Blackbone SRL processes personal data under Regulation (EU) 2016/679 (GDPR) and applicable Romanian law. The exact obligations depend on the service and the role agreed for the processing.
1. Controller and processor roles
Blackbone is the controller for its own website enquiries, business administration and recruitment. When it processes personal data solely on a customer's documented instructions, it acts as a processor under a data processing agreement (DPA). These roles are recorded in the relevant service agreement.
2. Processing principles
We apply lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; retention limits; security; and accountability. Processing activities and responsibilities are documented as required, including Article 30 records where applicable.
3. Providers and subprocessors
The website uses Vercel for hosting and Blackbone's existing mail infrastructure for enquiries and confirmations. Depending on the project, hosting, email, payments, monitoring, office services and professional advisers may also be involved. The actual subprocessor list, processing locations and contractual safeguards are identified in the customer's agreement; listing a capability does not mean every provider processes every visitor's data.
4. International transfers
Transfers outside the EEA require a valid transfer mechanism, such as an applicable adequacy decision or Standard Contractual Clauses. We assess the destination, recipient and processing and identify supplementary safeguards where required. Data Privacy Framework coverage must be checked for the particular recipient.
5. Data subject requests
Requests can be sent to dpo@blackbone.ro. We respond within the GDPR deadline, normally one month, and explain a permitted extension for complexity or volume. When acting as a processor, we assist the customer controller in handling the request.
6. Security and breaches
Measures are proportionate to the nature and risk of the processing. Where a breach is likely to create a risk to people's rights and freedoms, the controller must notify the supervisory authority within the applicable deadline, normally 72 hours after awareness. High-risk breaches may also require communication to affected people. As a processor, Blackbone informs its customer without undue delay.
7. Impact assessments
Processing likely to result in high risk requires a data protection impact assessment where Article 35 applies. Examples may include systematic profiling or large-scale processing of special-category data. The controller and processor responsibilities are set out in the project documentation.
8. Contact and supervision
Data protection contact: dpo@blackbone.ro. Romania's supervisory authority is ANSPDCP, B-dul G-ral. Gheorghe Magheru 28–30, Bucharest, anspdcp@dataprotection.ro. You may also use the competent supervisory authority available under the GDPR.
9. Data processing agreement
A DPA is available for services involving processing on a customer's behalf. See Data Processing Agreement or request one at contact@blackbone.ro.