Data protection notice
Privacy Policy
Last updated: 14 September 2026
Space ID Studio processes a minimal amount of personal data — essentially what you send us through a form or an email. This document explains what we collect, why, how long we keep it, and what rights you have over it.
01Who the controller is
The controller of personal data collected through this website is:
Space ID Studio is the trade name under which the company operating this website carries out its activity. The company's identification details — legal name, fiscal code and registered office — are filed with the Romanian Trade Register, are publicly accessible through the National Trade Register Office portal, and are provided to you on request at the email address above. You may ask for them at any time, including in order to exercise the rights set out in section 07 or to lodge a complaint with the supervisory authority.
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018, and Law no. 506/2004 on the processing of personal data in the electronic communications sector.
We have not appointed a Data Protection Officer, as our activity does not fall within the cases listed in Art. 37 GDPR. For anything concerning your data, write to us directly at the address above.
02What we collect
2.1. Data you give us directly
Through the “Project Enquiry” form on the Contact page:
- Name — so we know who we are speaking with;
- Email address — so we can reply;
- Project type (for example residential, commercial, corporate) — a short description you type, optional;
- Message — whatever information you choose to include in it.
A message sent through the form arrives directly in our email inbox. The site has no user accounts and does not save submissions to a database — it works exactly like an email you would send us yourself.
Please do not include sensitive data in your message (health information, political or religious beliefs, ID document details, banking details). We do not need any of it to reply to you.
The same categories apply when you email us directly or send us a direct message on Instagram or TikTok.
2.2. Data collected automatically
The site uses Vercel Web Analytics, a cookieless statistics service. For each page view, the following may be recorded:
- date and time of the visit;
- the page visited and the referring page;
- URL query parameters, filtered;
- approximate location (country, region, city);
- device type, operating system and browser, with their versions.
Visitors are not identified through cookies or persistent identifiers, but by a hash generated from the incoming request, which is automatically discarded after 24 hours. The resulting data is aggregated and does not allow us to identify you or to follow you across other websites. We do not store your IP address through this service.
2.3. Technical logs
The site is hosted by Vercel. Like any web server, the hosting infrastructure temporarily logs technical requests, including IP addresses, strictly for serving pages, security, and abuse prevention.
03Why we process it, and on what basis
| Purpose | Data categories | Legal basis (GDPR) |
|---|---|---|
| Responding to enquiries and discussing a possible project | Name, email, project type, message content | Art. 6(1)(b) — steps taken at your request prior to entering a contract |
| Performing the design contract and communicating throughout it | Contact details, correspondence, details about the space | Art. 6(1)(b) — performance of a contract |
| Aggregate traffic statistics, to understand which content is useful | Anonymous technical data (section 2.2) | Art. 6(1)(f) — legitimate interest in maintaining and improving the site |
| Site security and prevention of abuse or automated spam | Technical logs, IP address | Art. 6(1)(f) — legitimate interest in protecting our infrastructure |
Providing the form data is voluntary, but without a name and an email address we cannot reply to you. We do not use your contact details for newsletters or unsolicited commercial messages.
If our conversation leads to working together, we will then also process the data needed to issue accounting and financial records, under Art. 6(1)(c) — legal obligation. Publishing a completed project in our portfolio happens only with the client’s prior consent, which can be withdrawn at any time.
04Cookies
This site sets no analytics, advertising or tracking cookies, and therefore displays no consent banner. The statistics service we use works without cookies, and no persistent marketing identifiers are stored in your browser.
The hosting infrastructure may use strictly necessary, short-lived cookies for the operation and security of the site. These are exempt from the consent requirement under Art. 4(5)(b) of Law no. 506/2004.
If we introduce cookies that require consent in the future, we will implement a prior consent mechanism and update this section.
05Who else has access
We do not sell or rent personal data. We disclose it only to the following recipients, strictly within the purposes above:
- Vercel Inc. (USA) — website hosting and the analytics service, acting as our processor;
- Google Ireland Ltd. / Google LLC — the email service through which we receive and store messages sent via the form;
- professional collaborators (accounting, and where relevant architects or suppliers involved in a specific project), bound by contractual or legal confidentiality;
- public authorities, where we are legally required to provide information.
Instagram and TikTok are third-party platforms: if you contact us there, that message is also governed by their own privacy policies.
Transfers outside the EU/EEA
The providers listed above may process data on servers outside the European Economic Area, mainly in the United States. Such transfers take place on the basis of the Standard Contractual Clauses adopted by the European Commission and/or the EU–U.S. Data Privacy Framework, which provide an adequate level of protection.
06How long we keep it
| Category | Retention period |
|---|---|
| Enquiries that do not lead to a project | Up to 12 months from the last communication |
| Client correspondence and project documentation | For the duration of the contract and 3 years afterwards (general limitation period) |
| Accounting and financial records | 10 years, as required by Romanian accounting and tax law |
| Aggregate traffic statistics | Up to 12 months, in aggregated form |
| Temporary identifier in the analytics service | 24 hours |
Once these periods expire, the data is deleted or anonymised.
07Your rights
As a data subject, you have the following rights:
- Access (Art. 15) — to know what data we hold about you and receive a copy;
- Rectification (Art. 16) — to correct inaccurate or incomplete data;
- Erasure (Art. 17) — the “right to be forgotten”, where the data is no longer needed;
- Restriction of processing (Art. 18);
- Portability (Art. 20) — to receive your data in a structured, commonly used format;
- Objection (Art. 21) — to object to processing based on legitimate interest;
- Withdrawal of consent at any time, without affecting the lawfulness of processing carried out beforehand.
You can exercise any of these rights by emailing contact.spaceid@gmail.com. We reply within 30 days of receiving your request; this may be extended by two months for complex requests, in which case we will tell you. Exercising your rights is free of charge.
Right to lodge a complaint
If you believe we have infringed your rights, you may contact the supervisory authority:
You also have the right to seek a remedy before the competent courts.
08Data security
The site is served exclusively over an encrypted HTTPS connection. Access to incoming messages is limited to the people in the studio who need them in order to reply, and the accounts used are protected by two-factor authentication. We apply technical and organisational measures appropriate to the risk, but no transmission of data over the internet can be guaranteed to be absolutely secure.
09Automated decisions and minors
We do not take decisions based solely on automated processing and we do not carry out profiling within the meaning of Art. 22 GDPR.
This site is addressed to an adult audience and does not knowingly collect data from people under 16. If we learn that we have received such data without the consent of the holder of parental responsibility, we delete it.
10External links
The site contains links to profiles on other platforms (Instagram, TikTok). We are not responsible for the content or the privacy practices of those sites; we recommend reviewing their own policies.
11Changes to this policy
We may update this policy when the way the site works or the legal framework changes. The version in force is always the one published at this address, and the date of the last update is shown at the top. For substantial changes, we will make an announcement visibly on the site.
12Contact
For any question about this policy or about your data, write to us at contact.spaceid@gmail.com. We reply on working days, between 10:00 and 18:00.