Privacy notice
Who processes your data
The data controller is THILIA CONSULTING S.R.L., registered office: 19 Vasile Alecsandri Street, Miroslava village, Miroslava commune, Iași County, Romania; Trade Register no. J2025006148002; tax ID (CUI) 51202969. Phone +40 745 086 691, email gigi.bursucanu@gmail.com.
When you visit this website
This website uses no cookies, contact forms or visitor tracking tools and loads no resources from other websites. It is hosted by Cloudflare, which processes on our behalf the IP address and the technical data of each request (for example, the date and the page requested), only to deliver the pages and to protect them against attacks. The legal basis is our legitimate interest in making the website available and protecting it against attacks (Art. 6(1)(f) GDPR). In our Cloudflare account we see aggregate statistics, such as the number of visits. For requests blocked or challenged as suspicious we also see a security log with the IP address, country, page requested and browser type. We use this data only to keep the site secure and do not try to identify visitors.
When you call or email us
We process the data you send us: your name, contact details, the content of your message and information about your project.
- to reply to you and send you a quotation — on the basis of our legitimate interest in answering the requests we receive (Art. 6(1)(f) GDPR) or, if you ask for a quotation, steps taken before entering into a contract (Art. 6(1)(b));
- if we work together, to conclude and perform the contract (Art. 6(1)(b)); if you contact us on behalf of a legal entity (for example, a forest district, a religious unit or a company), as its representative, employee or contact person, the legal basis, for the quotation and for the contract, is our legitimate interest in contracting with that entity and communicating with the persons it designates (Art. 6(1)(f));
- for the company's legal obligations, such as accounting and tax (Art. 6(1)(c)).
Providing data is not a legal obligation. Without contact details we cannot reply, and without identification and invoicing details we cannot conclude the contract. We make no automated decisions and do no profiling.
Who may receive your data
Only as far as your project requires: our collaborators on the same project (for example, the certified experts with whom we prepare studies), the authorities to which documents are submitted, our accountant, and our email and website hosting providers. Cloudflare, Inc. (website hosting) and Google LLC (Gmail) may process data in the United States. These transfers rely on the European Commission’s adequacy decision on the EU–U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795) for companies certified under it (official list: www.dataprivacyframework.gov) or, failing certification, on the standard contractual clauses adopted by the Commission and included in the two companies’ data processing agreements. You can ask us for details of these safeguards at the email address above. We do not sell your data or pass it on to others for commercial purposes.
How long we keep it
Cloudflare keeps the technical data of requests only as long as needed to deliver the pages and keep them secure; the security log in our account is available for no more than 31 days. Correspondence that does not lead to a contract, including quotation requests and quotations not accepted, is kept for no more than 2 years after the last message and then deleted. Data related to a contract is kept for the duration of the contract and afterwards only as long as the law requires for keeping accounting records (Romanian Accounting Law No. 82/1991).
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability. To exercise any of them, email us at gigi.bursucanu@gmail.com. You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro).
Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR), by emailing us at the same address. We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.