Privacy Policy

Last updated: 9 October 2026

1. General Information and Identification of the Data Controller

This Privacy Policy explains how INGINERIE CREATIVĂ BIROU DE PROIECTARE SRL collects, uses, stores, and protects the personal data of individuals who visit the website www.ingineriecreativa.ro, contact us, request information or quotations, use our services, or participate in our recruitment processes.

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), Romanian Law No. 190/2018, Law No. 506/2004, and other applicable Romanian legislation.

The data controller is:

INGINERIE CREATIVĂ BIROU DE PROIECTARE SRL

Unique Registration Code (CUI): 37971614

Trade Register Number: J2020000093279

EUID: ROONRC.J2020000093279

Registered Office: 68–70 Brândușelor Street, 2nd Floor, Apartment C1-U5, Postal Code 500397, Brașov, Brașov County, Romania

Email: office@ingineriecreativa.ro

Phone: 0731 31 90 90

Website: https://www.ingineriecreativa.ro/

Hereinafter, the terms “we,” “the company,” and “Inginerie Creativă” refer to INGINERIE CREATIVĂ BIROU DE PROIECTARE SRL.

This policy applies to the processing of personal data relating to individuals, including clients, prospective clients, project beneficiaries, job applicants, and representatives or contact persons of business partners.

2. What Personal Data We Collect

The data we collect depends on how you interact with us and the nature of the services requested.

2.1. Data Submitted Through the Contact Form

When you complete the contact form available on our website, we may collect:

First and last name;
Email address;
Phone number;
Information included in your message.

Your email address and message are required to submit the form. Other information may be provided at your discretion.

We use this data to respond to inquiries and provide information about our services.

2.2. Data Provided by Email or Telephone

When you contact us directly, we may process your identification and contact details, correspondence, and information necessary to address your inquiry.

This may include information about a construction project, its location, technical requirements, estimated budget, or documents you choose to provide.

2.3. Data Required to Provide Our Services

As part of our architectural and engineering design, technical consultancy, energy efficiency, project management, and construction activities, we may process:

Identification and contact details of clients and their representatives;
Addresses and information regarding project locations;
Information concerning land and properties, including cadastral data where necessary;
Data contained in technical, administrative, or contractual documentation;
Information required to prepare quotations and conclude contracts;
Billing details and financial information necessary for contractual relationships;
Correspondence relating to the organization, implementation, and completion of projects.

Certain documents may contain personal data relating to property owners, clients, legal representatives, or other individuals involved in a project.

We process this information only to the extent necessary to provide our services, manage contractual relationships, comply with legal obligations, and protect legitimate rights.

We do not ordinarily request special categories of personal data, such as health information, religious beliefs, or other sensitive information. In exceptional circumstances, such data will only be processed where an appropriate legal basis exists under Articles 6 and 9 of the GDPR.

2.4. Data Provided During Recruitment

When you apply for an available position or submit an unsolicited application, we may process:

First and last name;
Contact details;
CV and the information contained therein;
Professional experience;
Education and qualifications;
Professional portfolio;
Other relevant information voluntarily provided.

This data is used to assess applications and communicate with candidates throughout the recruitment process.

2.5. Automatically Collected Data

When you access our website, certain technical information may be processed, including:

IP address;
Browser and device type;
Operating system;
Date and time of access;
Pages visited;
Technical information concerning website operation and security;
Identifiers and information collected through cookies or similar technologies, where applicable.

Our website is built and hosted using the Wix platform.

Technical information may be processed through Wix infrastructure and, depending on the services enabled, by third-party providers.

3. Purposes and Legal Bases for Processing

We process personal data only for specified, explicit, and legitimate purposes, based on the legal grounds established under Article 6 of the GDPR.

3.1. Managing Inquiries and Preparing Quotations

We use personal data to respond to messages, assess the requirements of potential projects, arrange discussions, and prepare quotations.

Legal basis: Article 6(1)(b) of the GDPR, where processing is necessary to take steps at the request of the data subject prior to entering into a contract.

For general inquiries or communications with representatives of legal entities, the legal basis may be Article 6(1)(f), namely our legitimate interest in managing professional communications.

3.2. Concluding and Performing Contracts

We use personal data to prepare, conclude, administer, and perform contracts, including project coordination and communication with the individuals involved.

Legal basis: Article 6(1)(b) of the GDPR for contracts concluded with individuals, or Article 6(1)(f) for managing contractual relationships with legal entities and their representatives, as applicable.

3.3. Preparing Documentation and Completing Technical and Administrative Procedures

Depending on the contracted services, we may use personal data to prepare design, approval, permitting, and construction documentation, as well as to communicate with specialists, collaborators, authorities, or competent institutions.

Legal basis: Article 6(1)(b), (c), or (f) of the GDPR, depending on the nature of the processing and the applicable obligations.

3.4. Compliance With Legal Obligations

We process personal data to comply with tax, accounting, and administrative obligations, as well as requirements specific to the construction industry.

Legal basis: Article 6(1)(c) of the GDPR.

3.5. Recruitment

We use applicants' personal data to evaluate applications, assess professional suitability, and conduct recruitment and selection processes.

Legal basis: Article 6(1)(b) for pre-contractual measures, or Article 6(1)(f) for organizing the recruitment process, as applicable.

Applications retained for future employment opportunities are processed on the basis of the applicant's consent.

3.6. Newsletter and Marketing Communications

If you voluntarily subscribe to our newsletter, we may use the information provided to send professional articles, information about construction, energy efficiency, projects, and updates concerning our activities.

Where marketing communications require consent, such consent will be requested separately from the contact form and the conclusion of contracts.

Legal basis: Article 6(1)(a) of the GDPR, in conjunction with legislation governing electronic commercial communications.

You may unsubscribe at any time using the option provided in our communications or by contacting us directly.

3.7. Website Administration and Security

We may use technical information to ensure website functionality, prevent unauthorized access, identify technical issues, and maintain the security of our digital infrastructure.

Legal basis: Article 6(1)(f) of the GDPR, based on our legitimate interest in website administration and security.

For optional cookies and technologies requiring consent, the provisions of Romanian Law No. 506/2004 and the GDPR apply.

3.8. Protection of Rights and Resolution of Disputes

We may process personal data to establish, exercise, or defend legal claims, manage complaints, or resolve disputes.

Legal basis: Article 6(1)(f) of the GDPR, or Article 6(1)(c) where a legal obligation applies.

4. Sources of Personal Data

In most cases, personal data is obtained directly from the individuals concerned.

In connection with projects, personal data may also be obtained from:

Clients or their representatives;
Architects, engineers, designers, and other specialists involved;
Collaborators or contractual partners;
Public authorities and institutions;
Cadastral, technical, or administrative documentation lawfully obtained.

When we receive personal data from other sources, we provide the information required under Article 14 of the GDPR, subject to applicable legal deadlines and exceptions.

5. Provision of Personal Data

Providing certain personal data is necessary for us to respond to inquiries or deliver the requested services.

For the contact form, the email address and message are mandatory fields.

To conclude and perform contracts, certain identification details, billing information, or project-related information may be required for contractual or legal reasons.

Failure to provide the necessary information may prevent us from responding to an inquiry, preparing a quotation, or providing services.

Providing data for newsletter subscriptions is voluntary and is not a condition for accessing our services.

6. Recipients of Personal Data

To the extent necessary to fulfill the stated purposes, personal data may be disclosed or made available to the following categories of recipients:

Digital service providers: Web hosting, IT administration, email, storage, communications, analytics, or marketing service providers, where lawfully used.
Project specialists: Architects, engineers, design reviewers, technical experts, surveyors, consultants, and other individuals involved in delivering the contracted services.
Institutions and authorities: Public administration authorities, competent construction authorities, utility providers, and other organizations involved in approval, permitting, or inspection procedures.
Professional service providers: Accountants, tax consultants, lawyers, auditors, and other service providers, to the extent necessary for our business operations.
Courts and regulatory bodies: Where disclosure is required or permitted by law.

Recipients may act as independent data controllers or data processors, depending on the nature of the services provided.

Where processing is carried out by data processors, we apply the contractual safeguards required under Article 28 of the GDPR.

We do not sell the personal data of website visitors.

7. International Data Transfers

Certain digital service providers used in our operations may operate outside the European Economic Area (EEA).

Our website is built and hosted through Wix, a provider headquartered in Israel, which may use affiliated entities and subcontractors in other jurisdictions.

Where personal data is transferred outside the EEA, the safeguards provided for under Chapter V of the GDPR apply.

Depending on the destination and applicable transfer mechanism, transfers may be based on:

Adequacy decisions issued by the European Commission;
Standard Contractual Clauses approved by the European Commission;
Other safeguards or derogations permitted under the GDPR, where applicable.

For additional information about international transfers involving your personal data, please contact us at office@ingineriecreativa.ro.

Wix's Privacy Policy is available at https://www.wix.com/about/privacy.

8. How Long We Retain Personal Data

We apply the storage limitation principle established under Article 5(1)(e) of the GDPR.

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations.

The retention periods applied by our company are as follows.

8.1. General Inquiries and Contact Forms

Data submitted through contact forms, email, or other channels for general inquiries is retained for 12 months from the last interaction, unless a contractual relationship arises or another justified legal requirement applies.

At the end of this period, data is deleted or anonymized, except where continued retention is legally justified.

8.2. Quotation Requests and Pre-contractual Negotiations

Data and documents relating to quotation requests that do not result in a contract are retained for 24 months from the last relevant communication.

This period allows us to manage renewed inquiries and document pre-contractual discussions, subject to the principles of necessity and proportionality.

Where a contract is concluded, the necessary data is incorporated into the records relating to the contractual relationship.

8.3. Contracts and Business Correspondence

Identification details, contractual correspondence, and administrative documents not subject to specific retention requirements are retained for the duration of the contract and, as an internal policy, for 3 years following its termination, to document the relationship and defend potential legal rights.

This period does not apply to documents that must be retained for longer under accounting legislation, construction legislation, or other specific legal provisions.

8.4. Financial and Accounting Documents

Mandatory accounting records and supporting documents underlying financial accounting entries are retained for 5 years, calculated from July 1 of the year following the financial year in which they were prepared, in accordance with Article 25 of Romanian Accounting Law No. 82/1991.

Any special retention periods established by law for specific categories of documents also apply.

8.5. Technical Documentation Relating to Construction Projects

Technical documentation, designs, verification records, and other documents relevant to construction quality and safety are retained separately from ordinary business correspondence.

For documentation required to demonstrate compliance with professional obligations and manage liability for latent defects, the company establishes, as an internal policy, a minimum retention period of 10 years from the acceptance of the completed works, insofar as the documents remain necessary and their processing is legally justified.

Where documents are relevant to obligations and liabilities that may continue throughout the lifetime of a building, retention may continue for as long as such justification exists.

Documents forming part of the building's technical record are subject to the specific preparation, handover, and retention requirements established under construction legislation.

Retaining technical documentation does not mean retaining all contact details and business correspondence for the same period. We apply the data minimization principle according to the nature and relevance of each document.

8.6. Job Applicant Data

Personal data relating to unsuccessful applicants is retained for 6 months following the conclusion of the recruitment process, after which it is deleted or anonymized, unless another legal basis justifies its retention.

For unsolicited applications, the retention period is 6 months from receipt.

Where an individual consents to being contacted about future professional opportunities, their data may be retained for 12 months from the date consent is given, with the right to withdraw consent at any time.

8.7. Newsletter and Marketing Communications

Subscribers' personal data is retained for the duration of their subscription, until they unsubscribe, withdraw consent, or the purpose for which the data was collected ceases to exist.

Following unsubscription, their data is removed from the active marketing list.

Records of consent and information strictly necessary to demonstrate legal compliance may be retained for up to 3 years after unsubscription, where a justified legitimate interest exists in demonstrating compliance or defending legal rights.

A minimal record of objections or unsubscribe requests may be retained separately, where necessary to prevent unwanted future communications.

8.8. Technical Data and Cookies

Cookie retention periods vary depending on their purpose and configuration.

As a company policy, cookie consent preferences are renewed every 6 months, with users able to modify their preferences at any time.

Specific cookie retention periods are detailed in our Cookie Policy and in the information provided through the consent management mechanism.

8.9. Special Circumstances

The retention periods above may be extended only where additional retention is necessary to comply with a legal obligation, manage litigation, meet an archiving requirement, or exercise or defend a legal right.

Once the applicable retention periods expire, data is securely deleted, anonymized, or otherwise disposed of.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure its functionality and security, remember user preferences, and, depending on the services enabled, perform statistical analysis or integrate external features.

Strictly necessary cookies may be used without consent under the exceptions provided by applicable legislation.

Optional cookies requiring consent are activated only after the user has provided consent.

Users may accept all optional cookies, reject them, or customize their preferences.

Consent may be withdrawn at any time through the cookie preference management mechanism.

Rejecting optional cookies does not prevent the use of essential website functions, although certain external services may become unavailable.

Further information is available in our Cookie Policy.

10. Images and Project Information

Our website may include photographs, renderings, graphic representations, and descriptions of completed projects.

Where such materials contain data that makes individuals identifiable, publication is carried out on a valid legal basis and in accordance with the rights of the individuals concerned.

Where publication requires consent, this is obtained before the relevant materials are used.

Data contained in technical or contractual documentation is not automatically made public simply because a contractual relationship exists.

11. Personal Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or accidental or unlawful destruction.

Access to personal data is restricted to individuals who require it to perform their professional duties.

Protection measures are adapted to the nature of the data, the volume of processing, and the associated risks.

Although we take measures to reduce security risks, no information system can guarantee the complete elimination of all vulnerabilities.

12. Rights of Data Subjects

Under the GDPR, you have the following rights, subject to the conditions established by law:

Right to be informed: To receive clear information about how your personal data is processed.
Right of access: To obtain confirmation of whether your personal data is being processed and access to the information provided for under the GDPR.
Right to rectification: To request the correction of inaccurate data or completion of incomplete data.
Right to erasure: To request the deletion of personal data in the circumstances provided by law.
Right to restriction of processing: To request that processing be restricted in the circumstances established under the GDPR.
Right to data portability: To receive your personal data in a structured, commonly used, and machine-readable format, where the legal conditions are met.
Right to object: To object to processing based on legitimate interests, subject to applicable law, and to object at any time to processing for direct marketing purposes.
Right to withdraw consent: To withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Rights relating to automated individual decision-making: To benefit from the protections provided under Article 22 of the GDPR, where applicable.

To exercise these rights, you may contact us at:

office@ingineriecreativa.ro

We will respond without undue delay, generally within one month of receiving your request.

In complex cases or where numerous requests have been received, this period may be extended by up to two additional months, provided that you are informed within the initial period, in accordance with the GDPR.

Where we have reasonable doubts regarding the identity of the person submitting a request, we may ask for additional information necessary to verify their identity.

Exercising these rights is generally free of charge, subject to the exceptions provided under the GDPR.

13. Right to Lodge a Complaint

If you believe that your personal data is being processed in violation of applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In Romania, this authority is:

National Supervisory Authority for Personal Data Processing (ANSPDCP)

Website: https://www.dataprotection.ro/

You also have the right to seek judicial remedies before the competent courts, in accordance with applicable law.

You may contact us directly to resolve any concerns, without this limiting your right to lodge a complaint.

14. External Websites and Services

Our website may contain links to other websites, social networks, video platforms, mapping services, or other external resources.

When you access these services, your personal data may be processed by their respective operators in accordance with their own privacy policies.

We recommend reviewing the information provided by these service providers before submitting personal data through their services.

15. Personal Data of Minors

Our website and services are primarily intended for individuals interested in professional services within the construction industry.

We do not intentionally collect personal data from minors for marketing purposes.

If you have reason to believe that a minor's personal data has been submitted without meeting the applicable legal requirements, you may contact us so that we can review the situation.

16. Updates to This Privacy Policy

We may periodically update this Privacy Policy to reflect legislative, technical, or organizational changes, or changes to our data processing activities.

The updated version will be published on our website, together with the date of the latest update.

Where the law requires additional notification or renewed consent, we will comply with these obligations before carrying out the relevant processing activities.

17. Contact

For any questions, requests, or complaints concerning the processing of personal data, you may contact us using the following details: