Skip to content
0 %

Privacy Policy

Last updated: 31 October 2026

This policy explains what personal data medusa-studio.eu collects, why, for how long, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Romanian Law no. 190/2018.

1. Who is responsible for your data

The data controller is SC MEDUSA DESIGNS SRL, Str. Regele Ferdinand nr. 9, bl. 5, et. 3, ap. 31, sat Șelimbăr, comuna Șelimbăr, județul Sibiu, Romania. Tax ID (CUI): 45624268. Trade Register no.: J32/267/2022 (registered on 11.02.2022). EUID: ROONRC.J32/267/2022.

For anything related to your personal data, write to contact@medusa-studio.eu.

2. What we collect and why

2.1 The “Let’s talk” contact form

Data: your name, email address and message, and, if you choose to give them, your company, its tax ID (CUI/VAT), your phone number and the services you are interested in.

Purpose: to answer your enquiry and, if you ask for it, to prepare an offer.

Legal basis: steps taken at your request before entering into a contract (art. 6(1)(b) GDPR) and our legitimate interest in answering the messages we receive (art. 6(1)(f) GDPR).

How long: for as long as the conversation lasts and up to 3 years after our last contact. If the enquiry leads to a contract, the related documents are kept for the periods required by Romanian tax and accounting law.

Spam protection: before the form is sent, Cloudflare Turnstile (Cloudflare, Inc.) checks that it is being filled in by a person and not by an automated program. For this check only, it processes technical data about your browser and device and your IP address; it is not used for advertising. Legal basis: our legitimate interest in protecting the form and our inbox from abuse (art. 6(1)(f) GDPR). See Cloudflare’s privacy policy.

2.2 Newsletter and “book release” notifications

Data: your email address, the list you joined, the date of sign-up, the confirmation that you agreed to receive our emails and a one-way, non-reversible fingerprint (hash) of your IP address, used only to block automated sign-ups.

Purpose: to send you the news you subscribed to.

Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time, without affecting what happened before.

How long: until you unsubscribe or ask us to delete your address.

2.3 Visiting the website

Like every website, our hosting server records technical data for each visit (IP address, date and time, the page requested, browser type). These logs are used only to keep the site secure and working, on the basis of our legitimate interest (art. 6(1)(f) GDPR), and are kept by the hosting provider for a limited period.

We do not use advertising cookies and we do not build visitor profiles. Visit statistics (Google Analytics) are collected only if you accept them; see section 2.6 and the Cookie Policy.

2.4 Embedded videos

Some service pages show videos hosted on YouTube, embedded in privacy-enhanced mode (youtube-nocookie.com). When a page with such a video loads, your browser connects to YouTube (Google Ireland Limited), which receives your IP address; when you play a video, YouTube may store information on your device. Google’s privacy policy applies: policies.google.com/privacy.

2.5 Links to social networks

The links to Instagram, LinkedIn, TikTok, YouTube, Facebook, Pinterest and GitHub are plain links: nothing is sent to these networks until you click them. Once on their pages, their own privacy policies apply.

2.6 Visit statistics (only with your consent)

If you accept analytics cookies in the cookie banner, we use Google Analytics (Google Ireland Limited) to understand, in aggregate, how the site is used.

Data: the pages you visit and for how long, the site or search that brought you here, your device and browser type, and your approximate location (country, city). Google Analytics does not store your full IP address.

Purpose: statistics that help us improve the site; they are not used to identify you or for advertising.

Legal basis: your consent (art. 6(1)(a) GDPR and art. 4 of Romanian Law no. 506/2004). Without it, Google Analytics does not load. You can withdraw your consent at any time from the cookie banner.

How long: for the retention period set in our Google Analytics account, at most 14 months.

3. Who receives your data

We do not sell or rent personal data and we do not share it for marketing.

4. Transfers outside the European Economic Area

We do not transfer your data outside the EEA ourselves. Google and Cloudflare may process data in the United States; such transfers rely on the EU–U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.

5. Your rights

You have the right to:

Write to contact@medusa-studio.eu; we answer within one month. You may also lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, www.dataprotection.ro.

6. Security

The site is served only over an encrypted connection (HTTPS). Forms are protected against automated abuse, access to the databases is restricted, and we keep the data we collect to the minimum needed.

7. Children

Our services are addressed to businesses and adults. We do not knowingly collect data from children under 16.

8. Changes to this policy

When we change how we handle personal data, we update this page and the date at the top.