ORPHID

Privacy policy

Last updated: 6 October 2026

This policy explains what personal data we collect through the orphid.ro website, why we collect it, how long we keep it and what your rights are. We process data in accordance with Regulation (EU) 2016/679 (“GDPR”), Romanian Law no. 190/2018 and Romanian Law no. 506/2004.

We work with clients in Romania, in other European Union countries and beyond. This policy applies to everyone, whatever their country, and the level of protection is that of the GDPR. What applies in addition for the United Kingdom, Switzerland and the United States is set out in a dedicated section.

This is a translation. If it differs from the Romanian version, the Romanian version prevails.

1. Who we are

The data controller is PETRISOR DESIGN CONSTRUCT S.R.L., with its registered office at Str. Crângului nr. 1, 910157 Călărași, jud. Călărași, registered with the Romanian Trade Register under no. J2024000409511, tax ID 50145768 (“Orphid” or “we”).

For any question about your data, write to us at orphid@gmail.com.

We have not appointed a data protection officer, as our activity does not meet the conditions of Article 37 GDPR.

2. What data we collect

We only collect the data you send us through the website's forms, and the technical data strictly needed to run the server:

  • Contact form: your name, email address, company (optional) and message.
  • Project configurator: your answers about the project, your name, email address and, optionally, your company, phone number and notes.
  • Booking a call: the meeting type and day, your name, email address, company (optional), the topic and, if you filled in the configurator, its summary.
  • Technical data: your IP address and the information your browser sends automatically when loading a page (browser type, page requested, date and time).

We do not ask for sensitive data, such as health information, and we ask you not to include it in messages. We do not use traffic analytics, tracking pixels or advertising.

3. Why we use it and on what legal basis

  • To reply to messages, briefs and booking requests and to prepare an offer. The legal basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). If you write on behalf of a company, the legal basis is our legitimate interest in communicating with prospective clients (Article 6(1)(f) GDPR).
  • To protect the website from spam and abuse by limiting the number of submissions from the same IP address. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).
  • To keep the server running and secure, through technical logs. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).
  • To meet our legal obligations, such as accounting obligations, if we end up working together. The legal basis is a legal obligation (Article 6(1)(c) GDPR).

We do not make decisions based solely on automated processing, we do not build profiles and we do not send you marketing messages.

4. Who we share data with

We do not sell or rent your data. Only the following may access it:

  • Resend, Inc. (USA), the service that delivers the forms to our email, acting as our processor;
  • the website's hosting provider, with servers in the European Union, acting as our processor;
  • our email service provider, which stores our correspondence;
  • the collaborators who work with us on a project (design, content, development), only if we work together, only as far as needed and under a duty of confidentiality;
  • public authorities, when the law requires it.

5. Transfers outside the European Union

Data may leave the European Economic Area (EEA) in the following situations:

  • Resend processes data in the United States. The transfer relies on Resend's participation in the EU-U.S. Data Privacy Framework, including the UK Extension, and on the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, with the adaptations for the United Kingdom and Switzerland (Articles 45 and 46 GDPR).
  • If you or your company are outside the EEA, our correspondence and deliverables naturally reach your country. The European Commission has found that the United Kingdom and Switzerland provide an adequate level of protection. For other countries, including the United States, the transfer is necessary to answer your request and to enter into or perform our contract with you (Article 49(1)(b) and (c) GDPR).
  • If a collaborator working on your project is in a country without an adequacy decision, the transfer relies only on standard contractual clauses (Article 46 GDPR).

Apart from these situations, data stays within the EEA.

6. How long we keep data

  • Messages, briefs and booking requests that do not lead to a collaboration: at most 2 years from the last contact, after which we delete them.
  • If you become a client: for the duration of our collaboration and afterwards for as long as limitation periods and accounting law require.
  • Server technical logs: at most 30 days.
  • The IP address used for spam protection: only in the server's memory, for at most one minute. We do not store it.

7. Cookies and local storage

The website does not use analytics, marketing or third-party cookies. We only store the following in your browser, strictly needed for features you explicitly request. Under Article 4 of Romanian Law no. 506/2004, these do not require consent:

  • orphid-theme (localStorage): your chosen theme, light or dark. It stays in your browser until you delete it.
  • orphid-brief and orphid-brief-handoff (sessionStorage): your configurator answers, so you don't lose them if you reload the page or move on to booking a call. They are deleted automatically when you close the tab.

This information stays on your device and only reaches us if you submit a form. You can delete it at any time from your browser settings. If we ever use cookies that require consent, we will ask for it first and update this policy.

8. Your rights

Under Articles 15–22 GDPR, you have the right:

  • to find out whether we process your data and to receive a copy of it (right of access);
  • to have inaccurate data corrected or incomplete data completed (right to rectification);
  • to have your data erased (right to be forgotten), within the limits of the law;
  • to restrict processing;
  • to receive your data in a structured format and transmit it to another controller (right to data portability);
  • to object to processing based on our legitimate interest;
  • not to be subject to a decision based solely on automated processing.

To exercise your rights, write to us at orphid@gmail.com. Exercising your rights is free of charge. We reply within one month of receiving your request; for complex requests, this may be extended by two further months, and we will let you know (Article 12(3) GDPR).

9. Right to lodge a complaint

If you believe we process your data unlawfully, please write to us first so we can sort it out together. You always have the right to lodge a complaint with the supervisory authority:

  • National Supervisory Authority for Personal Data Processing (ANSPDCP)
  • B-dul G-ral. Gheorghe Magheru 28–30, sector 1, postal code 010336, Bucharest, Romania
  • anspdcp@dataprotection.ro · www.dataprotection.ro

If you live or work in another European Union or EEA country, you may also lodge a complaint with the authority in your country (Article 77 GDPR), such as the CNIL in France or the Garante per la protezione dei dati personali in Italy. The full list of authorities is published by the European Data Protection Board at edpb.europa.eu.

10. United Kingdom, Switzerland, United States and other countries

  • United Kingdom: processing the data of people in the United Kingdom is also subject to the UK GDPR and the Data Protection Act 2018. You have the same rights described above and may lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk. We have not appointed a UK representative, as our processing is occasional and does not pose a high risk (Article 27(2) UK GDPR).
  • Switzerland: processing the data of people in Switzerland is also subject to the Federal Act on Data Protection (FADP). You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch. We have not appointed a Swiss representative, as we do not process data regularly and on a large scale (Article 14 FADP).
  • United States: we do not sell or “share” personal information as defined by the California Consumer Privacy Act (CCPA), we do not use it for targeted advertising, and we do not track visitors across websites or over time. For this reason, Do Not Track and Global Privacy Control signals change nothing on our website: there is no tracking for them to stop. For California residents (CalOPPA): the categories of data and of recipients are described in sections 2 and 4, how to review or correct your data in “Your rights”, and how we announce changes in “Changes to this policy”.
  • Other countries: wherever you are, you have the rights described in this policy.

11. How we protect data

The website uses an encrypted connection (HTTPS), access to data is limited to the people who need it, and the forms are protected against automated submissions. If a personal data breach occurs that may affect your rights, we notify the authority and, where required, you, in accordance with Articles 33 and 34 GDPR.

12. Minors

Our services are aimed at businesses. We do not knowingly collect data from people under 16. If you find out that a minor has sent us data, write to us and we will delete it.

13. Changes to this policy

We may update this policy when the website, our services or the law change. The date of the last update appears at the top of the page. We highlight important changes visibly on the website.