Privacy policy

The organisation responsible for your personal information is:

SC PENROSE CDB SRL
34 Dumbrava Nouă Street, Ground Floor, Unit 1
District 5, Bucharest, Romania

VAT number: RO34133729
Trade Register number: J40/2054/2015

In this policy, we refer to SC PENROSE CDB SRL as “Penrose”, “we”, “us” or “our”.

If you have questions about this policy or how we handle your personal information, you can contact our Data Protection Officer:

Mihai Tonsciuc
mihai.tonsciuc@penrose-cdb.com

Information you give us

When you contact us through our website form, we ask for:

• Your first and last name
• Your email address
• The name of your organisation
• Information about your project or enquiry

If you contact us by email, we receive your email address and any other information you choose to include in your message.

Please avoid sending us sensitive personal information unless it is necessary for your enquiry.

Information collected when you visit our website

When you visit our website, some technical information may be processed to deliver and protect the site. Depending on how you use the website and your cookie choices, this may include:

• Your IP address
• Information about your browser, operating system and device
• The pages you visit and when you visit them
• The website or link that brought you to ours
• Information about how you interact with our website

We use Matomo, a website analytics platform hosted and managed by Penrose, to understand how visitors use our website. Matomo uses cookies when you agree to analytics cookies.

You can find more information in our Cookie policy.

We use personal information for the following purposes:

Where we rely on legitimate interests, we consider your rights and interests alongside ours. You have the right to object to this processing, as explained below.

You do not have to use our contact form. However, we need the information marked as required to understand your enquiry and respond. You can also email us directly at hello@penrose-cdb.com.

Cookies are small files stored on your device when you visit a website. Some help a website function; others help us understand how it is used.

We use Matomo to collect website statistics, such as which pages are visited and how visitors find and navigate our website. Matomo is hosted on infrastructure managed by Penrose.

Analytics cookies are used only if you agree to them. You can change your choice or withdraw your consent at any time through our cookie settings. Withdrawing consent does not affect processing that took place before you withdrew it.

Matomo is configured to mask part of visitors’ IP addresses. Masking reduces the amount of information stored, but does not necessarily make the data anonymous.

For details of the cookies we use, their purpose and duration, and how to manage your preferences, please see our Cookie policy.

We only share personal information where there is a reason to do so. Depending on the circumstances, this may include:

• Leafcloud, which provides the virtual server infrastructure used to host our website and Matomo.
• Cloudflare, which helps us deliver and protect our website and may process technical information, including IP addresses.
• Our email service provider, which helps us receive and respond to enquiries.
• Professional advisers or public authorities, where necessary to obtain advice, protect our rights or comply with a legal obligation.

Our service providers may process personal information on our behalf to provide their services. Where required, we put appropriate agreements in place to govern that processing and protect your information.

We do not sell your personal information.

Some of our service providers may process personal information outside the European Economic Area, or allow access to it from outside the EEA.

Where this happens, we use an appropriate transfer mechanism required by data protection law, such as an adequacy decision or the European Commission’s standard contractual clauses, together with additional safeguards where necessary.

You can contact our Data Protection Officer if you would like more information about the safeguards applicable to a particular transfer.

We keep personal information only for as long as we need it for the purposes described in this policy.

• Enquiries: We keep enquiries for a maximum of two years after our last contact. If an enquiry leads to a project, information needed for that relationship may be handled under a separate retention schedule.
• Matomo analytics: We keep analytics data for a maximum of two years.
• Technical and security logs: We keep these for the period needed to maintain and protect the website.

In some circumstances, we may need to retain particular information for longer—for example, to comply with a legal obligation or establish, exercise or defend a legal claim.

We use technical and organisational measures intended to protect personal information against unauthorised access, loss, alteration or disclosure. These include managing access to our systems and maintaining the infrastructure on which our website and analytics platform are hosted.

No website or method of electronic transmission is completely risk-free. We review our security measures and update them as appropriate.

Depending on the circumstances, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Ask us to delete your information.
• Ask us to restrict how we use your information.
• Object to processing based on our legitimate interests.
• Receive your information in a portable format, where the right to data portability applies.
• Withdraw your consent at any time where we rely on consent. This does not affect the lawfulness of processing before withdrawal.
• Object to direct marketing at any time.

Some rights apply only in certain circumstances, and we may need to keep some information where we have a lawful reason to do so.

To exercise your rights, contact mihai.tonsciuc@penrose-cdb.com. We may ask for additional information if we reasonably need it to verify your identity.

We will normally respond within one month. If your request is complex or you have made several requests, we may need more time; if so, we will let you know.

If you have a concern about how we handle your personal information, please contact us first so we can try to address it. You also have the right to complain directly to a data protection authority.

In Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal — ANSPDCP).

Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro

You may also complain to the relevant supervisory authority in the EU country where you live or work, or where an alleged infringement occurred.

Our website may contain links to websites operated by other organisations. Those websites have their own privacy policies, and we encourage you to read them when you visit.

We may update this policy when our website, services or data practices change. We will publish the updated version on this page and change the date below.

Last updated: [date of publication]