Privacy Policy
Last updated: 23 October 2026
1. General information
HUSH-HUSH CONSULTING & BEYOND S.R.L. respects the right to privacy and pays particular attention to protecting personal data.
This Privacy Policy explains how we collect, use, retain and protect the personal data of people who visit our website or contact us through it, as well as the rights available to them.
Data is processed in accordance with Regulation (EU) 2016/679 on the protection of personal data (GDPR), Romanian Law No. 190/2018 and other applicable legal provisions.
This policy covers processing associated with the use of the website and the handling of enquiries. Processing carried out as part of contracted professional services may be subject to additional notices tailored to the nature of those activities.
2. Identity of the controller
The personal data controller is:
HUSH-HUSH CONSULTING & BEYOND S.R.L.
Registered office: 12 Managua Street, Sector 1, Bucharest, Romania
Tax identification number: 52295869
Trade Register number: J2025059446001
E-mail: office@hushhushconsulting.com
Telephone: +40 721 255 667
For questions about personal data protection or to exercise your GDPR rights, please contact us at the email address above.
3. Categories of data processed
Depending on how you interact with the website, we may process the following categories of data:
a) Data provided through the contact form
First and last name;
The name of the company or organisation you represent, where applicable;
Email address;
Telephone number, if provided;
Service of interest;
Information included in your message.
b) Data provided through correspondence
When you contact us by email, telephone or other means of communication, we may process identification and contact details, the content of correspondence and information needed to handle your enquiry.
c) Technical data associated with website use
When you access the website or use the contact form, technical data such as your IP address, browser type, device information, and the date and time of access or submission may be processed.
Where the automated-message protection mechanism is used, the server may process a technical identifier cryptographically derived from the IP address, together with submission timestamps. This information is used exclusively to limit automated submissions and protect the operation of the form.
We do not ask you to submit special categories of personal data, identity documents or classified information through the general contact form. We recommend that you do not include such information in initial messages.
4. Purposes and legal bases for processing
We process personal data only to the extent necessary for specific, explicit and legitimate purposes.
Handling enquiries and communications
Data is used to review incoming messages, prepare responses and communicate with people interested in the company’s services.
Legal basis: Article 6(1)(f) GDPR, our legitimate interest in managing correspondence and professional relationships, or Article 6(1)(b) GDPR where processing is necessary to take pre-contractual steps at the data subject’s request.
Establishing and managing contractual relationships
If an enquiry leads to an engagement, the necessary data may be used to prepare, conclude and perform contractual arrangements.
Legal basis: Article 6(1)(b) GDPR for contracts to which the data subject is a party, or Article 6(1)(f) GDPR for managing professional relationships with representatives and contact persons of contractual partners.
Website operation and security
Technical data may be used to operate the website, prevent unauthorised access, identify incidents and protect IT infrastructure.
Legal basis: Article 6(1)(f) GDPR, our legitimate interest in the security and operation of IT services.
Preventing misuse of the contact form
To protect the form against automated messages and misuse, technical data associated with enquiries may be processed temporarily, including identifiers derived from IP addresses and submission timestamps.
This data is used to identify and limit repeated or unjustified requests and is not used for advertising or commercial profiling.
Legal basis: Article 6(1)(f) GDPR, the controller’s legitimate interest in preventing misuse of the form and ensuring the security and proper operation of the website.
Compliance with legal obligations
Where legislation requires information to be retained or disclosed, processing is carried out to meet the obligations applicable to the controller.
Legal basis: Article 6(1)(c) GDPR.
Establishing, exercising or defending legal claims
In justified circumstances, certain data may be retained and used to resolve disputes or protect the company’s rights and legitimate interests.
Legal basis: Article 6(1)(f) GDPR.
Where optional technologies requiring consent are used, the associated personal data will, where applicable, be processed on the basis of Article 6(1)(a) GDPR.
5. Providing personal data
Providing data through the contact form is voluntary.
Certain information, such as your name, email address and message, may be necessary to submit and handle an enquiry. Omitting it may prevent you from submitting the enquiry or us from responding.
Other fields are optional unless expressly stated otherwise.
We only request information necessary for the purpose of the communication.
6. Recipients of personal data
Access to personal data is limited to people and entities with a legitimate reason to process it.
Depending on the specific need, data may be accessible to:
Staff or collaborators authorised to handle enquiries;
Web hosting, maintenance, email and IT security providers;
Professional service providers, to the extent their involvement is necessary and justified;
Public authorities or institutions where disclosure is required by law.
Where providers act as processors, processing takes place under Article 28 GDPR, subject to appropriate contractual obligations.
Data is not disclosed to third parties without a legal basis and is not used for purposes incompatible with those for which it was collected.
7. International data transfers
HUSH-HUSH CONSULTING & BEYOND does not directly transfer personal data outside the European Economic Area in the course of the activities described in this policy.
Third-party services are used to operate the website and manage communications. To the extent these involve international data transfers, the requirements of Chapter V GDPR apply, including the appropriate legal mechanisms and safeguards.
8. Data retention periods
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, subject to applicable legal obligations.
Retention periods depend on the nature of the data and the purpose of processing, as follows:
Contact enquiries and correspondence that do not lead to an engagement: up to 12 months from the last communication, to handle enquiries and any subsequent clarifications.
Data associated with contractual relationships: for the duration of the engagement and, as a rule, for 3 years after it ends, to the extent necessary to protect the company’s rights and legitimate interests, subject to applicable statutory periods.
Financial and accounting documents: 5 years, calculated from 1 July of the year following the end of the financial year in which they were drawn up, in accordance with Article 25 of Romanian Accounting Law No. 82/1991, unless legislation requires different periods.
Technical data, security logs and information used to prevent automated messages: up to 90 days from recording, or for a shorter period once the purpose of processing has been fulfilled. Retention may be extended in justified circumstances, such as investigating security incidents or meeting legal obligations.
Where litigation, an investigation or a legal obligation justifies longer retention, data may be kept until the reasons for the extension no longer apply, within the limits established by law.
At the end of the applicable periods, data is deleted or anonymised, except where a separate legal basis exists for further retention.
9. Data security
Protecting information is a fundamental principle of HUSH-HUSH CONSULTING & BEYOND’s work.
We apply technical and organisational measures appropriate to the risks associated with processing, in accordance with Article 32 GDPR, to prevent unauthorised access, loss, destruction, alteration or unjustified disclosure of personal data.
Security measures are adapted to the nature of the information and the way it is processed.
No IT system can guarantee the complete elimination of every risk. Protective measures must therefore be assessed and updated as risks and technologies evolve.
10. Data subjects’ rights
Subject to the conditions set out in the GDPR, you have the following rights:
Right to information and access — you may request information about processing and, where applicable, a copy of your personal data.
Right to rectification — you may request the correction of inaccurate data or completion of incomplete data.
Right to erasure — you may request deletion of data in the circumstances set out in Article 17 GDPR.
Right to restriction of processing — you may request that processing be restricted under the conditions of Article 18 GDPR.
Right to data portability — you may receive your data in a structured format and transmit it to another controller where the legal conditions are met.
Right to object — you may object to processing based on legitimate interests under the conditions of Article 21 GDPR.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
You also benefit from the protection provided by Article 22 GDPR concerning decisions based solely on automated processing, including profiling, under the conditions established by the Regulation.
Exercising your rights
To exercise your rights, please send a request to:
office@hushhushconsulting.com
Requests are generally reviewed and answered within one month of receipt. In the cases provided for by the GDPR, this period may be extended by up to two further months; the data subject will be informed of the extension and the reasons for it.
Where we have reasonable doubts about the applicant’s identity, we may request additional information strictly necessary to confirm it.
Exercising your rights is generally free of charge, subject to the exceptions expressly provided for by law.
11. Right to lodge a complaint
If you believe your personal data is being processed in breach of applicable legislation, you have the right to lodge a complaint with:
The Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Address: 28–30 General Gheorghe Magheru Boulevard, Sector 1, Bucharest
Website: www.dataprotection.ro
You also have the right to bring proceedings before the competent courts, in accordance with the law.
We encourage you to contact us to clarify any matter relating to the processing of personal data. This does not limit your right to contact the supervisory authority.
12. Cookies and similar technologies
The website may use cookies and similar technologies for its proper operation and security and, if implemented, for other purposes communicated to users.
Strictly necessary cookies may be used under applicable legislation. Non-essential cookies and technologies requiring user agreement will only be used after prior consent has been obtained.
Information about cookie categories, purposes, providers, durations and management options is provided in the separate Cookie Policy on this website.
13. Policy updates
This Privacy Policy may be updated to reflect legislative developments, changes in processing activities or changes to website functionality.
The updated version will be published on this page together with the date of the latest amendment.
In the event of significant changes, data subjects will receive additional information where required by applicable legislation.