Privacy Policy
Last updated: 13 October 2026
1. Who we are
ROMANYA VATANDASLIGI SRL ("Bosfora Group", "Bosfora", "we"), tax ID (CUI) 50106890, registered with the Romanian Trade Register under no. J40/10083/2024, is the data controller for the information collected through this website (bosfora.ro / bosfora.eu / bosfora.tr) and the associated WhatsApp channel. Registered office: Bucharest, Bd. Regina Elisabeta nr. 7-9, 2nd floor, room 34, Sector 3. Business office: Louis Blanc Offices, Str. Arhitect Louis Blanc nr. 1, Et. 4, Sector 1, Bucharest, Romania. For any question about your data: office@bosfora.ro (opens in a new tab).
2. What data we collect
- Data you provide directly through the contact form: name, email address, phone / WhatsApp number (optional), the service you are interested in and your message. In later conversations (WhatsApp, phone, email) you may provide further data, such as details about your situation.
- Technical data collected automatically: your IP address (used briefly to protect the form against abuse and in the server's technical logs) and the data from cookies and similar technologies described in the Cookie Policy.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Responding to your enquiry, assessing your situation and proposing the relevant Bosfora services | name, email, phone (if provided), service, message | art. 6(1)(b): steps taken at your request prior to entering into a contract |
| Communicating via WhatsApp / phone | phone, content of the conversation | art. 6(1)(b) |
| Protecting the form against abuse (rate limiting) and site security | IP address, technical logs | art. 6(1)(f): our legitimate interest in protecting the site |
| Cookieless traffic statistics (Rybbit) | aggregated data, no persistent identifiers | art. 6(1)(f): our legitimate interest in understanding how the site is used |
| Google Analytics 4 statistics | _ga* cookies, browsing data | art. 6(1)(a): your consent, "Analytics" category in the cookie banner |
| Conversion measurement and attribution of enquiries to advertising campaigns (Google Ads, Meta) | click identifiers, marketing cookies; when the form is submitted, email and phone (if provided) to Google Ads and Meta and first name to Meta, pseudonymised (SHA-256 hash) | art. 6(1)(a): your consent, "Marketing" category in the cookie banner |
We make no automated decisions with legal effects on you and do no profiling within the meaning of art. 22 GDPR. Providing the form data is voluntary, but without it we cannot answer your enquiry.
If you become a client, the data needed to deliver the services (for example identity documents, company documents) is processed on the basis of the contract and our legal obligations, as described in the data protection notice you receive when the contract is signed.
4. Who we share data with
- Providers processing data on our behalf (processors):
- Microsoft Ireland Operations Ltd. (Microsoft 365): delivery and storage of the emails generated by the contact form;
- Vercel Inc. (USA): hosting the site and the server's technical logs;
- Hetzner Online GmbH (Germany): hosting our own cookieless statistics instance (Rybbit);
- Google Ireland Ltd. (Google Tag Manager, Google Analytics 4, Google Ads) and Meta Platforms Ireland Ltd. (Meta Pixel): only with your consent, as described in the Cookie Policy.
- Independent recipients:
- WhatsApp / Meta Platforms Ireland Ltd., as the provider of the messaging channel, if you choose to contact us via WhatsApp;
- our partner law firm, Boian, Gaina & Asociații: only when your situation requires legal assistance; it acts as an independent controller for the services it provides.
- Public authorities, where the law requires it.
The cookieless traffic statistics (Rybbit) are produced by an instance we operate ourselves on servers rented in the EU (Hetzner); the data is not passed to any other party. You can object to this processing at any time (art. 21 GDPR); details in the Cookie Policy.
We do not sell your data and do not use it for purposes other than those above.
5. Transfers outside the European Economic Area
Google, Meta, Microsoft and Vercel may also process data in the United States. Transfers rely on the adequacy decision for the EU-U.S. Data Privacy Framework (Google LLC, Meta Platforms, Inc., Microsoft Corporation and Vercel Inc. are certified) and, in addition, on the standard contractual clauses approved by the European Commission. You can request a copy of the applicable safeguards at the contact address above.
6. How long we keep data
- Form enquiries and the related conversations: 24 months from the last contact, then deleted, unless you become a client (in which case the contractual and statutory retention periods apply).
- The IP address used for rate limiting: a few minutes, in server memory. Technical logs: at most a few days, per the hosting platform's (Vercel) retention period.
- Cookies: for the durations set out in the Cookie Policy.
7. Your rights
Under the GDPR you have the right:
- of access to your data and to receive a copy;
- to rectification of inaccurate data;
- to erasure ("right to be forgotten"), under the conditions of art. 17;
- to restriction of processing;
- to object to processing based on legitimate interest;
- to portability of the data you provided;
- to withdraw consent at any time for processing based on consent (for example via "Cookie settings" in the page footer), without affecting the lawfulness of prior processing;
- to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro (opens in a new tab), or to seek a judicial remedy.
To exercise your rights, write to office@bosfora.ro (opens in a new tab). We reply within one month of receiving your request; in complex cases this may be extended by two further months, and we will let you know.
8. Security
We apply appropriate technical and organisational measures: encrypted transmission (HTTPS), sanitisation of form content, rate limiting, restricted access to received messages. No transmission over the internet is completely secure, however.
9. Changes
We may update this policy; the current version and its date are shown at the top of the page. Significant changes will be announced on the site.