Privacy Policy

01 Who we are

Your data is processed by two joint controllers under Article 26 of the GDPR: PLEROMA S.R.L., which runs the Pleroma Branding website, and A.R.G. EXCLUSIV S.R.L., the company that signs the contracts with clients and issues their invoices. The two companies set the purposes and means of the processing together; the essence of their arrangement is what this policy describes. For any question about your data, whichever controller holds it, you can reach us here:

Controller: PLEROMA S.R.L.
Tax ID (CUI): RO54497201
Trade Register no.: J2026025141007
EUID: ROONRC.J2026025141007
Joint controller: A.R.G. EXCLUSIV S.R.L.
Tax ID (CUI): RO47490430
Trade Register no.: J2023000117246
Registered office, both companies: Str. Alexandru Vaida Voevod nr. 41, Coruia village, Săcălășeni commune, Maramureș County, 437284, Romania
Email: office@pleromabranding.com
Phone: +40 756 218 828

02 What data we collect

We only collect the data we need to reply to you, to make the site work and, with your consent, to see how the site is used:

Contact details: your name, email address, phone number and the message you send us through the form. The message reaches us by email, together with the page you sent it from and the site’s language.
Direct conversations: what you write to us on WhatsApp or by email, or tell us by phone, if you contact us that way.
Data for form protection: when you submit the form, we keep the time of submission and a digital fingerprint of your IP address, calculated with a secret key. For this purpose we do not keep the IP address itself.
Technical data: the IP address, date and time, browser type, pages visited and the page you came from, which the site’s server logs automatically.
Statistics data: how you use the site (the pages you visit, how long you stay on them, how far you scroll, which links you press, whether you start or send the form, where you came from, the type of browser and device, the approximate country and city) and a code from the Google Analytics cookies, which tells your browser apart from others. We collect it through Google Analytics, only with your consent. Google uses your IP address only to work out the approximate country and city, and does not keep it.

We do not ask you for sensitive data, such as health data or beliefs. Please do not send us any through the form.

03 Why we use it

We use the data only for the purposes below. Each purpose has a legal basis under the GDPR (Regulation (EU) 2016/679).

Purpose	Data	Legal basis
We reply to your message or call	Name, email, phone, message	Steps taken at your request, before a contract · art. 6(1)(b). For other messages: our legitimate interest · art. 6(1)(f)
The offer and the contract, if you become a client (A.R.G. EXCLUSIV S.R.L.)	Identification and contact data	Entering into and performing the contract · art. 6(1)(b)
Invoicing and accounting (A.R.G. EXCLUSIV S.R.L.)	Billing data	Legal obligation · art. 6(1)(c)
We protect the form from spam and abuse	The IP address fingerprint and the time of submission	Our legitimate interest · art. 6(1)(f)
We keep the site secure and working	Technical data from the server logs	Our legitimate interest · art. 6(1)(f)
We count visits and see which pages are read	Technical data from the server logs	Our legitimate interest · art. 6(1)(f)
Statistics about how the site is used, with Google Analytics	Technical data, through cookies	Your consent · art. 6(1)(a)

Our legitimate interest: to reply to messages that are not about a contract, to receive genuine messages, not spam, to stop abuse, to keep the site secure and working and to know how many visits the site gets. We use this data only for that.

Your consent: we produce the Google Analytics statistics only if you accept statistics cookies in the cookie banner. You can withdraw it at any time, from the “Cookie settings” button at the bottom of every page.

To stop spam, the form has a hidden field, which only automated programs fill in, and it rejects messages filled in within only a few seconds. We also limit how many messages can be sent from the same IP address within an hour. For this we count by the digital fingerprint, not by the IP address. If a check blocks your message by mistake, you can call us or write to us on WhatsApp.

We do not make important decisions about you automatically, and we do not build a profile of you. The only automated checks are the anti-spam checks above.

04 Do you have to give us your data?

No. No law and no contract requires you to give us data through this site. However, the form needs your name, email, phone and message: without them it cannot be sent and we cannot reply to you. You can also call us or write to us on WhatsApp.

The form also asks you to tick that you have read this policy. The legal bases for processing are the ones in the table above.

If you become a client, we need your data to enter into the contract, and the law requires us to have your billing data. Without them we cannot enter into the contract or issue an invoice.

We do not sell your data. We share it only with the partners who help us work, under contract and only as much as needed, and with public authorities, when the law requires it:

The hosting provider for the site and email: Chroot Network SRL.
Programming Gurus SRL, which built the site and handles its technical side.
Google, through Gmail, where we read and send emails.
Google Ireland Limited, through Google Analytics, for statistics about how the site is used, only with your consent.
Our accountant, for invoicing.
Public authorities, only when the law requires it.

If you write to us on WhatsApp, the conversation goes through the WhatsApp service, provided by Meta. WhatsApp uses data under its own terms and its privacy policy. The WhatsApp link on the site sends nothing to WhatsApp until you tap it.

06 Transfers outside the EU

Some partners, such as Google (Gmail and Google Analytics) and Meta (WhatsApp), may process data outside the European Economic Area, in the United States of America.

For US companies certified under the EU-U.S. Data Privacy Framework, the European Commission has decided that data is protected at an adequate level (Implementing Decision (EU) 2023/1795). Google LLC and Meta Platforms, Inc. are certified. The list of certified companies is on dataprivacyframework.gov.

A transfer that this decision does not cover is made only under the standard contractual clauses approved by the European Commission. You can ask us for a copy of these safeguards at office@pleromabranding.com.

07 How long we keep data

Messages and conversations: [12 months] from the last contact, if you do not become a client.
Messages and conversations with clients: [for as long as the collaboration lasts, plus X years].
The contract: [the period].
Invoices and accounting documents: 5 years from 1 July of the year following the close of the financial year in which they were issued (the Accounting Law no. 82/1991, art. 25).
The form’s IP address fingerprint: we use it for one hour, then it is deleted automatically, with the next message sent through the form.
Server logs and visit statistics: until the end of the month in which you visited the site.
Google Analytics data: the cookies stay in your browser for as long as the Cookie Policy says. Google Analytics keeps the data about each visit for 2 months; after that, only aggregated statistics remain, with no data about individual visits.

After these periods, we delete the data or anonymise it.

08 Your rights

The GDPR gives you the following rights over your data:

Access: find out what data we hold about you and receive a copy.
Rectification: we correct data that is wrong or incomplete.
Erasure: we delete data when we no longer have a basis to keep it.
Restriction: we limit the use of data, for example while we check a request from you.
Portability: you receive the data in a format that is easy to transfer.
Objection: you object to processing based on our legitimate interest, for reasons linked to your situation.
Withdrawing consent: when processing is based on your consent, you can withdraw it at any time, without affecting processing done before that.

To exercise a right, write to us at office@pleromabranding.com. We reply within one month at most.

The request is free of charge. If it is complex or we receive many requests, we may extend the deadline by a further two months. We will tell you this, with the reason, within the first month.

The right to object. You can object at any time, for reasons linked to your situation, to processing based on our legitimate interest. We then stop the processing, unless we have compelling legitimate grounds that override your interests and rights, or we need the data to defend a right in court.

If you are not satisfied with the response, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro.

09 How we protect data

We take appropriate technical and organisational measures. The site uses an encrypted connection (HTTPS), and only the people who reply to you read your messages.

The form’s IP address fingerprints stay on the server, outside the public part of the site. If a message cannot be sent, we log only the time and the technical error, without your data.

10 Cookies

The site sets statistics cookies only with your consent, given in the cookie banner, and a single necessary cookie, which keeps your choice. You can change your choice at any time from the “Cookie settings” button at the bottom of every page. Details in the Cookie Policy.

11 Changes

We may update this policy when the law or our services change. The date of the last update appears at the top of the page.