Capabilities Approach Studio Apply →
Legal

Privacy Policy

Last updated: March 18, 2025

1. Data Controller

The data controller responsible for processing your personal data is:

The Sunstone
Based in Romania, European Union
Email: razvan@thesunstone.ro
Website: thesunstone.ro

We are committed to protecting and respecting your privacy in compliance with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and applicable Romanian data protection legislation.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Data You Provide Directly

When you submit our application form, we collect:

  • Full name
  • Company name
  • Your role (optional)
  • Email address
  • Phone number (optional)
  • Company website (optional)
  • Company Registration Number / CUI (required)
  • The services you are interested in, timeline, and (optional) working investment
  • The content of your message

2.2 Data Collected Automatically

When you visit our website, we may collect (subject to your consent):

  • IP address
  • Browser type and version
  • Operating system
  • Pages visited, time on page, and navigation paths
  • Referring URL (how you arrived at our site)
  • Device type and screen resolution
  • Cookie identifiers (see our Cookie Policy)

3. Purpose and Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

PurposeLegal BasisData Used
Responding to your applicationConsent (Art. 6(1)(a)) / Legitimate interestName, email, phone, company, message
Website analyticsConsent (Art. 6(1)(a))IP address, browsing data, device info
Advertising and remarketingConsent (Art. 6(1)(a))Cookie identifiers, browsing behaviour
Website security and functionalityLegitimate interest (Art. 6(1)(f))IP address, security cookies

4. Consent and Google Consent Mode v2

For analytics and marketing data processing, we rely on your explicit consent, managed through our cookie consent banner and Google Consent Mode v2 implementation.

You can withdraw your consent at any time by:

  • Clicking "Cookie Settings" in the website footer
  • Clearing your browser cookies
  • Contacting us directly at razvan@thesunstone.ro

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

5. Data Recipients and Third Parties

Your personal data may be shared with the following third-party service providers, who process data on our behalf:

  • Google LLC, Google Analytics 4, Google Ads, Google Tag Manager (USA; EU-U.S. Data Privacy Framework)
  • Meta Platforms, Inc., Facebook/Instagram Pixel (USA; EU-U.S. Data Privacy Framework)
  • TikTok Inc., TikTok Pixel (Ireland/UK; Standard Contractual Clauses)
  • LinkedIn Corporation, LinkedIn Insight Tag (USA; EU-U.S. Data Privacy Framework)
  • FormSubmit.co, Form submission email delivery

We ensure that all third-party recipients provide adequate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) and adherence to the EU-U.S. Data Privacy Framework where applicable.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

  • Application form submissions: Retained for up to 24 months or until you request deletion
  • Cookie consent preferences: Stored locally on your device for 365 days
  • Analytics data: Retained in Google Analytics for 14 months (default GA4 setting)
  • Marketing data: Retained according to each platform's data retention policy

7. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

  • Right of access (Art. 15), You can request a copy of the personal data we hold about you
  • Right to rectification (Art. 16), You can request correction of inaccurate or incomplete data
  • Right to erasure (Art. 17), You can request deletion of your personal data ("right to be forgotten")
  • Right to restriction (Art. 18), You can request that we restrict processing of your data
  • Right to data portability (Art. 20), You can request your data in a structured, machine-readable format
  • Right to object (Art. 21), You can object to processing based on legitimate interests
  • Right to withdraw consent (Art. 7), You can withdraw consent at any time

To exercise any of these rights, please contact us at razvan@thesunstone.ro. We will respond to your request within 30 days.

8. Right to Lodge a Complaint

If you believe that we have violated your data protection rights, you have the right to lodge a complaint with the supervisory authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Address: B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, Romania
Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes HTTPS encryption for all data in transit and secure data handling practices.

10. Children's Privacy

Our website and services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

12. Contact Us

For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact:

The Sunstone
Email: razvan@thesunstone.ro
Website: thesunstone.ro