01
Controller and contact
AXIO STACK S.R.L., registered in Romania, is the controller for website enquiry data. CUI / VAT: RO55633573; Trade Register: J2026055778006. Registered office: Municipiul București, Sector 3, Str. Nerva Traian, Nr. 27–33, Birou 6, Sc. B, Et. 1. Use the contact form and select Privacy request, or write to the registered office, to ask about your information. No separate data protection officer is designated in this notice.
02
Information we collect
When you submit an enquiry, we collect your name, email address, company if provided, project type, description, optional budget and timeline, and the submission time and reference. Please do not include passwords, payment details or sensitive personal information. Hosting systems may process IP addresses, request metadata and security logs to deliver and protect the website.
03
Purposes and legal bases
We use project enquiries to understand requirements, respond and prepare a possible proposal. Where you request steps towards your own contract, the basis is Article 6(1)(b) GDPR. Business contact correspondence and requests made on behalf of a company are processed under Article 6(1)(f), our legitimate interest in responding to relevant communications. Security and abuse prevention also rely on this legitimate interest. Applicable record-keeping duties use Article 6(1)(c). We do not use enquiries for unsolicited marketing.
04
Required and optional information
Name, email, enquiry type and a description are needed to process a request. Company, budget and timeline are optional. Not providing required information means we cannot submit the form or meaningfully respond.
05
Recipients and processors
Enquiries are stored in the website’s Cloudflare D1 database. Cloudflare supplies hosting and storage infrastructure; the Sites platform supplies deployment and private-preview access. Authorised personnel and necessary service providers may process data only for the relevant purpose. When email notifications are configured, Resend processes the enquiry contents and email addresses to deliver the notification to our designated inbox and a receipt confirmation to the email address supplied by the enquirer. We do not sell personal data.
06
Storage periods
Our intended retention period for unsuccessful enquiries is up to 12 months after the last meaningful correspondence, unless longer retention is needed for a legal obligation or the defence of a claim. If an enquiry becomes a project, the contract and applicable statutory requirements govern project records. Preference storage remains on your device until you clear it or change your choice. Retention is reviewed periodically and unnecessary enquiry records are deleted.
07
International transfers
Hosting and support infrastructure can involve processing outside the European Economic Area. Where this occurs, the relevant provider must use a lawful transfer mechanism, such as an applicable adequacy decision or standard contractual clauses with supplementary measures where necessary. You can request information about applicable safeguards through the contact form or registered office.
08
Security
We use encrypted transport, server-side validation, restricted infrastructure access and server-side storage. Access is limited to people and systems that need it. No online service can guarantee absolute security. Do not send credentials or confidential source material through the public enquiry form.
09
Your rights
Subject to GDPR conditions, you may request access, correction, deletion, restriction, portability and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting prior lawful processing. Send a Privacy request through Contact or write to the registered office. We normally respond within one month; a lawful extension may apply to complex requests. We may request proportionate identity verification.
10
Complaints
You may complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) at dataprotection.ro, or to another competent supervisory authority. You do not need to contact us first to exercise that right.
11
Automated decisions and children
We do not make automated decisions producing legal or similarly significant effects through this website. The website is intended for business enquiries and is not directed at children.
12
Policy updates
Changes in processing or providers will be reflected here with a revised effective date. The cookie policy explains device-local preference storage.
Further information: European Commission guidance · ANSPDCP complaints procedure.