Privacy Policy

Data controller

This policy applies to personal data processed by:

In this policy, "we", "the company" or "ReBrandMe" refers to the entity above. "You" or "the user" refers to the natural person whose personal data we process.

What data we collect

Through the forms on our website (the project brief form and the contact form) we collect only the data you voluntarily provide:

• Contact details: full name or company name, email address, phone number (required in the brief form, so we can reach you if your email address doesn’t work; optional in the contact form)
• Your message: the text sent through the contact form
• Project information: requested service type, project description, estimated budget, target deadline, relevant links
• Uploaded files: existing logo, brand materials, visual references or other documents voluntarily uploaded
• Minimal technical data: IP address and consent timestamp (exclusively for the GDPR audit log)
• Your client portal account (rebrandme.ro/client): name / contact person, company, email address, phone, profile photo (optional), language and preferences (sounds, notifications, cursor). Your password is stored encrypted and we cannot see it.
• What you write and upload in the portal: messages, comments on images, files, approvals, new requests and responses to proposals, with their date and time, plus which messages you have seen (to flag new messages).
• People invited to a project: when a project owner invites a colleague, we receive their name and email address in order to send the invitation.
• The ReBrandMe app (if you use it): a phone identifier for notifications. Face ID / fingerprint unlocking happens only on your phone; biometric data never reaches us.

We do not collect special categories of data and we do not use automated profiling that produces legal effects on you.

Purposes of processing

We use your data exclusively for:

• Responding to your business inquiry (sending a customized proposal)
• Communicating with you throughout the project discussion
• Fulfilling our legal obligations (accounting, tax) if you become a client
• Demonstrating GDPR compliance (consent log)
• Providing the client portal: access to your project, conversations with the team, files, approvals, proposals and notifications (email and, in the app, on your phone)

We do not use your data for direct marketing without a separate, explicit consent obtained afterwards.

Legal basis

• Consent (Art. 6(1)(a)): when you tick the consent box upon submitting the brief
• Pre-contractual measures (Art. 6(1)(b)): to respond to your request and evaluate a potential collaboration
• Legitimate interest (Art. 6(1)(f)): for website security and preventing abuse
• Legal obligation (Art. 6(1)(c)): if you become a client, for issuing and storing accounting documents
• Performance of a contract (Art. 6(1)(b)): for your portal account and project communication; for people invited by the project owner, the owner’s legitimate interest in involving their team (Art. 6(1)(f))

Storage duration

We keep data only as long as needed for the purpose we received it for (Art. 5(1)(e) GDPR):

• Requests that don't turn into a collaboration (briefs, contact messages and attached files): maximum 12 months from the last contact, so we can follow up on our proposal or reply if you write to us again. After that we delete them permanently; files attached on our server are deleted automatically.
• Clients: for the duration of the collaboration and 3 more years after it ends (the general limitation period, Art. 2517 of the Romanian Civil Code), for possible claims or disputes.
• Accounting and tax documents (contracts, invoices): 10 years from the end of the financial year, per Art. 25 of Romanian Accounting Law no. 82/1991.
• GDPR consent log (date, name, email address, IP and accepted policy version): 3 years from submission, as proof of consent; then deleted automatically.
• Your portal account: while it is active. You can delete it at any time from Profile → “Delete account”. If we haven’t started a collaboration, we delete the account together with its requests, messages and files. An account without any accepted proposal (no collaboration) is deleted automatically, with its requests, messages and files, after 12 months without activity. If you were a client, we delete the account and keep the project conversations and files for the period listed under “Clients”, because they relate to the work delivered.

You can ask us to delete your data at any time before these periods end. See "How to exercise your rights".

Data recipients

Your data is accessed only by authorized personnel within ReBrandMe Project S.R.L. We may disclose it to:

• The web and email hosting provider of the rebrandme.ro domain: its servers run the website and store files uploaded through the brief and the contact@rebrandme.ro mailbox
• Google (Gmail service), which we use to manage the contact@rebrandme.ro mailbox: messages sent through the forms also reach this account
• Accountant / accounting firm, only if you become a client
• Competent public authorities, only based on a justified legal request
• Other project members: what you write and upload in a portal project is seen by the ReBrandMe team, the project owner and the members invited to that project
• Expo (650 Industries, Inc.) and the Apple / Google notification services, only if you use the app: we send phone notifications through them (a title and a short text)
• Cloudflare (Turnstile service), when enabled: when you create an account, request a proposal or use the contact and brief forms, it checks that you are not a robot

We do not sell, rent or commercially trade your data with third parties.

International transfers

Google LLC is based in the US, so messages managed through Gmail may be transferred outside the European Economic Area. Google LLC is certified under the EU-US Data Privacy Framework, recognized by the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR); Google also relies on Commission-approved Standard Contractual Clauses (Art. 46 GDPR).

If you use the ReBrandMe app, or if the anti-robot check is enabled, some data (phone notifications, and your IP address during the check) also passes through Expo, Apple, Google or Cloudflare servers, which may be outside the European Economic Area. These providers rely on the transfer mechanisms provided by the GDPR (EU-US Data Privacy Framework certification and / or Standard Contractual Clauses).

Your rights

Under GDPR, you have the following rights:

How to exercise your rights

Send us an email at contact@rebrandme.ro with the subject "GDPR Request". We'll reply within maximum 30 days (which may be extended by two further months for complex requests, in which case we'll let you know). Exercising these rights is free of charge.

When you ask for erasure, we delete the messages, the brief and the attached files. We keep only what the law requires us to keep (e.g. accounting documents, if you were a client) or what is needed to establish or defend legal claims (Art. 17(3) GDPR), and we tell you exactly what that is.

Right to complain

You may lodge a complaint with the ANSPDCP:

• B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania
• Phone: +40.318.059.211 / +40.318.059.212
• Email: anspdcp@dataprotection.ro
• Web: www.dataprotection.ro

We encourage you to contact us first, since most situations can be resolved directly.

Cookies and similar technologies

The rebrandme.ro website does not use analytics or marketing cookies. We only keep in your browser (via local storage) the language you chose and whether you've already passed the language screen during the current visit: information strictly necessary for the functionality you asked for, which requires no consent and is never sent to us. The WordPress platform may set technical session and security cookies. If we ever add analytics cookies or marketing technologies, we will implement a separate consent banner.

Visitor statistics, without cookies. To understand which pages are useful and where visitors come from, we use our own statistics system, hosted on our server: the data is not shared with third parties (such as Google). If your browser sends the “Do Not Track” or “Global Privacy Control” signal, we do not record the visit at all. The site’s fonts and scripts are hosted on our server: the pages do not load fonts from Google or libraries from other servers. We record the page visited, the website you came from, campaign parameters in the link (UTM), the device type, your browser’s language and time zone, as well as actions such as submitting a form or clicking our email address. We use no cookies, store nothing in your browser and do not keep your IP address: visitors are counted with an anonymous code generated from the IP and browser together with a key that changes every day, so we cannot tell who you are or recognise you from one day to the next. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR). The data is deleted automatically after 13 months.

In the client portal we only use strictly necessary cookies and local data: the WordPress login cookie (while you are logged in; with “Remember me”, up to two weeks), your time zone (so times show in your local time), a temporary cookie when you create an account (48 hours, so you are logged in automatically after confirming your email) and, in the app, the notification identifier. In your browser we keep your language, sounds, cursor, the fact that you have seen the intro animation and drafts of unfinished forms. None of these are used for advertising or tracking.

Minors

Our services target legal entities and adults (over 18 years old). We do not intentionally collect data from minors. If you become aware that a minor has provided us with data, please contact us at contact@rebrandme.ro.

Changes to this policy

We may update this policy periodically. Any significant change will be published on this page with clear indication of the version and update date. If changes affect processing based on consent, we will ask for a new explicit consent.

Contact

• Email: contact@rebrandme.ro
• Postal address: Strada Cașin, nr. 2, bl. G5B, sc. A, ap. 5, Constanța, Romania