Your GDPR rights

The lawful basis depends on the purpose: pre-contractual steps requested by you (Article 6(1)(b)) for a quote; legitimate interest (Article 6(1)(f)) for general correspondence, security and abuse prevention; legal obligation (Article 6(1)(c)) for required records; and performance of a contract (Article 6(1)(b)) if a separate contract is concluded. Analytics is inactive. Future optional statistics processing would require prior information and consent.

We do not currently use Google Analytics or collect usage statistics through that service. Any future activation requires an updated notice describing the actual provider, transfers and applicable safeguards.

Hosting and email are provided by Spatiul.ro, with servers in Romania, inside the EEA. The form currently uses no external verification service. If we enable Cloudflare Turnstile (Cloudflare, Inc., USA), the transfer will rely on the provider’s certification under the EU-U.S. Data Privacy Framework and on standard contractual clauses, and this notice will be updated first.

To exercise your rights, write to office@zemos.ro or to the controller’s registered office. We reply without undue delay and in any case within one month of receipt. Depending on the complexity and number of requests, this may be extended by up to two further months; we inform you of any extension and the reasons within the first month. Requests are free of charge, except in the manifestly unfounded or excessive cases set out by the GDPR.

If you believe we have handled your data improperly, you have the right to lodge a complaint with the Romanian authority:

• ANSPDCP (the National Supervisory Authority for Personal Data Processing)
• Website: dataprotection.ro
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, Romania

You may also complain to the authority of the EU country where you live or work, if different.

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. Any decisions affecting your relationship with us are made by people, not algorithms.

A personal data breach is assessed and documented, with measures to limit its effects.

• Under Article 33 GDPR, the supervisory authority is notified without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to people’s rights and freedoms. A delay must be explained.
• Where a high risk requires communication to affected people under Article 34 GDPR, they are informed without undue delay, subject to the conditions and exceptions in that article.
• The breach, its effects and corrective measures are documented.