Privacy Policy

The data controller responsible for the personal data described in this policy is PAVELS WEB SOLUTIONS SRL, a company registered in Romania under fiscal identification code (CUI) 44099926 and Trade Registry number J40/6699/2021 ("we", "us", "PWS"). We provide web design, web development and related digital services under the Pavels Web Solutions brand.

You can reach us regarding any privacy matter at office@pavels.ro or +40 731 296 191.

We collect personal data in two situations:

• When you contact us. Through the contact form on this website we collect your full name, work email address, phone number, company name and the content of your message. We ask for this information so we can understand your request and reply to you.
• When you browse the website. If you accept analytics cookies, we collect usage data through Google Analytics: pages viewed, time spent on the site, referring website, approximate (anonymised) location, device/browser type, and how you interact with the page — which buttons and links you click, which sections you scroll into view, which FAQ questions you open, and, on the contact form, which field failed validation and where you stopped if you did not submit. This data does not directly identify you. See our Cookie Policy for details.
• When you submit the contact form. At the moment you submit, we generate a short random reference (for example L-4KQ2XM). It contains no information about you. The same reference is added to the message we receive and sent to Google Analytics, which allows us to see which visit led to an enquiry and therefore which parts of the site are useful to people who contact us. Because we hold both the message and the reference, this connects your enquiry to the analytics record of that visit. If you have not accepted analytics cookies, no reference is sent to Google Analytics and no such connection exists.

We do not process any special categories of data (e.g. health, religion, political opinions) and we do not offer any checkout, payment or e-commerce functionality on this particular website, so we do not collect payment card data here.

• To respond to your enquiry and prepare a proposal — necessary to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• To manage a resulting business relationship (project communication, invoicing, accounting records) — performance of a contract (Article 6(1)(b) GDPR) and compliance with Romanian accounting and tax legislation (Article 6(1)(c) GDPR).
• To measure and improve the website through analytics — based on your consent (Article 6(1)(a) GDPR), which you can withdraw at any time as described in our Cookie Policy.
• To protect our website and users (e.g. spam and abuse prevention via ALTCHA) — our legitimate interest in keeping the service secure (Article 6(1)(f) GDPR).

We do not sell your personal data. We share it only with service providers acting as our processors, strictly to the extent needed to operate this website and run our business:

• our WordPress-based content and forms backend, which securely stores the messages submitted through the contact form so our team can respond to them;
• Google LLC, as provider of Google Analytics, when you have consented to analytics cookies;
• our email and hosting providers, to the extent necessary to deliver and store your message and our reply;
• public authorities, where disclosure is required by law (for example, tax authorities or courts).

Our contact form uses ALTCHA, a self-hosted, privacy-first verification widget. Unlike third-party CAPTCHA services, it does not transmit your data to any external company or track you across websites.

Where analytics data is processed by Google, it may be transferred to and stored in the United States or other countries outside the European Economic Area. Such transfers rely on the safeguards provided by Google, including the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. All other data described in this policy is stored and processed within the European Union.

• Contact form submissions that do not lead to a business relationship are kept for as long as reasonably necessary to handle your enquiry, and are then deleted or anonymised, generally within 24 months.
• Data related to an actual project or contract is kept for the duration of the collaboration and, for documents with accounting or fiscal relevance (e.g. invoices), for the retention periods required by Romanian law (currently up to 10 years).
• Analytics data is retained in Google Analytics for the period configured in our analytics property (typically up to 14 months), after which it is automatically deleted or aggregated.

Under the GDPR, you have the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data, where there is no legal reason for us to keep it;
• request restriction of how we process your data;
• object to processing based on our legitimate interest;
• request portability of the data you provided to us;
• withdraw your consent at any time, for processing that relies on consent, without affecting the lawfulness of processing carried out before the withdrawal;
• lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, or with the supervisory authority of your own EU member state.

To exercise any of these rights, contact us at office@pavels.ro. We will respond within the timeframes set out by the GDPR (generally within one month).

We apply reasonable technical and organisational measures to protect your data, including encrypted (HTTPS) connections, restricted access to systems that store personal data, and the use of a self-hosted, non-tracking spam-protection widget on our contact form to reduce third-party exposure of your information.

Our website and services are intended for businesses and professionals. We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has provided us with personal data, please contact us and we will take appropriate action.

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The "Last updated" date at the top of this page shows when it was last revised. We encourage you to review this page periodically.

For any question about this Privacy Policy or about how we handle your data, contact PAVELS WEB SOLUTIONS SRL at office@pavels.ro or +40 731 296 191.