Privacy Policy

1Data controller

The controller is WEB LOFT SRL, registered office at Str. Buzoieni 14, Sector 5, Bucharest, Romania, VAT number 44674942, Trade Register J40/13171/2021.

We have not appointed a Data Protection Officer, because our activity does not fall within the cases listed in art. 37 GDPR. For anything concerning your data, write to [email protected] or call +40 728 354 886.

2What we collect

The site has no user accounts and sells nothing online. We collect data in two situations.

• The contact form: your name, e-mail address, subject and message, plus the box you tick to confirm your agreement. Nothing else is asked for and nothing is inferred.
• Traffic measurement, only if you accept it: the page visited, the referring page, the parameters in the page address (such as the source of a campaign), the external links you click, technical data about your browser and device, and a randomly generated visitor identifier.

3Legal basis and purpose

We process on the basis of your consent in both cases.

• Form messages: consent (art. 6(1)(a) GDPR), given by ticking the box before sending. We use them solely to answer your enquiry and discuss possible work together.
• Traffic measurement: consent (art. 6(1)(a) GDPR), given with the “Accept” button in the banner. Nothing is measured until you accept, and you can withdraw at any time under “Cookie settings” at the bottom of the page. We use it to understand which pages are read and where visitors come from.

We take no automated decisions with legal effect on you, and we do not profile.

4How long we keep it

• Contact form messages: 3 years from receipt — the general limitation period for claims arising from a commercial discussion. They are deleted after that.
• Traffic data: 14 months, after which it is removed from our analytics instance.

5Who else has access

We do not sell or rent data. We disclose it only to those who actually help us deliver the service, each as a processor and only for the stated purpose.

• SMTP2GO — delivery of the e-mail generated by the contact form. We use the service’s European endpoint.
• Our hosting provider, which operates the server webloft.ro runs on.
• Cloudflare, Inc. (USA) — the network every request to webloft.ro and analytics.webloft.ro passes through: it delivers the pages and protects the site against attacks and automated traffic. Like any network intermediary, it sees the IP address and technical data of each request. Transfers to the US rely on the EU–US Data Privacy Framework, with the European Commission’s standard contractual clauses as a fallback, under Cloudflare’s data processing addendum.

Traffic statistics are stored and processed on our own infrastructure at analytics.webloft.ro; we use no third-party analytics provider. The measurement requests do, like all of the site’s traffic, pass through Cloudflare. We may also disclose data to authorities where the law requires it.

6Traffic measurement and local storage

The site sets no cookies of its own. The one cookie is set by Cloudflare: cf_clearance, a security cookie confirming that your browser has passed the check against automated traffic. It is needed to protect the site, so it does not depend on your choice in the banner, and it is valid for one year.

Everything else uses the browser’s localStorage, which falls under the same rules as a cookie (art. 5(3) of the ePrivacy Directive, implemented in Romania by Law 506/2004).

We measure traffic with Rybbit, self-hosted at analytics.webloft.ro. The measurement script loads only after you press “Accept”. The following values may be written in your browser:

• rybbit-visitor-id — a random visitor identifier, written by the measurement tool, and only once you have accepted.
• gdpr-consent — your choice from the banner, so we do not ask again on every page.
• webloft-lang — the language you prefer the site in.

If you decline, or make no choice at all, the measurement script does not load: no page view is sent and no identifier is written. You can change your choice at any time under “Cookie settings” at the bottom of every page. If you withdraw your consent, the visitor identifier is deleted from your browser and the page reloads without measurement. Page views recorded before the withdrawal stay in the statistics until the 14-month retention period expires.

7Your rights

Under the GDPR you have the rights below. You can exercise them by writing to [email protected], and we answer within one month.

• Access — to find out what data we hold about you.
• Rectification — to have inaccurate data corrected.
• Erasure — to have data removed once we no longer have a reason to keep it.
• Restriction — to have processing stopped while the data is kept.
• Portability — to receive your data in a format you can reuse.
• Objection — to object to the processing.
• Withdrawal of consent — at any time, without affecting what was lawfully processed before then.

If our answer does not satisfy you, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul General Gheorghe Magheru 28-30, Sector 1, Bucharest, anspdcp.ro.

8Changes and contact

If we change this policy, we update the date at the top of the page.

For any question about your data: [email protected] or +40 728 354 886.