.
| Purpose | Data used | Legal basis |
|---|---|---|
| Replying to an enquiry you send us by email or the contact form | Name, email address, company name, location, budget range, what you tell us about your project | Art. 6(1)(b) steps taken at your request before entering a contract |
| Scheduling and holding a discovery call | Name, email address, time zone, chosen slot | Art. 6(1)(b) steps taken at your request before entering a contract |
| Delivering the services you have engaged us for | Contact details of your staff, access credentials you provide, project content | Art. 6(1)(b) performance of our contract with you. For the contact details of your staff, who are not parties to that contract, Art. 6(1)(f) our legitimate interest in communicating with the people you nominate |
| Issuing invoices and keeping accounting records | Billing name, registered address, CUI or tax number, amounts, payment records | Art. 6(1)(c) compliance with our legal obligations under Romanian accounting and tax law |
| Measuring how the website is used | Pseudonymous usage events and Google Analytics identifiers | Art. 6(1)(a) your consent, given through the cookie banner and withdrawable at any time |
| Keeping the site available and preventing abuse | IP address, user agent, request timestamps in server logs | Art. 6(1)(f) our legitimate interest in the security and availability of our own site |
| Referring to completed work in our portfolio | Client name, project description, screenshots of delivered work | Art. 6(1)(f) our legitimate interest in demonstrating our work, subject to the opt-out in our Client Services Agreement |
Where we rely on legitimate interest, we have weighed that interest against your rights and concluded that it does not override them. You can object at any time, and we explain how under Your Rights below.
Where we rely on consent, you can withdraw it at any time using the Cookie Settings link in the site footer. Withdrawing is as easy as giving it, and it costs you nothing else on the site.
How Long We Keep It
We keep personal data for as long as it serves the purpose it was collected for, or for as long as the law requires, whichever is longer. Then we delete it.
| What | How long | Why that long |
|---|---|---|
| Enquiries that do not become engagements | 24 months from last contact | So we have context if you come back to us, after which the correspondence is deleted |
| Discovery call bookings | 12 months from the call | Short operational record of scheduling |
| Client contract records and project correspondence | The term of the engagement plus 3 years | The general limitation period for civil claims under Romanian law |
| Invoices and accounting documents | 10 years from the end of the financial year | Required by Law no. 82/1991 on accounting |
| Server logs | No longer than 14 days | Security monitoring and diagnosing faults. Our hosting provider keeps access and connection logs for at most 14 days, and we do not copy them anywhere that outlives that |
| Google Analytics data | 14 months once analytics is enabled | Analytics is not yet switched on. When it is, the retention period on our Analytics property will be set to 14 months, after which Google deletes the data. |
Your cookie preference is different: it is stored in your own browser, not on our servers, and it never reaches us. It stays there until you clear your browser storage or until we publish a new consent version, at which point you are asked again.
Credentials and access a client grants us are held only for the engagement. We revoke them and remove them from our password manager when the work ends.
Work shown in our portfolio stays published until the client asks us to take it down or we retire the case study. The opt-out is in the Client Services Agreement, and you can also object under Art. 21 as described below.
Who We Share It With
We do not sell personal data and we do not trade it. We share it only with the service providers we need in order to operate. Each of them acts as a processor for us: they may use the data solely to provide their service, and solely on our instructions, as Art. 28 of the GDPR requires.
| Recipient | Role | Location | Purpose | Transfer safeguard |
|---|---|---|---|---|
| netcup GmbH | Hosting provider | Nürnberg, Germany (EU) | Serving the website and storing server logs | No third-country transfer: hosting runs on EU data centres. |
| Google Ireland Limited | Email and productivity (Google Workspace) | Ireland (EU), with support access outside the EEA | Receiving and storing email correspondence and client documents | EU Data Protection Terms; Standard Contractual Clauses for onward transfers. |
| Google LLC | Analytics (Google Analytics 4) | United States | Measuring aggregate website usage, only where analytics consent is given | EU-US Data Privacy Framework and Standard Contractual Clauses. |
| Cal.com, Inc. | Appointment scheduling | San Francisco, California, United States | Booking discovery calls; receives name, email address and time zone | No explicit EU-US Data Privacy Framework or Standard Contractual Clauses cited in current public policy; transfer safeguard is Cal.com's general GDPR commitment plus an EU Representative appointed under GDPR Article 27. |
| Web3Creative (Web3Forms) | Contact form backend | United States and EU (AWS; Hetzner in Germany/Finland) | Receiving contact-form submissions from this website and relaying them to our inbox | Standard Contractual Clauses incorporated in Web3Forms’ Data Processing Agreement; submissions stored encrypted at rest with configurable retention. |
| Stripe Payments Europe Ltd. | Payment processing (EEA card transactions) | Ireland (EU) | Processing card payments invoiced to clients inside the EEA | EU leg of payment processing handled inside the EU. Any onward transfer to Stripe, LLC in the United States relies on the EU-US Data Privacy Framework (with UK and Swiss extensions) per Stripe, LLC's published DPF Policy. |
| Stripe, LLC | Payment processing (US card transactions and global infrastructure) | South San Francisco, California, United States | Processing card payments invoiced to US clients and providing the underlying payment infrastructure | EU-US Data Privacy Framework (with UK and Swiss extensions), as set out in Stripe, LLC's published DPF Policy (effective 2026-04-28). |
Beyond that list, accounting documents go to our accountant, and we disclose data to public authorities or a court where the law obliges us to. If the business were ever sold or restructured, data would pass to the acquirer on the same terms, and we would tell affected clients before it happened.
Transfers Outside the EEA
This site is hosted in Germany, so serving a page to you involves no transfer outside the EEA.
Four services do involve transfer to the United States: Google Analytics, Cal.com when you book a call, Stripe when you pay an invoice by card, and Web3Forms when you use the contact form. Web3Forms’ own sub-processors include US-based spam filters (CleanTalk and Akismet), which receive your email address and IP address to assess the submission. Our email and documents sit with Google Ireland Limited inside the EU, with support access from outside the EEA.
The safeguard each of them relies on is named in the table above. If you want to see the mechanism that applies to your data, ask at privacy@forma.marketing and we will send you a copy.
If you refuse analytics in the cookie banner, no analytics data about you reaches the United States at all. The Google Analytics tag is only loaded after consent, so without it no request is ever made.
Your Rights Under the GDPR
You have the following rights over the personal data we hold about you.
- Access (Art. 15): to be told whether we hold data about you, and to receive a copy of it together with the detail in this policy applied to your case.
- Rectification (Art. 16): to have inaccurate data corrected and incomplete data completed.
- Erasure (Art. 17): to have data deleted where we no longer have a ground to keep it. This does not reach invoices and accounting records, which Romanian law requires us to retain for the period given above.
- Restriction (Art. 18): to have us hold data without using it, for example while we check whether it is accurate or while an objection is being considered.
- Portability (Art. 20): to receive the data you gave us in a structured, commonly used, machine readable format, and to have it sent to another provider where that is technically feasible.
- Objection (Art. 21): to object to any processing we base on legitimate interest, including our use of completed work in our portfolio. We stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.
- Withdrawal of consent (Art. 7(3)): to withdraw analytics consent at any time through the Cookie Settings link in the site footer. Withdrawal does not affect processing already carried out while the consent was in place.
To exercise any of these, write to privacy@forma.marketing. We respond within one month. If a request is complex, or if you have made several, we may extend that by up to two further months, and we will tell you inside the first month if we do.
We may ask you for information that confirms your identity before we act, so that we do not hand your data to somebody else. Exercising these rights is free. We would charge a reasonable fee, or decline and explain why, only where a request is manifestly unfounded or excessive.
Complaints to the Supervisory Authority
If you think we have handled your personal data wrongly, please tell us first at privacy@forma.marketing so that we have a chance to put it right.
You may also complain to the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), at any time and without telling us first.
ANSPDCP, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania. Website: dataprotection.ro.
If you live or work in another EU or EEA country, you may complain to the supervisory authority there instead.
If You Are in the United States or Canada
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to our commercial handling of your personal information, regardless of how small we are. You may ask us what we hold about you and ask us to correct it, and if our answer does not satisfy you, you may complain to the Office of the Privacy Commissioner of Canada.
If you are in the United States, the position is different and we would rather be straight about it. We are a Romanian company far below the revenue and volume thresholds at which the California Consumer Privacy Act and comparable state privacy laws bind a business, so those laws do not apply to us. We nevertheless extend the same rights voluntarily to anyone who asks.
- Know what categories of personal information we hold about you, and why we hold them.
- Get a copy of that information.
- Have it corrected if it is wrong.
- Have it deleted, except where Romanian accounting law requires us to keep it.
Two things are worth stating in the words those laws use: we do not sell personal information, and we do not share it for cross-context behavioural advertising. We run no advertising or ad-targeting tags on this site.
Requests under this section go to the same place as everything else, privacy@forma.marketing. We handle them on the timescale set out under Your Rights above.
How We Protect It
Our measures are proportionate to what we actually hold, which is business contact details, project material and accounting records rather than large volumes of sensitive data. These are the measures in place today.
- Traffic between your browser and this site is encrypted in transit with TLS.
- The site is hosted inside the EU, at netcup GmbH, Nürnberg, Germany.
- Access to client data is limited to the two people who run the studio. No one outside the two of us has an account with us.
- The accounts that hold client data are protected with multi-factor authentication.
- Credentials a client gives us are kept in a password manager, are not passed around over email or chat, and are revoked when the engagement ends.
- We never store client payment card data on our systems. Most invoices are paid by card through Stripe; bank transfer remains available on request. When you pay by card you are redirected to Stripe's checkout, where your card details are handled by Stripe under their own terms. Stripe Payments Europe Ltd. (Ireland) processes EEA card transactions; Stripe, LLC in the United States provides the underlying infrastructure and processes US-card transactions. Stripe, LLC participates in the EU-US Data Privacy Framework. See Cookies for what Stripe itself sets in your browser when you reach its checkout domain.
We hold no security certification and we do not claim one. No set of measures makes a system perfectly safe, and we do not pretend otherwise.
If a personal data breach occurs that is likely to result in a risk to your rights, we notify ANSPDCP within 72 hours of becoming aware of it, and we tell you directly where the risk to you is high.
No Automated Decision-Making
We do not make decisions about you by automated means that produce legal effects concerning you or similarly significantly affect you, and we do not profile you. Nothing on this site scores, ranks or segments the people who visit it.
We do build AI automations for clients. Those run on the client systems and on the client data, where the client is the controller and we act as a processor on their instructions. What we may and may not do in that role is set out in the Data Processing Agreement, not here.
Changes to This Policy
The version number and effective date at the top of this page always identify the current version. We update the policy when what we do changes, or when the law does.
Where a change is material, we announce it on the site rather than quietly replacing the text.
Where a change affects processing that rests on your consent, we ask for your consent again rather than carrying over the consent you gave to an earlier version.
How to Reach Us
Data protection matters, including any request about your personal data: privacy@forma.marketing.
Everything else: hello@forma.marketing.
Postal correspondence: FORMA DIGITAL S.R.L., Str. Ghimbavului nr. 68, Hălchiu, Brașov 507080, Romania.