This policy explains how Blackbone SRL processes personal data in connection with blackbone.eu and its business services. It should be read with the GDPR, Romanian Law 190/2018 and Law 506/2004.
1. Data controller
Blackbone SRL, based in Chiajna, Ilfov, Romania, tax identification number 54833093, Trade Register J2026036807008, is the controller for its website and business enquiries. Contact: contact@blackbone.ro. Privacy enquiries: privacy@blackbone.ro; data protection contact: dpo@blackbone.ro.
2. Information we process
• Identification and business information, such as your name, company and role.
• Contact details, including email, phone number and correspondence address.
• Contract and billing information, including tax identifiers, payment details and invoice history where needed for a service.
• Technical information, such as IP address, browser, operating system and server request logs.
• Information you submit in an enquiry, project brief or attachment.
• Recruitment information, such as a CV, when you contact us about a role.
3. Purposes and legal bases
We process enquiries and deliver agreed services to take steps at your request or perform a contract (GDPR Article 6(1)(b)). We process invoices and statutory records to meet legal obligations (Article 6(1)(c)). Security, fraud prevention and the administration of our services may rely on legitimate interests (Article 6(1)(f)). Optional marketing or storage that requires consent relies on Article 6(1)(a); consent can be withdrawn.
4. Recipients and service providers
Information may be accessed by authorised staff and providers needed to deliver a particular service: hosting, communications, payment processing, accounting, professional advice and technical support. For this website, Vercel serves the application and the existing Blackbone mail service handles contact enquiries and confirmations. Both the enquiry and its attachments are sent to contact@blackbone.ro. Public authorities may receive information where the law requires it. Project-specific providers and responsibilities are documented in the relevant agreement; see our GDPR information.
5. International transfers
Where a provider processes data outside the European Economic Area, an applicable adequacy decision or appropriate safeguards are required. These may include the European Commission's Standard Contractual Clauses, supplemented by measures appropriate to the transfer. EU–US Data Privacy Framework participation is relevant only where the recipient and the transfer are covered by it.
6. Retention
We retain contract and financial records for the statutory period applicable to the record. Unconverted contact enquiries are normally retained for up to 24 months; marketing data until withdrawal or another applicable retention limit; operational logs normally for up to 90 days unless an incident or legal requirement justifies longer retention. A project agreement may specify additional retention and deletion requirements. See the Cookie Policy for browser storage.
7. Your rights
Subject to the GDPR's conditions, you may request access, correction, deletion, restriction, portability or objection to processing, including direct marketing. You may withdraw consent without affecting the lawfulness of earlier processing. You also have rights concerning solely automated decisions with legal or similarly significant effects.
Contact dpo@blackbone.ro to exercise these rights. We normally respond within one month; a permitted extension will be explained. You may complain to Romania's supervisory authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru 28–30, Bucharest, email anspdcp@dataprotection.ro, or the supervisory authority available to you under the GDPR.
8. Automated decisions and AI
Website enquiries are not used to make solely automated decisions with legal or similarly significant effects. For project-specific AI processing, the applicable purposes, safeguards and human oversight are described in the project documentation and our AI Policy.
9. Security and incidents
Access restrictions, encrypted transport and operational safeguards protect information. Measures depend on the system and the agreed service. Where a personal data breach triggers notification obligations, the competent authority and affected people are notified as required by the GDPR. See our Security Policy.
10. Changes and contact
This page is updated when processing changes. Material changes affecting a contractual service are communicated through the relevant customer channel. For questions, contact privacy@blackbone.ro or dpo@blackbone.ro.