Privacy Policy

1. Who processes your data

Your personal data is processed by SymphoNote, as controller within the meaning of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (the “GDPR”).

For any matter concerning data protection you can reach us at:

• E-mail: contact@symphonote.ro
• Phone: +40 733 205 502

Processing is carried out in accordance with the GDPR, with Romanian Law no. 190/2018 implementing the GDPR, and with Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector.

2. What data we process

Data you give us directly. Through the contact form on the Site we collect:

• your name;
• your e-mail address;
• the event date (optional);
• the event type (optional);
• the content of your message.

If you contact us by e-mail, by phone or through WhatsApp, we process the identification and contact details you use, together with whatever information you choose to tell us about your event.

Data collected automatically. When you visit the Site, our analytics tools may collect your IP address (truncated or anonymised, as the case may be), the device and browser type, the operating system, the pages you visit, the duration of the visit, the source you arrived from, your approximate location at city or region level, and the identifiers associated with cookies. This data is collected only if you have given your consent for the relevant cookie categories.

Consent records. We keep a record of your cookie choices — the categories accepted or refused, the moment they were expressed, and the version of the policy — so that we can demonstrate compliance with our legal obligations.

We do not request and do not intentionally process special categories of data, such as data concerning health, ethnic origin, political opinions or religious beliefs. Please do not send us such information through the form.

3. Why we process your data, and on what basis

Where we rely on legitimate interest, we assess beforehand whether that interest is not overridden by your fundamental rights and freedoms. You may object to such processing at any time, as described below.

4. Do you have to give us your data?

Providing your name, e-mail address and message is necessary for us to be able to reply. Without that information we cannot process your Enquiry. The remaining fields of the form are optional.

Accepting measurement and marketing cookies is always optional. Refusing them does not affect your access to the Site in any way, nor the answer you receive from us.

5. Who else has access to your data

We do not sell or rent your data. We may disclose it only to the following categories of recipients, strictly within the purposes set out above:

• the web hosting provider — Vercel Inc., which hosts the Site and provides us with aggregate traffic statistics;
• the e-mail service provider, through which the message sent from the form reaches us and through which we reply to you;
• Google Ireland Limited — for Google Analytics and Google Ads, activated only with your consent;
• Microsoft Ireland Operations Limited — for Microsoft Clarity, activated only with your consent;
• the consent management platform provider (c15t) — for recording and evidencing your cookie choices;
• professional advisers — accounting or legal services, where necessary for performing the contract or defending a legal claim;
• public authorities, where we have a legal obligation to disclose the data.

Providers that process data on our behalf act as processors, under contracts imposing confidentiality and security obligations on them, in accordance with art. 28 of the GDPR.

6. Transfers outside the European Economic Area

Some of our providers belong to groups headquartered in the United States of America. Where data is transferred outside the European Economic Area, the transfer takes place on the basis of:

• the European Commission’s adequacy decision on the EU–U.S. Data Privacy Framework, for providers certified under it; and/or
• the standard contractual clauses adopted by the European Commission through Implementing Decision (EU) 2021/914, accompanied by supplementary technical and organisational measures.

You can request further information about the safeguards in place by writing to us at contact@symphonote.ro.

7. How long we keep your data

We keep data only for as long as necessary for the purpose it was collected for, according to the periods in the table above. Once those periods expire, the data is deleted or irreversibly anonymised.

If you withdraw your consent for processing based on consent, we stop that processing without undue delay, without this affecting the lawfulness of processing carried out before the withdrawal.

8. Your rights

As a data subject, the GDPR grants you the following rights:

• the right of access — to find out whether we process data about you and to receive a copy of it (art. 15);
• the right to rectification — to have inaccurate data corrected and incomplete data completed (art. 16);
• the right to erasure, also known as “the right to be forgotten”, in the cases provided by law (art. 17);
• the right to restriction of processing, where you contest the accuracy of the data or object to the processing (art. 18);
• the right to data portability — to receive your data in a structured, commonly used and machine-readable format (art. 20);
• the right to object — to object to processing based on legitimate interest, including profiling (art. 21);
• the right to withdraw your consent at any time, where processing is based on consent (art. 7(3));
• the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you (art. 22).

You can exercise these rights by sending a request to contact@symphonote.ro. We reply within one month of receiving the request; that period may be extended by up to two further months for complex requests, in which case we will inform you within the first month.

Exercising your rights is free of charge. We may charge a reasonable fee, or refuse to act on a request, only where it is manifestly unfounded or excessive. So that we can reply safely, we may ask you for additional information needed to confirm your identity.

9. Your right to lodge a complaint

If you consider that the processing of your data infringes data protection legislation, you have the right to lodge a complaint with the supervisory authority:

• the National Supervisory Authority for Personal Data Processing (ANSPDCP);
• B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, 010336 Bucharest, Romania;
• E-mail: anspdcp@dataprotection.ro;
• Web: dataprotection.ro.

You also have the right to bring proceedings before the competent courts. We would be glad, however, if you contacted us first, so that we can put things right directly.

10. Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure: encrypted transmission over HTTPS, restricting access to form data to the people who need it, accounts protected by passwords and two-step authentication, and choosing providers that offer adequate security guarantees.

No system is entirely invulnerable, however. Should a personal data breach occur that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, in accordance with art. 34 of the GDPR.

11. Children

The Site is not addressed to persons under 16, and we do not knowingly collect data from them. If you become aware that a minor has sent us personal data, please write to us at contact@symphonote.ro — we will delete that information.

12. Automated decisions and profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Analytics and advertising tools may build statistical profiles from browsing behaviour, solely on the basis of your consent and without identifying you by name. You can withdraw your consent at any time, as described in our Cookie Policy.

13. Changes to this policy

We may update this policy to reflect changes in our processing activities or in the applicable legislation. The version in force is the one published on this page, and the date of the last update is shown at the top of the document.

Substantial changes will be brought to your attention through a visible notice on the Site before they take effect.

14. Contact

For any question about the processing of your data, write to us at contact@symphonote.ro or call +40 733 205 502.

See also our Terms and Conditions and Cookie Policy.