Privacy Policy

Last updated: 6 November 2026

This policy explains what personal data medusa-studio.eu collects, why, for how long, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Romanian Law no. 190/2018.

1. Provider identification

Medusa Designs SRL
Tax ID (CUI): 45624268
Trade Register no.: J32/267/2022 (registered on 11.02.2022)
EUID: ROONRC.J32/267/2022
Email: contact@medusa-studio.eu
Registered office: Str. Regele Ferdinand nr. 9, bl. 5, et. 3, ap. 31, sat Șelimbăr, comuna Șelimbăr, județul Sibiu, Romania

The registered office is not a place of business. Meetings take place online only or at a location agreed in advance.

2. Who is responsible for your data

The data controller is Medusa Designs SRL, the provider identified in section 1.

For anything related to your personal data, write to contact@medusa-studio.eu.

Our services are provided exclusively to businesses and professionals. The personal data we receive through the Website therefore usually belongs to the people who represent them or work with them.

3. What we collect and why

3.1 The “Let’s talk” contact form

Data: your name, the company or practice you represent and its tax ID (CUI/VAT), your email address, the estimated budget and your message, and, if you choose to give them, the company website, your phone number and the services you are interested in.

Purpose: to answer your enquiry, to check that it comes from a business or a professional and, if you ask for it, to prepare an offer.

Legal basis: steps taken at your request before entering into a contract (art. 6(1)(b) GDPR) and our legitimate interest in answering the messages we receive (art. 6(1)(f) GDPR).

How long: for as long as the conversation lasts and up to 3 years after our last contact. If the enquiry leads to a contract, the related documents are kept for the periods required by Romanian tax and accounting law.

Spam protection: before the form is sent, Cloudflare Turnstile (Cloudflare, Inc.) checks that it is being filled in by a person and not by an automated program. For this check only, it processes technical data about your browser and device and your IP address; it is not used for advertising. Legal basis: our legitimate interest in protecting the form and our inbox from abuse (art. 6(1)(f) GDPR). See Cloudflare’s privacy policy.

The chat window (WhatsApp bubble): the message you write there and the phone number or email address you leave reach us by email and as a WhatsApp notification on the company phone, delivered through the CallMeBot service. We use them only to answer you, on the same legal basis, for the same period and with the same spam protection as the form above.

3.2 Newsletter and “book release” notifications

Data: your email address, the list you joined, the date of sign-up, the confirmation that you agreed to receive our emails and a one-way, non-reversible fingerprint (hash) of your IP address, used only to block automated sign-ups.

Purpose: to send you the news you subscribed to.

Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time, without affecting what happened before.

How long: until you unsubscribe or ask us to delete your address.

3.3 Visiting the website

Like every website, our hosting server records technical data for each visit (IP address, date and time, the page requested, browser type). These logs are used only to keep the site secure and working, on the basis of our legitimate interest (art. 6(1)(f) GDPR), and are kept by the hosting provider for a limited period.

We do not use advertising cookies and we do not build visitor profiles. Visit statistics (Google Analytics) are collected only if you accept them; see section 3.6 and the Cookie Policy.

3.4 Embedded videos

Some service pages show videos hosted on YouTube, embedded in privacy-enhanced mode (youtube-nocookie.com). When a page with such a video loads, your browser connects to YouTube (Google Ireland Limited), which receives your IP address; when you play a video, YouTube may store information on your device. Google’s privacy policy applies: policies.google.com/privacy.

3.5 Links to social networks

The links to Instagram, LinkedIn, TikTok, Facebook, Pinterest and WhatsApp are plain links: nothing is sent to these networks until you click them. Once on their pages, their own privacy policies apply. If you write to us on WhatsApp, the conversation is also processed by WhatsApp Ireland Limited; your phone number and messages reach us only so we can reply, on the same terms as requests sent through the form (section 3.1).

3.6 Visit statistics (only with your consent)

If you accept analytics cookies in the cookie banner, we use Google Analytics (Google Ireland Limited) to understand, in aggregate, how the site is used.

Data: the pages you visit and for how long, the site or search that brought you here, your device and browser type, and your approximate location (country, city). Google Analytics does not store your full IP address.

Purpose: statistics that help us improve the site; they are not used to identify you or for advertising.

Legal basis: your consent (art. 6(1)(a) GDPR and art. 4 of Romanian Law no. 506/2004). Without it, Google Analytics does not load. You can withdraw your consent at any time from the cookie banner.

How long: for the retention period set in our Google Analytics account, at most 14 months.

4. Who receives your data

• our hosting provider, which stores the website, the email and the databases on servers in the European Union;
• Google (YouTube), only as described in section 3.4, and Google Analytics, only with your consent (section 3.6);
• Cloudflare (Turnstile), only to check that the contact form and the chat window are used by a person (section 3.1);
• CallMeBot, which forwards the messages from the chat window to our WhatsApp, and WhatsApp Ireland Limited, through which we receive them (section 3.1);
• CookieYes, the provider of the cookie banner, which records your cookie choices (see the Cookie Policy);
• public authorities, only when the law requires it.

We do not sell or rent personal data and we do not share it for marketing.

5. Transfers outside the European Economic Area

We do not transfer your data outside the EEA ourselves. Google, Cloudflare and WhatsApp (Meta) may process data in the United States; such transfers rely on the EU–U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.

6. Your rights

You have the right to:

• access the data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it;
• receive it in a portable format;
• object to processing based on our legitimate interest;
• withdraw your consent at any time (for example, unsubscribe from the newsletter);
• not be subject to decisions based solely on automated processing (we do not take such decisions).

Write to contact@medusa-studio.eu; we answer within one month. You may also lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro.

7. Security

The site is served only over an encrypted connection (HTTPS). Forms are protected against automated abuse, access to the databases is restricted, and we keep the data we collect to the minimum needed.

8. Children

Our services are addressed to businesses and professionals. We do not knowingly collect data from children under 16.

9. Changes to this policy

When we change how we handle personal data, we update this page and the date at the top.