Privacy policy

This policy explains what personal data we process when you visit https://www.tailoredmedia.org (the “Website”), send us an enquiry through the Website forms or request our e-book or newsletter. It also applies when you contact us by email, telephone or messages on our social media accounts. The policy explains why we process the data, how long we retain it and what rights you have.

This policy is issued pursuant to Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (“GDPR”). It is also issued pursuant to Law No. 190/2018 on measures implementing the GDPR and Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

1. Who is the data controller

The data controller is TAILORED MEDIA S.R.L. (“Tailored Media”, “we”):

• Registered office: Bd. Iuliu Maniu No. 15H, Bucharest, Sector 6
• Trade Register registration number: J2023013268405
• Unique registration code (CUI): 48504401
• Email: teodora.toma@tailoredmedia.org

We have not appointed a data protection officer (DPO), as our activities do not fall within the situations in which the GDPR requires one (Article 37). For any questions about your data, you can write to us at teodora.toma@tailoredmedia.org.

Tailored Media works with clients in Bucharest and Madrid. All processing described in this policy is carried out by TAILORED MEDIA S.R.L., a company registered in Romania.

2. When this policy applies

2.1. This Policy applies to the processing of personal data carried out by us in connection with the use of the Website, the handling of enquiries received through the Website, by email, telephone or messages on our social media accounts, as well as in connection with requesting and providing our e-book and subscribing to and sending our newsletter.

2.2. The Policy does not apply to third-party platforms linked from the Website. They process data on their own behalf, in accordance with their own privacy policies:

• Instagram (Meta) and LinkedIn – our social media accounts;
• our clients’ websites and Instagram accounts, to which the logos, videos and case studies link.

We recommend that you read these platforms’ policies before using them.

This Policy does not govern processing carried out by third-party platforms for their own purposes. Processing carried out by us through our social media accounts is described in this Policy.

2.3. As part of the marketing services provided to our clients, including the management of social media accounts, advertising campaigns or email lists, we may process personal data as a processor. In this capacity, we act on behalf of the client and in accordance with their documented instructions, under a contract that complies with the requirements of Article 28 GDPR.

For this processing, the client is the controller, and the relevant information is provided through their privacy policy or other applicable notices. To exercise your rights, you may contact the respective client directly. If we receive such a request, we will forward it to the client without undue delay and provide the necessary assistance, in accordance with the law and our contract with them.

3. What personal data we process

3.1. Data you provide through forms

Mandatory fields are marked in each form.

Data submitted through the Website forms is processed and stored through the Webflow platform. To protect the forms against spam and abusive use, we use Cloudflare Turnstile, which processes technical data, such as your IP address and information about your browser and connection. Cloudflare also uses this data to improve its bot detection capabilities, acting as a controller for this purpose. Further information is available in the Cloudflare Turnstile Privacy Notice (https://www.cloudflare.com/turnstile-privacy-policy/).

3.2. Data you provide by email, telephone or social media messages

Your name, contact details and information you choose to share with us, including in messages sent to our social media accounts.

3.3. Automatically collected data

When you use the Website, we process the following categories of data:

• Technical data, such as your IP address, browser and device type, pages accessed, date and time of access, for the operation and security of the Website, including the prevention of spam and abuse.
• Cookie preferences, to remember and respect your choices.
• Website usage data, such as pages visited, duration of the visit, referral source and approximate location, to compile usage statistics, only if you have given your consent.

For information about cookies and managing your preferences, please see the Cookie Policy. Data recipients, any international transfers and retention periods are described in sections 6–8.

3.4. Data we do not request

We do not ask you for special categories of personal data, such as health data, or for your personal identification number or identity document details. Please do not include such information in forms or messages addressed to us.

If you send us such data without it being necessary to handle your enquiry, we will take steps to delete or remove it from the messages and records we retain. We will retain or use it only if there is an applicable legal basis and the special conditions laid down by law are met, where applicable.

3.5. Testimonials, case studies and portfolio

We publish testimonials, images and video materials to present our activities and projects, while respecting the right to one’s image and the rights to use the materials. Depending on the context, personal data processing is based on consent or on the legitimate interest in presenting our activities, where the legal conditions are met.

Data subjects may contact us at the address indicated in this Policy to exercise their rights, including to request the removal of data or materials concerning them, subject to the conditions laid down by law.

4. Why we process data and on what legal basis

Enquiries, offers and services. We process data to respond to enquiries, prepare offers and provide the agreed services. We rely on Article 6(1)(b) GDPR when you are a party or prospective party to the contract. For general questions and communication with company representatives, we rely on the legitimate interest in responding to enquiries and managing professional relationships (Article 6(1)(f) GDPR).

E-book and newsletter. We use the data necessary to provide the requested e-book, on the basis of Article 6(1)(b) GDPR. The newsletter is sent separately, only with your consent, pursuant to Article 6(1)(a) GDPR, Article 12 of Law No. 506/2004 and Article 6 of Law No. 365/2002, as well as the applicable provisions of Spanish Law No. 34/2002 for recipients in Spain. You can unsubscribe at any time; afterwards, we retain the minimum data necessary to respect your choice, on the basis of legitimate interest (Article 6(1)(f) GDPR).

Website operation, security and analytics. We process technical data on the basis of the legitimate interest in ensuring the operation and security of the Website (Article 6(1)(f) GDPR). Website usage is analysed only with your consent (Article 6(1)(a) GDPR). When storing or accessing information on your device, we comply with Article 4(5)–(6) of Law No. 506/2004, in accordance with the Cookie Policy.

Testimonials and portfolio. We use personal data to present our activities and projects, on the basis of consent or the legitimate interest in promoting our activities, as applicable, in compliance with the legal conditions and the right to one’s image.

Communication on social media. We process data from messages and interactions on the basis of the legitimate interest in responding to and communicating with the public (Article 6(1)(f) GDPR).

Legal obligations and defence of rights. We process data to comply with accounting, tax and other obligations imposed by law (Article 6(1)(c) GDPR). To handle complaints and establish, exercise or defend our rights, we rely on legitimate interest (Article 6(1)(f) GDPR).

The right to object and the withdrawal of consent are explained in section 10. We do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you.

5. Children’s data

Our Website and services are intended for companies and professionals and are not intended for children. We do not knowingly request personal data from children through the Website. If we identify such data submitted through forms or messages, we delete it, except where its retention is required by law.

6. To whom we disclose data

We disclose personal data only to the extent necessary for the purposes described in this policy, to the following categories of recipients:

Service providers. We use providers for Website hosting, security and maintenance, email communication, document storage, newsletter distribution and Website usage analytics. When they process data on our behalf, they do so in accordance with our instructions and under contracts that comply with Article 28 GDPR.

Team and collaborators. Persons involved in handling enquiries and providing services have access only to the data necessary for their duties and are subject to confidentiality obligations.

Advisers and authorities. We may disclose data to lawyers, accountants, auditors or other advisers, if necessary for our activities or the defence of our rights, as well as to public authorities and institutions, subject to the conditions laid down by law.

Independent or joint controllers. Some services we use and social media platforms also process certain data for their own purposes, in accordance with their privacy policies.

In the event of a reorganisation or transfer of the business, data may be disclosed to the entities involved, only on a legal basis, with appropriate safeguards and in compliance with information obligations.

Information on transfers of data outside the European Economic Area is provided in section 7.

7. Transfer of data outside the European Economic Area

The use of certain providers may involve transferring data outside the European Economic Area, including to the USA. These transfers are carried out on the basis of a European Commission adequacy decision or appropriate safeguards, pursuant to Articles 45–46 GDPR.

For recipients in the USA holding a valid certification that covers the transferred data, we rely on the EU–US Data Privacy Framework, in accordance with Decision (EU) 2023/1795. In the absence of an applicable adequacy decision, we use the standard contractual clauses approved by Decision (EU) 2021/914, accompanied, where necessary, by supplementary protective measures.

You may request information about transfers concerning you and a copy of the applicable safeguards by contacting us at the email address indicated in this Policy.

8. How long we retain data

At the end of the period, data is deleted or anonymised.

9. How we protect data

We implement technical and organisational measures appropriate to the risks of processing to protect data against unauthorised access or disclosure, loss, destruction or accidental or unlawful alteration. These include encrypted connections (HTTPS), limiting access to authorised persons who need the data to perform their duties, strong passwords and, where possible, two-step authentication. Persons who have access to data are subject to confidentiality obligations, and relationships with providers processing data on our behalf are governed in accordance with GDPR requirements.

10. Your rights

Under the GDPR, you have the following rights:

• the right of access (Article 15) – to find out whether we process your data and to receive a copy of it;
• the right to rectification (Article 16) – to have us correct or complete inaccurate or incomplete data;
• the right to erasure (Article 17) – to have us delete your data, subject to the conditions laid down by law;
• the right to restriction of processing (Article 18);
• the right to data portability (Article 20) – to receive the data you have provided to us in a structured, commonly used format, or to have us transmit it to another controller, where processing is based on consent or a contract and is carried out by automated means;
• the right to withdraw your consent (Article 7(3)), at any time, without affecting the lawfulness of processing carried out before withdrawal. For the newsletter, use the unsubscribe link in each email; for cookies, use the “Cookie settings” link in the page footer;
• the right not to be subject to a decision based solely on automated processing (Article 22).

The right to object (Article 21 GDPR). You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims. In the case of direct marketing, you may object at any time, free of charge and without giving reasons, and the data will no longer be processed for that purpose, including for profiling related to direct marketing.

The right to lodge a complaint. You may contact the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru No. 28-30, Sector 1, postcode 010336, Bucharest, Romania; tel. +40.318.059.211 / +40.318.059.212; fax +40.318.059.602; email: anspdcp@dataprotection.ro; www.dataprotection.ro.

11. How to exercise your rights

To exercise your rights, you may contact us at teodora.toma@tailoredmedia.org or by post at our registered office. We respond without undue delay, within no more than one month of receiving the request, with the possibility of an extension under the conditions laid down in the GDPR. Exercising your rights is, in principle, free of charge. If we have reasonable doubts about the identity of the person making the request, we may ask for the additional information necessary to confirm it.

12. Is it mandatory to provide us with your data?

You may choose whether to provide us with personal data. However, certain data is necessary to handle enquiries, send the e-book, enter into and perform contracts or comply with legal obligations.

Mandatory fields are indicated in the forms. Without the necessary data, we may be unable to handle your enquiry or provide the requested service. Providing optional data and subscribing to the newsletter are not mandatory.

13. Changes to the policy

We may update this Policy to reflect changes to our activities or legal requirements. The updated version is available on the Website, together with the date of the latest update. Where the law requires individual or advance notification, we will provide it by appropriate means. If the changes require your consent, we will request it before carrying out the relevant processing.

14. Contact

For any questions about your personal data:

• Email: teodora.toma@tailoredmedia.org
• By post: TAILORED MEDIA S.R.L., Bd. Iuliu Maniu No. 15H, Bucharest, Sector 6

15. Language versions

This policy is published in Romanian, English and Spanish. The English and Spanish versions are translations for information purposes. In the event of discrepancies, the Romanian version prevails.

See also: Terms and Conditions · Cookie Policy