Privacy policy.

1. Who we are

Controller

CSTUDIO RO FILM PRODUCTION SRL operates the website redstudio.ro (RED Studio), a film studio in Bucharest.

DPO contact and correspondence

Email: [email protected]
Phone: +40 770 979 442

Address

Strada Progresului 25, Cotroceni, Sector 5, Bucharest, Romania (RED Studio).

2. What data we collect

• Contact data (name, email, phone), provided through the contact form.
• Production data (production type, dates, technical or creative details), provided through the quote form or by email.
• Technical data (IP address, browser type, pages visited, aggregated events), if Google Analytics or similar tools are implemented.

We do not intentionally collect special categories of data (health, ethnic origin, religious beliefs, etc.). Please do not send us such information unless it is strictly necessary and you have a legal basis.

3. Why we collect the data (legal basis)

Performance of a contract or pre-contractual measures

Art. 6(1)(b) GDPR: to respond to quote requests, prepare bookings and conclude or perform studio rental contracts.

Legitimate interest

Art. 6(1)(f) GDPR: for site traffic analysis, network security, improving services and user experience, to the extent your rights do not override.

Consent

Art. 6(1)(a) GDPR: for marketing communications or non-essential cookies, only when you have expressly accepted through clear mechanisms on the site.

4. How we use the data

• We respond to quote requests and questions sent through the site or email.
• We manage bookings, invoicing and the contractual relationship with clients.
• We improve the site structure and informational content, based on aggregated and anonymized use where possible.
• We do not sell your data to third parties.
• We do not use the data for behavioral advertising without explicit consent.

5. How long we keep the data

Contact data and correspondence for quotes

Up to 3 years from the last interaction, unless a contract requires otherwise.

Contractual and billing data

In line with accounting and tax legal obligations in Romania, up to 10 years where the law requires it.

Technical data (analytics)

The typical duration in Google Analytics 4 is up to 26 months, per account settings; it can be reduced by configuration.

6. Who we share the data with

• IT providers (web hosting, email services, sometimes payment processors): only to the extent necessary to provide the service, under confidentiality obligations.
• Public authorities: only on a legal request or to defend our rights within the limits of the law.

We do not share data with third parties for commercial purposes independent of providing RED Studio services.

7. Your rights (GDPR, Art. 15-22)

• Right of access: you may request a copy of the data processed and information about the processing.
• Right to rectification: you may ask for inaccurate data to be corrected.
• Right to erasure ("right to be forgotten"), under the conditions of the law.
• Right to restriction of processing, when the legal conditions are met.
• Right to data portability for data you provided, in a structured format, where applicable.
• Right to object, including to processing based on legitimate interest, under the conditions of the GDPR.
• Right not to be subject to decisions based solely on automated processing, including profiling, with the legal exceptions.

You may lodge a complaint with ANSPDCP: www.dataprotection.ro.

To exercise your rights: [email protected] (use the subject "GDPR rights").

8. Cookies

Necessary technical cookies

They ensure basic site operation (for example session, security). They do not require consent under current practice for strictly necessary cookies.

Analytics cookies

If we use Google Analytics or an equivalent, these require consent before loading, through a banner or dedicated settings on the site.

Marketing cookies

We do not use third-party marketing cookies on this site, unless such a tool is explicitly added and communicated separately.

You can manage or delete cookies in your browser settings.

9. Data security

We apply reasonable technical and organizational measures: HTTPS connection, restricted access to systems that contain data, passwords and internal policies for staff, backups per provider practice.

No method of transmission over the internet is 100% secure; we work to reduce risks and to respond in line with the law if an incident occurs.

10. Changes to the policy

Any substantial change will be published on this page, with an update to the "Last updated" date in the header. Continued use of the site after publication may constitute acceptance of the changes where the law allows; for processing based on consent, we will ask for your agreement when required.

11. Contact

For any question about your data or this policy: [email protected].