DRAFT / NOT THE FINAL VERSION
This template must be reviewed by a lawyer before publication.
Guidance only, not legal advice. Information marked “TO BE COMPLETED” must be confirmed and adapted to DPScaling’s actual processing activities. This template does not guarantee GDPR compliance.
PERSONAL DATA / GDPR
This draft describes how data submitted through the contact and free audit request form is processed. The final version must reflect how the website actually operates.
01 / Who is the data controller
TO BE COMPLETED before publication: the legal name of the controller using the DPScaling brand, its legal form, registered office and relevant identification details. Contact for questions about personal data: damianpatrascu3@gmail.com. This contact does not constitute the appointment of a data protection officer.
02 / What data we collect through the form
The form asks for your name, phone number, business type and a message. Name, phone number and business type are required in the current form; the message is optional. Your message may contain other data you choose to share. Do not send sensitive data or other people’s data without a lawful basis. If you contact us by email, we also receive your email address and the content of the correspondence.
03 / Why we use the data and on what lawful basis
The data is used to respond to your enquiry, discuss your business and prepare the free audit you requested. Depending on the context, the lawful basis may be taking steps at your request before entering into a contract — Article 6(1)(b) GDPR — or the legitimate interest in managing business correspondence — Article 6(1)(f), following an assessment of that interest. Any legal obligations are based on Article 6(1)(c). TO BE CONFIRMED with a lawyer: the applicable lawful basis for each purpose. Submitting the form does not constitute consent to marketing.
04 / How long we keep the data
TO BE COMPLETED: the specific retention period or criteria for enquiries that do not lead to a contract, correspondence, backups and any contractual documents. As a principle, data is kept only as long as necessary to handle the enquiry and fulfil documented purposes, then deleted or anonymized, except for information that must be retained by law or to defend legal rights. No numerical retention period is set in this draft.
05 / Who may have access to the data
The form is built in Framer, and notifications are configured to go to damianpatrascu3@gmail.com. Providers involved in hosting, form handling and email may process data within the scope of their services. TO BE VERIFIED: the list of providers and subprocessors, their roles, processing agreements, data locations and authorized access. Do not assume that data remains exclusively within the European Economic Area; any transfers and safeguards under Chapter V GDPR must be documented in the final version.
06 / Your rights under GDPR
Subject to the conditions set out in GDPR, you may request access to your data, correction of inaccurate data, erasure or restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interests, subject to the law. If processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. These rights are not absolute; their applicability depends on the lawful basis and circumstances.
07 / How to exercise your rights
Send your request to damianpatrascu3@gmail.com, stating which right you wish to exercise. Proportionate information may be needed to verify your identity and protect your data. In principle, a response will be provided within one month; in the cases allowed by GDPR, this period may be extended by a further two months, with notice given during the first month. Requests are generally free of charge, subject to the exceptions provided by law.
08 / Your right to lodge a complaint
If you believe that the processing infringes GDPR, you may lodge a complaint with ANSPDCP or the competent supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement. This right does not exclude other administrative or judicial remedies.
09 / Security, cookies and other processing
The final version must describe the appropriate technical and organizational measures that are actually in place. TO BE VERIFIED separately: cookies, analytics tools, any technical logs, marketing, profiling and automated decision-making. This draft does not confirm whether these exist or not and does not replace a privacy notice and consent mechanism where required.
10 / Policy updates
TO BE COMPLETED before publication: the version date and the procedure for notifying users of relevant changes. The policy must be reviewed when the form, purposes, providers or methods of data processing change.
Questions about your data?