What we solve Services How we work FAQ Start a project →
Legal

Privacy Policy

Last updated: 25 September 2026

1. Data controller

The controller responsible for your personal data is:

THE SUN STONE S.R.L. (The Sunstone)
Romania, European Union
Email: razvan@thesunstone.ro
Website: thesunstone.ro

We process personal data in line with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and Romanian data protection law.

2. What personal data we collect

2.1 Data you give us through the project form

  • Full name
  • Company name
  • Email address
  • Phone number (optional)
  • Company website (optional)
  • Company registration number (CUI)
  • What is already in place (website, tracking, creatives, ad management)
  • Monthly ad budget and timeline
  • The content of your message and the language of the form

2.2 Data collected automatically, only with your consent

If you accept analytics cookies, Google Analytics 4 collects:

  • Pages visited, time on page and how you moved through the site
  • The page or site that referred you
  • Device type, browser and operating system
  • Approximate location (country, city), derived from your IP address. Google Analytics 4 does not store IP addresses.
  • Cookie identifiers (see the Cookie Policy)

If you refuse, Google receives only anonymous signals without cookies or identifiers (see section 4).

3. Purposes and legal basis

PurposeLegal basisData used
Replying to your project request and preparing a proposalSteps taken at your request before a contract (Art. 6(1)(b)) and your consent (Art. 6(1)(a))The form data in section 2.1
Website analyticsConsent (Art. 6(1)(a))The data in section 2.2
Measuring advertising resultsConsent (Art. 6(1)(a))Cookie identifiers, conversion events
Website security and operationLegitimate interest (Art. 6(1)(f))Technical server logs

4. Consent and Google Consent Mode v2

Analytics and marketing processing starts only after you agree in the cookie banner. The site uses Google Consent Mode v2: until you choose, and if you refuse, Google tags run without cookies and send only anonymous signals.

You can withdraw consent at any time:

  • through "Cookie Settings" in the footer of any page
  • by clearing your browser's cookies and site data
  • by writing to razvan@thesunstone.ro

Withdrawing consent does not affect processing carried out before the withdrawal.

5. Who receives the data

  • Google LLC / Google Ireland Ltd.: Google Analytics 4 and Google Workspace email (EU-U.S. Data Privacy Framework)
  • Vercel Inc.: website hosting and technical logs (EU-U.S. Data Privacy Framework)
  • FormSubmit.co: delivery of the project form to our email

This website does not currently load Meta, TikTok or LinkedIn tracking tags. If we add them, they will load only with marketing consent and this policy will be updated first.

Where data leaves the European Economic Area, transfers rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

6. How long we keep data

  • Project form submissions: up to 24 months, or until you ask us to delete them
  • Your cookie choice: stored in your browser until you change it or clear your site data
  • Analytics data: up to 14 months in Google Analytics 4

7. Your rights

  • Access (Art. 15): a copy of the data we hold about you
  • Rectification (Art. 16): correction of inaccurate or incomplete data
  • Erasure (Art. 17): deletion of your data
  • Restriction (Art. 18): limiting how we process your data
  • Portability (Art. 20): your data in a structured, machine-readable format
  • Objection (Art. 21): to processing based on legitimate interest
  • Withdrawal of consent (Art. 7): at any time

Write to razvan@thesunstone.ro to exercise any of these rights. We reply within one month.

8. Complaints

You can lodge a complaint with the Romanian supervisory authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București, Romania
Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro

9. Security

The site is served only over HTTPS, uses security headers, and protects the form against spam and bots. Access to form submissions is limited to the people who reply to them.

10. Children

The site and our services are not aimed at people under 16. We do not knowingly collect their data and delete it if we find out we have.

11. Changes

We may update this policy. Changes are published on this page with a new date at the top.

12. Contact

THE SUN STONE S.R.L. (The Sunstone)
Email: razvan@thesunstone.ro
Website: thesunstone.ro