Free Consultation

Privacy Policy

Last updated:

Vatria Consult S.R.L. – Website, contact enquiries, WhatsApp Business and social-media links

ControllerVatria Consult S.R.L., Jud. Brașov, Loc. Zărnești, Str. Gutanu nr. 3, România
Trade RegisterJ2025097239003
EUIDROONRC.J2025097239003
CUI53109352
Represented byPaul-Sebastian Rehner
Privacy contactinfo@vatriaconsult.com | +40 732 779 548
Version1.0
Last updated20 May 2026

Note: This version has been prepared on the basis of the currently described setup: corporate/lead website of Vatria Consult S.R.L. with contact form, Outlook/e-mail handling, WhatsApp Business and linked presences on Facebook and Instagram. Analytics, advertising, newsletter, CRM or other additional tools are covered only where they are expressly identified in this policy.

1. Scope and controller

This Privacy Policy explains the processing of personal data in connection with the website of Vatria Consult S.R.L., contact enquiries submitted through the website form, requests sent by e-mail or telephone, and optional contact through WhatsApp Business and linked social-media presences.

The controller for the purposes of the General Data Protection Regulation (GDPR) is Vatria Consult S.R.L., Jud. Brașov, Loc. Zărnești, Str. Gutanu nr. 3, România, Trade Register J2025097239003, EUID ROONRC.J2025097239003, CUI 53109352, represented by Paul-Sebastian Rehner.

Privacy-related enquiries may be sent to info@vatriaconsult.com. No data protection officer is identified in this policy because, on the current understanding, no such officer has been formally appointed.

 

2. What data we process

Depending on how the website and communication channels are used, we may process the following categories of personal data:

  • technical usage data, including IP address, date and time of access, requested pages/content, browser type, operating system, referrer URL, web-server log data and security-related events;
  • basic identity and contact data, including name, e-mail address, telephone number, company, role/function and location or project information voluntarily provided by the user;
  • content data from enquiries, including information about land, properties, documentation status, project objectives, issues raised and communication history;
  • communication data from e-mails, phone calls, contact forms and WhatsApp messages;
  • evidence and organisational data, including processing status, correspondence notes, scheduling context and internal allocation of the enquiry.

 

3. Purposes and legal bases

We process personal data only for specified, explicit and legitimate purposes and only where there is a valid legal basis.

The main purposes and legal bases are:

  • provision and secure delivery of the website, troubleshooting, abuse prevention and IT security – Article 6(1)(f) GDPR;
  • handling specific contact enquiries, answering follow-up questions and taking steps prior to entering into a contract at the request of the data subject – Article 6(1)(b) GDPR;
  • general business and communication administration, documentation of enquiries and protection of our legitimate interests in organised handling, quality assurance and the establishment, exercise or defence of legal claims – Article 6(1)(f) GDPR;
  • compliance with legal obligations where applicable in the individual case, for example accounting, tax or regulatory requirements – Article 6(1)(c) GDPR;
  • consent-based processing where expressly activated in the future, for example newsletters, non-essential cookies, analytics or marketing technologies – Article 6(1)(a) GDPR.

 

4. Website operation, server logs and technical security

When the website is accessed, technical log data may be processed on the server side. This processing is necessary to provide the website, maintain the stability and security of the systems, and understand abuse or attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and economically reasonable operation of the website.

Server log data is not processed for the purpose of profiling individuals without cause. Combination with other datasets takes place only where necessary for security, troubleshooting or the assertion or defence of legal claims.

 

5. Contact form and general communication

If you contact us through the contact form, by e-mail or by telephone, we process your information in order to handle your request, classify your matter and communicate with you further.

Where your enquiry relates to a potential engagement, review of a project, preliminary assessment or other pre-contractual steps, processing is based on Article 6(1)(b) GDPR.

Where enquiries are of a general nature or where documentation of the communication is required for proper handling, quality assurance or legal defence, processing is also based on Article 6(1)(f) GDPR.

Please do not send particularly sensitive or extensive original documents through the general website form unless a separate secure transmission channel has been agreed.

 

6. Processing in connection with WhatsApp Business

If you use the WhatsApp contact option provided by us, we process the communication and content data you send in order to handle your enquiry.

The use of WhatsApp is voluntary. You may contact us by e-mail or telephone instead at any time.

For our own processing of enquiries received via WhatsApp, the legal basis will generally be Article 6(1)(b) GDPR or Article 6(1)(f) GDPR, depending on the content and purpose of the communication.

Please note that when WhatsApp or WhatsApp Business is used, additional processing may be carried out by companies within the Meta group. We have only limited influence over that platform-side processing. It cannot be ruled out that data may also be processed outside the European Economic Area. The privacy information of the relevant Meta services applies in addition in this respect.

For confidential records, sensitive documents or extensive ownership, inheritance or project files, WhatsApp should be used only after checking whether it is an appropriate communication channel.

 

7. Social media and linked presences

Our website may contain links to presences on Facebook and Instagram. Merely visiting our website does not in itself normally result in data being transferred to those platforms where only simple links are used and no active social plugins or embedded feeds are implemented.

Only if you actively click such a link or interact with those platforms do you leave our website or establish a direct connection to the relevant service. From that point, the privacy and use terms of the respective platform operator apply in addition.

If you contact us through social-media channels, we process the data you provide for the purpose of communicating with you. Depending on the content, the legal bases are Article 6(1)(b) or Article 6(1)(f) GDPR.

 

8. Microsoft/Outlook and other service providers

Incoming website enquiries and other communication may be processed in our e-mail system. On the current setup, contact enquiries are transmitted to an Outlook/Microsoft-based mailbox.

We use external service providers only to the extent necessary for website operation, communication, technical provision or security. Where such providers process personal data on our behalf, we enter into data-processing agreements where legally required or rely on another permissible data-protection framework.

Depending on the technical configuration, providers with a group connection to third countries, in particular the United States, may be involved. In such cases, we pay attention to appropriate transfer mechanisms under Chapter V GDPR, such as adequacy decisions, certifications under an applicable EU-US framework or standard contractual clauses, where relevant.

 

9. Recipients or categories of recipients

Personal data is disclosed only to recipients to whom disclosure is necessary for the stated purposes. This may include in particular:

  • responsible internal contacts within Vatria Consult S.R.L.;
  • hosting, IT, security and website service providers;
  • e-mail and communication service providers, including Microsoft/Outlook where used;
  • WhatsApp Business or Meta services where that communication channel is used;
  • professional advisers and local specialist partners only where necessary in the specific case and where a valid legal basis exists;
  • authorities, courts, notaries, lawyers, surveyors, architects or other third parties only where required by law, initiated by you or necessary for appropriate handling in the individual case.

 

10. Transfers to third countries

Where service providers or platforms outside the European Economic Area are involved, or where access from third countries cannot be excluded, transfers take place only in compliance with Articles 44 et seq. GDPR.

Depending on the service and configuration, this may be based in particular on an adequacy decision of the European Commission, standard contractual clauses or other appropriate safeguards recognised under the GDPR.

Despite such mechanisms, the level of data protection in certain third countries may differ from that within the European Union. We therefore limit the use of such services to what is objectively necessary.

 

11. Retention period

We store personal data only for as long as necessary for the relevant purposes or where statutory retention obligations apply.

For the current website and lead-generation structure, the following retention logic generally applies, subject to a different legal requirement or a specific individual case:

  • technical server and security logs: generally only for as long as necessary for secure operation, troubleshooting and abuse prevention;
  • general contact enquiries without further collaboration: usually up to 12 months after the communication has ended;
  • qualified project or introductory enquiries with further relevance: usually up to 24 months after the last substantively relevant communication;
  • correspondence and records relevant under commercial or tax law: for as long as legally required;
  • records proving consent or withdrawal of consent: until the purpose of proof no longer exists.

 

12. Cookies and similar technologies

Further information on cookies and similar technologies is set out in our separate Cookie Policy.

Where only technically necessary cookies or comparable technologies are used, we rely on their necessity for operating the website and on the relevant Romanian electronic communications rules.

If non-essential analytics, marketing or personalisation technologies are introduced in the future, they will be used only after valid prior consent where such consent is legally required.

 

13. Whether you must provide data

As a general rule, the provision of personal data is not a statutory requirement. However, without the minimum information necessary to handle your request, we may be unable to respond or to respond properly.

Where information is optional, we do not treat it as mandatory; providing it is then your free choice.

 

14. Automated decision-making and profiling

On the current understanding of the website setup, we do not engage in solely automated decision-making, including profiling, within the meaning of Article 22 GDPR.

 

15. Your rights

Subject to the conditions of the GDPR, you have in particular the following rights:

  • the right of access to the personal data we process about you (Article 15 GDPR);
  • the right to rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);
  • the right to erasure under the conditions of Article 17 GDPR;
  • the right to restriction of processing (Article 18 GDPR);
  • the right to data portability where the conditions of Article 20 GDPR are met;
  • the right to object to processing based on legitimate interests (Article 21 GDPR);
  • the right to withdraw consent at any time with effect for the future.

 

16. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a competent data protection supervisory authority. For Vatria Consult S.R.L., the Romanian authority ANSPDCP is particularly relevant.

According to the published information, complaints to ANSPDCP may be submitted in writing in Romanian or English.

Current information on the procedure and contact routes can be found on the ANSPDCP website.

 

17. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure or unlawful alteration.

However, no electronic system is entirely risk-free. We therefore cannot guarantee absolute security, but we review and improve our measures on an ongoing basis.

 

18. Changes to this Privacy Policy

We may amend this Privacy Policy if legal requirements, website functions, the services used or internal processes change.

The current version published on the website is the version that applies.

 

Kontakt

For privacy questions or to exercise your rights, please contact info@vatriaconsult.com or write to Vatria Consult S.R.L., Jud. Brașov, Loc. Zărnești, Str. Gutanu nr. 3, România.