Privacy Policy

The controller of personal data is the entity trading under the BNG Studio brand, which determines the purposes and means of processing:

The website covered by this policy is https://www.bngstudio.dev.

For any question about the processing of your data, or to exercise the rights described below, you can contact us by email at bungardeanc1@gmail.com or via WhatsApp on +40 772 172 745.

The controller is not legally required to appoint a Data Protection Officer (DPO); requests are handled directly by the controller at the contact details above.

The BNG Studio website is a presentation site. It has no contact form, creates no user accounts and asks for no data when you simply visit. Data reaches us only when you choose to get in touch. Depending on the channel you use and the information you share, the following may be processed:

• the name or business name you introduce yourself with;
• your email address, if you write to us by email;
• your phone number and the profile details shown by the app (such as your display name), if you message us on WhatsApp;
• your username, if you contact us through Instagram;
• information about your business and the project you have in mind, shared voluntarily during the conversation (sector, objectives, content, existing materials);
• the details needed for invoicing, if a service is contracted (such as the client's name, address and tax identification number);
• the correspondence exchanged with us and the history of project-related discussions.

We do not request and do not knowingly process special categories of data (health data, beliefs, trade union membership and so on). Please do not send us such information.

Data generated automatically when you visit the website

As with any website, the hosting provider may automatically process technical data — such as IP address, browser and device type, date and time of access, or the page requested — for the operation and security of the service. This data is generated at infrastructure level and is not used by BNG Studio to identify you, build a profile of you, or track you across websites.

Collection happens solely through your own voluntary action: when you press a button that opens WhatsApp, send us an email, or write to us on Instagram. The website collects no data in the background and uses no behavioural tracking technologies.

The website contains buttons that, when pressed, redirect you to WhatsApp with a pre-filled message. The redirect only happens if you choose to press the button; until then, nothing is sent to WhatsApp.

Once the conversation takes place in WhatsApp, the interaction also runs through a third-party service (WhatsApp Ireland Limited, part of the Meta group), which processes data as an independent controller under its own policies and terms. BNG Studio neither controls nor can modify the processing carried out by WhatsApp/Meta and is not responsible for it. We recommend reviewing WhatsApp's privacy policy before using this channel.

On our side, we process the content of the messages you send us and the phone number you write from, in order to reply and discuss the project.

If you write to us by email, we process your email address, the content of your message and any attachments, in order to reply and take the conversation further. Messages are stored in the controller's mailbox, hosted by the email provider used by the controller (Google), acting as a service provider.

Please send us only the information needed for the discussion about your project.

• to answer the questions and requests you send us;
• to discuss the project you have in mind and assess whether and how we can deliver it;
• to prepare and send a tailored quote;
• to communicate throughout the collaboration with clients and prospective clients;
• to perform the requested services and deliver the agreed project;
• to meet our legal, accounting and tax obligations where a service is contracted;
• to protect our legitimate business interests, including keeping records of discussions and agreements reached, and establishing, exercising or defending legal claims.

We do not use your data for automated marketing, profiling or behavioural advertising, and we make no automated decisions producing legal effects concerning you.

The legal basis differs depending on the processing activity:

• Pre-contractual steps — Art. 6(1)(b) GDPR: processing from the moment you contact us to discuss a project until a quote is sent, at your request.
• Performance of a contract — Art. 6(1)(b) GDPR: processing necessary to produce and deliver the agreed services.
• Legal obligation — Art. 6(1)(c) GDPR: issuing and retaining financial and accounting documents under applicable accounting and tax legislation.
• Legitimate interests — Art. 6(1)(f) GDPR: retaining relevant correspondence, ensuring website security and defending the controller's rights.
• Consent — Art. 6(1)(a) GDPR: only where we explicitly ask for your agreement, for example if you allow us to publicly present the project built for you as portfolio work. You may withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

Consent is not the legal basis for most of the processing described here: communicating about a project and performing the services rest on the (pre-)contractual relationship between us.

We keep data only as long as necessary for the purpose it was collected for, applying the following principles:

• correspondence with people who contacted us but with whom no collaboration followed is kept for a reasonable period, while the conversation may still be resumed, and is then deleted;
• data relating to a contracted project is kept for the duration of the collaboration and afterwards, for as long as contractual liability may arise or it is needed to defend a legal claim;
• financial and accounting documents are kept for the periods required by Romanian accounting and tax legislation, which generally provides for 5 or 10 years depending on the type of document.

Once those periods expire, the data is deleted or anonymised.

We do not sell or rent your data. It may be accessible to the following categories of recipients, strictly to the extent necessary:

• the provider hosting and delivering the website;
• the email service provider used by the controller;
• the communication platforms you choose to use (WhatsApp, Instagram), which process data as independent controllers;
• the controller's accountant or tax adviser, for documents relating to the collaboration;
• public authorities, where there is a legal obligation to disclose.

Following a technical review of the website, the only resources loaded from third parties are the web fonts:

• Fontshare (Indian Type Foundry) — provides the fonts used in the design, loaded from api.fontshare.com and cdn.fontshare.com. When the fonts load, your browser sends this provider your IP address and the standard technical information accompanying the request. The review confirmed that this resource sets no cookies in your browser.

Apart from these, the website loads no third-party scripts, contains no embedded content (maps, videos, widgets) and uses no advertising networks. Further details are available in the Cookie Policy.

Some of the providers mentioned above are organisations outside the European Economic Area, or may process data on servers located outside the EEA. Where such transfers occur, they take place under the mechanisms set out in Chapter V of the GDPR, such as European Commission adequacy decisions or the standard contractual clauses adopted by it, on the terms established by each provider through its own policies.

The controller does not itself transfer personal data to recipients outside the EEA for purposes other than those described in this document.

We apply reasonable technical and organisational measures to protect data: the website is delivered encrypted over HTTPS, access to the mailbox and the accounts used is protected by authentication, and access to project information is limited to what is necessary to deliver the services.

No method of transmitting or storing data on the internet is completely secure, however. We cannot guarantee absolute security of data and offer no such guarantee.

As a data subject, you have the following rights under the GDPR:

• right of access — to find out whether we process your data and to obtain a copy of it;
• right to rectification — to ask that inaccurate data be corrected or incomplete data completed;
• right to erasure — to ask for your data to be deleted, in the situations provided by law;
• right to restriction of processing — to ask that processing be limited in the cases set out by the GDPR;
• right to object — to object to processing based on legitimate interests, on grounds relating to your particular situation;
• right to data portability — to receive the data you provided in a structured, commonly used and machine-readable format;
• right to withdraw consent — at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• right to lodge a complaint with the supervisory authority.

Supervisory authority

The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, postcode 010336, Bucharest, Romania. Website: www.dataprotection.ro, email: anspdcp@dataprotection.ro. You also have the right to bring the matter before the competent courts.

You can exercise any of the rights above by sending a request to bungardeanc1@gmail.com. So that we can respond correctly, we may ask for reasonable additional information allowing us to confirm your identity.

We respond to requests without undue delay and in any case within one month of receipt. That period may be extended by two further months where the request is complex or where several requests have been made, in which case you will be informed of the extension and the reasons for it.

This policy may be updated when legal, technical or operational changes occur — for example if the website begins using new services. The applicable version is the one published on this page, and the date of the last update is shown at the top of the document. We encourage you to review it periodically.