Privacy Policy

The controller of your personal data is:

TheFactory Agency is the brand under which the company delivers integrated digital services. The same company also operates ads-factory.ro for paid advertising, seo-factory.ro for search optimization, dev-factory.ro for web development, and thefactory.shopping. These are commercial brands of a single legal entity, not separate companies. If your data is used in connection with another brand of the group, that is not a disclosure to a third party but internal processing by the same controller.

This notice covers this website only. The group’s other websites collect different data through different means and publish their own notices.

For anything concerning your personal data, write to gdpr@thefactory.agency, an address monitored by the person responsible for data protection. You can also send it by post to the registered office, marked for their attention.

The terms below appear throughout this document. They are the ones defined in Article 4 of the General Data Protection Regulation (Regulation (EU) 2016/679), referred to here as the Regulation.

Personal data means any information relating to an identified or identifiable natural person. A person is identifiable if they can be recognised, directly or indirectly, by a name, an identification number, location data, an online identifier, or by other elements specific to their identity.

Processing means any operation performed on data: collection, recording, organisation, storage, alteration, consultation, use, transmission, erasure or destruction.

Restriction of processing means marking stored data with the aim of limiting its future processing.

Controller is the party that determines the purposes and means of processing. For this site, that is us.

Processor is the party that processes data on behalf of the controller, under a contract. Our hosting provider, for example.

Recipient is the person or organisation to whom data is disclosed, whether or not they are a third party.

Consent means a freely given, specific, informed and unambiguous indication of your wishes, by a statement or by a clear affirmative action.

We collect only what the stated purpose requires. Each row below has its own legal basis.

Two things worth stating explicitly, because they do not appear in any visible field. First, your IP address, your browser details and the moment of submission are saved automatically alongside every request, as evidence and as protection against abuse. Second, the contact form is protected by Google reCAPTCHA, which is described in section 4.

Providing the fields marked as required is necessary for us to answer you. If you do not complete them, we cannot process the request.

We do not sell your data and we do not disclose it for anyone else’s own purposes. It is accessible to:

• Our hosting provider, which stores the site and its database on our behalf, as a processor.
• Google, for traffic analytics through Google Analytics, for advertising measurement through Google Ads, for protecting the contact form through reCAPTCHA, and for the map on the contact page, which loads only if you press the button.
• Nobody else for the cookie banner. The banner is part of this site. Your choice is stored in your own browser and recorded on our own server, so no third party is involved in asking you or in keeping the answer.
• External advisers, meaning accountants, auditors and lawyers, where necessary to meet our legal obligations or to defend our rights.
• Public authorities, where the law obliges us to disclose data.

Google reCAPTCHA runs on the contact page as soon as it loads and sends Google your IP address, your browser and device details, and how you interact with the page. We rely on legitimate interest here: without it the form is flooded with automated messages. If you would rather not use it, write to us directly at gdpr@thefactory.agency.

Some of the providers above are companies in the United States or process data on servers there, namely Google.

These transfers rely on the safeguards set out in Chapter V of the Regulation: the standard contractual clauses adopted by the European Commission and, for certified providers, the adequacy decision on the EU-US Data Privacy Framework. You can ask us which safeguards apply to a given provider by writing to gdpr@thefactory.agency.

If you decline analytics and marketing cookies, no advertising or analytics provider receives cookie data about your visit.

Every form on this site asks you to tick a box before it will send. The box is not pre-ticked and the form will not submit without it, so nothing is collected unless you act.

Alongside what you type, we record the wording of the consent you agreed to and the moment you agreed to it, so that both of us can check later what was actually accepted, together with your IP address and browser details, and the page you sent the form from.

When you start a project enquiry, we also ask a few questions about the work itself, for example the platform your site runs on, how soon you need to start, and which of our services interest you. We keep these answers with your enquiry, for the same 12 months, and use them only to prepare a useful first conversation.

We use all of this only to answer you. We do not add you to a mailing list on the strength of a contact form. It is deleted after 12 months.

In short, you have the right of access to your data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object, the right not to be subject to an automated decision, and the right to withdraw consent. Each one is explained below.

You can exercise them at any time, free of charge, through the form on the Your Rights page or by writing to gdpr@thefactory.agency. We answer within one month at the latest.

Right of access. You can find out whether we process data about you and, if so, obtain a copy of it and information about how we use it.

Right to rectification. If a piece of data is wrong or incomplete, we correct it without undue delay. We communicate the correction to the recipients we had passed the data to, unless this proves impossible or involves disproportionate effort.

Right to erasure, also known as the right to be forgotten. You can exercise it when the data is no longer necessary for the purpose we collected it for, when you withdraw consent and there is no other basis, when you object and we have no overriding legitimate grounds, when the data has been processed unlawfully, or when the law obliges us to erase it.

Right to restriction of processing. You can exercise it while we verify the accuracy of data you contest, when processing is unlawful but you prefer restriction to erasure, when we no longer need the data but you want it kept for a legal claim, or while we verify whether our legitimate grounds override your objection.

Right to data portability. You can receive the data you provided to us in a structured, commonly used and machine-readable format, and you can ask us to transmit it directly to another controller where that is technically feasible.

Right to object. You can object to processing based on our legitimate interest. Where processing is for direct marketing, you can object at any time and we stop immediately, with no need to give a reason.

Right not to be subject to an automated decision. See the next section. In practice, we do not take such decisions.

Right to withdraw consent. If you gave us consent, for cookies or otherwise, you can withdraw it at any time, as easily as you gave it, under Article 7(3). Withdrawal does not affect the lawfulness of processing carried out beforehand.

So that we can identify you safely, we may ask for additional information. We do not do this to make the request harder, but to avoid disclosing your data to someone who is not you.

We do not take automated decisions producing legal effects concerning you or similarly significantly affecting you. No request sent through the site is accepted or refused by an algorithm; a person reads it.

Separately from that, if you accepted marketing cookies, advertising platforms may show you our ads based on the fact that you visited this site. That is segmentation for advertising, not a decision about you, and you can object to it at any time by withdrawing consent for that category.

We have taken technical and organisational measures proportionate to the risk: site traffic is encrypted end to end over HTTPS, access to data is limited by role and granted only to those who need it, and everyone who comes into contact with personal data signs a confidentiality undertaking.

One design detail that protects you concretely: every request sent through a form is saved on our side first and only then forwarded by email. If the email fails, your request is not lost.

Our services are addressed to companies and professionals. This site is not intended for persons under 16 and we do not knowingly collect data about them. If you become aware that a minor under 16 has provided us with personal data, write to gdpr@thefactory.agency and we will delete it.

When we change this policy, we publish the new version on this page and update the date at the top. If the change is significant, meaning a new purpose, a new legal basis or a new category of recipient, we tell you by appropriate means, and where the law requires it we ask for fresh consent.

For any question about your personal data or to exercise your rights: gdpr@thefactory.agency or +40 314 014 100.

By post, write to the registered office at Strada Balanței 46, Corbeanca, Ilfov County, or to the place of business at Strada Părintele Galeriu 6C, Sector 2, Bucharest. For requests concerning personal data, add the mention “for the attention of the data protection officer”.

If you exercise a right and are not satisfied with our answer, or if you consider that we are infringing your rights under the Regulation, you can turn to the Romanian National Supervisory Authority for Personal Data Processing. You can complain directly, without contacting us first, though it is usually faster if you write to us as well.

You also have the right to go to court.

• Cookie Policy, which cookies we use, how long they last and how you control them.
• Terms and Conditions, the rules for using this site.
• Your Rights, the form through which you exercise them.