Privacy Policy

1. Data Controller

The personal data you provide through this website is processed by Flavour Software S.R.L., a company registered in Romania with:

• CUI (Tax ID): 36238039
• EUID: ROONRC.J40/8714/2016
• Registered address: Bucharest, Romania
• Contact e-mail: contact@flavoursoftware.ro

2. Data We Collect

We collect only the data you voluntarily submit via our contact form:

• Name — to address you correctly in our reply
• E-mail address — to respond to your enquiry
• Subject — optional context for your request
• Message — details needed to understand and respond to your enquiry

In addition, the website and hosting environment may process limited technical data strictly necessary for security and delivery, such as server logs, IP address, user-agent information, request timestamps, anti-abuse rate-limit records, and a temporary session identifier used for secure form handling.

3. Purpose & Legal Basis

Contact form data is processed for the purpose of responding to your enquiry and, where applicable, taking steps prior to entering into a service relationship. The legal basis for that processing is Article 6(1)(b) GDPR.

Security, anti-spam, rate limiting, session protection, and technical logging are processed on the basis of Article 6(1)(f) GDPR, namely our legitimate interests in protecting this website, preventing abuse, and ensuring the integrity and availability of our communication channels.

4. Recipients / Processors

Your data is accessed only on a need-to-know basis. It may be processed by the following categories of recipients acting under confidentiality and data-protection obligations:

• Flavour Software S.R.L. internal staff or authorized collaborators handling enquiries
• Our hosting and server infrastructure provider, including the environment used to host this website and process form delivery
• Technical service providers involved in message transport, storage, maintenance, backup, or security operations, if used by the hosting environment
• Public authorities, courts, regulators, or law-enforcement bodies where disclosure is required by law

5. Security and Anti-Spam Processing

To protect this website and our contact channel against abuse, we apply technical and organizational safeguards such as HTTPS transport security, request-origin checks, clickjacking protection, content-security restrictions, server-side rate limiting, anti-bot honeypot fields, and temporary session handling. These measures are designed to prevent spam, automated misuse, malicious submissions, and unauthorized interaction with the form endpoint.

6. Cookies and Session Information

We do not use advertising, analytics, or profiling cookies on this website. However, when interacting with the contact form, the server may create a strictly necessary session identifier to support secure request handling and protection against abuse. Such session data is not used for marketing or behavioral tracking and is kept only for the active session or for the minimum time necessary to complete the security function.

7. International Transfers

We aim to keep personal data within the European Economic Area wherever possible. If any service provider used by the hosting or mail-delivery environment processes data outside the EEA, we expect such processing to rely on a valid transfer mechanism under GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with appropriate safeguards.

8. Mandatory vs Optional Fields

The fields Name, E-mail, and Message are mandatory because we cannot meaningfully respond to your request without them. The Subject field is optional. If you choose not to provide the mandatory fields, we may be unable to process or answer your enquiry.

9. Retention Schedule

• Contact messages and business correspondence: up to 3 years from the last relevant interaction
• Temporary anti-abuse and rate-limit records: up to 10 minutes within the active protection window, then overwritten or expired by the server-side mechanism
• Session identifiers used for secure form handling: only for the active session or until technically expired
• Standard server access/security logs: retained according to hosting-environment rotation schedules and operational/legal needs

10. Your Rights

Under GDPR and Romanian Law 190/2018 you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data
• Portability — receive your data in a structured, machine-readable format where applicable
• Objection — object to processing based on legitimate interests where applicable
• Restriction — ask us to limit how we process your data in certain circumstances

To exercise any of these rights, contact us at contact@flavoursoftware.ro. We will respond within the time limits required by applicable law.

11. Automated Decision-Making

We do not use your personal data for automated decision-making or profiling within the meaning of Article 22 GDPR.

12. Supervisory Authority

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with the Romanian data-protection authority:

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The "Last updated" date at the top of this page shows the current version in force.