Privacy policy

What data we process and how.

1. 01

   The contact form. When you send the form, we receive your name, your email address, your phone number (if you enter it), the service and budget you select, and your message. The name, the email address and the message are required to send the form. The other fields are optional. No law obliges you to give us this data. Without it we cannot receive the message. We use the data to reply to you and to prepare an offer. When you write in your own name, the basis is GDPR article 6(1)(b), to take steps at your request before entering into a contract. When you write for a company, the basis is GDPR article 6(1)(f), our legitimate interest in replying to the companies that contact us. The data arrives in an email at contact@kronstadtsoft.ro. We keep the message for at most 12 months unless we sign a contract. If we sign a contract, we keep the message for the duration of the contract and then for as long as the law requires for the contract documents. We make no automated decisions based on this data.

2. 02

   Direct emails and calls. When you write to us directly at contact@kronstadtsoft.ro, including an application from the Careers page, or when you call us, we receive the data you give us. We use it to reply to you, on the same basis as for the form. We keep the data in the same way as a message sent through the form.

3. 03

   Campaign tags. When you reach the website from an advertisement, the page address may carry the campaign tags: utm_source, utm_medium, utm_campaign and utm_content. The website does not store them in a cookie. If you send the form, the tags may go into the email with your message, so that we know which advertisement brought the message. The basis is GDPR article 6(1)(f), our legitimate interest in measuring the advertisement. They are kept and deleted together with the message. The page address with the tags may also stay in the technical log, for at most 7 days.

4. 04

   The language cookie. The website has a Romanian edition and an English edition. When you pick a language from the site menu, we save a cookie named lang, with the value ro or en, for one year. The cookie holds no identifier and serves only to give you the chosen language on later visits. It is strictly necessary for a service you requested, under Romanian Law 506/2004, article 4(6)(b), so the website shows no consent banner. You can delete the cookie in your browser settings. If you pick no language, the website chooses the language on each visit from your browser language and the country of the connection, which Cloudflare estimates from the IP address, without storing this data. The basis is GDPR article 6(1)(f), our legitimate interest in showing you the website in the right language.

5. 05

   The sending limit and the technical log. To stop automated submissions, Cloudflare counts the messages sent from the same IP address: at most five in one minute. The counter is kept at Cloudflare and resets after one minute. Cloudflare keeps a technical log of the requests to the website, for at most 7 days, with the technical data of each request, for example the page address, the time, the response code, the request headers, the IP address and the location that Cloudflare estimates. The application does not write the form content to the log. If sending the email fails, the log keeps the error message. The website has no database and does not save the IP address. The basis is GDPR article 6(1)(f), our legitimate interest in protecting the form and the website.

6. 06

   Who processes the data for us. Cloudflare, Inc. hosts the website, sends the email with your message and keeps the sending counter and the technical log. Google Cloud EMEA Limited, Ireland, hosts the contact@kronstadtsoft.ro mailbox through Google Workspace. Cloudflare, Inc. is based in the United States. Google may transfer the data to Google LLC, in the United States. Transfers outside the European Economic Area rely on the certification of Cloudflare, Inc. and Google LLC under the EU-U.S. Data Privacy Framework and, as a fallback, on the standard contractual clauses of the European Commission. You can ask for a copy of the clauses at contact@kronstadtsoft.ro. We pass the data to no other recipient.

7. 07

   Your rights. You can ask for access to your data, its correction, erasure or restriction. You can object to processing based on legitimate interest. For data processed under article 6(1)(b), you can receive the data you gave us in a portable format. Write to contact@kronstadtsoft.ro and we reply within one month. You can lodge a complaint with the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, www.dataprotection.ro.

We publish this policy on kronstadtsoft.ro and update it when the data we receive or the companies that process it for us change. The version published here is the one in force.

Dated: 26 September 2026