Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how Creatif Agency collects, uses and protects personal data when you visit creatif.agency or contact us. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Romanian legislation.

For any question regarding your personal data, contact us at [email protected].

1. Data we collect

  • Data you provide to us: when you request a quote or send us a message, we collect your name, email address, phone number, company name and the project details you choose to share.
  • Technical data: when you visit the website, our infrastructure automatically processes your IP address, browser type, device information and the pages requested. This is necessary to deliver the website securely.
  • Analytics data: only if you consent, we collect information about how you use the website, such as pages visited, time spent, approximate location (country/city) and traffic source.

2. Why we process your data and on what legal basis

  • Responding to enquiries and preparing offers: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR).
  • Performing a contract with you or your company: Art. 6(1)(b) GDPR.
  • Website operation, security and fraud prevention: our legitimate interest in providing a secure and functional website (Art. 6(1)(f) GDPR).
  • Website analytics: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
  • Legal obligations, such as accounting and tax requirements: Art. 6(1)(c) GDPR.

We do not sell personal data and we do not use it for advertising or automated decision-making.

3. Cookies

We use a limited number of cookies. Necessary cookies are always active because the website cannot function properly without them. Analytics cookies are only set after you accept them in the cookie panel. You can change your choice at any time through the Cookie settings link in the website footer.

Necessary cookies

  • creatif_consent (Creatif Agency): stores your cookie preferences. Duration: 180 days.
  • zaraz-consent (Cloudflare): stores your consent choice for the tools loaded through Cloudflare Zaraz. Duration: persistent.
  • cf_zaraz_client (Cloudflare): technical cookie used by Cloudflare Zaraz to operate. It contains no identifier. Duration: persistent.
  • Cloudflare security cookies (for example __cf_bm): set when needed to protect the website against bots and abuse. Duration: up to 30 minutes.

Analytics cookies (consent required)

  • cfz_google-analytics, cfzs_google-analytics (Google Analytics 4 via Cloudflare Zaraz): used to distinguish visitors and sessions and to measure how the website is used. Duration: persistent and session.
  • cfz_zaraz-analytics (Cloudflare Zaraz): stores an analytics client identifier. Duration: persistent.

4. Third-party services

Google Analytics 4 (Google Ireland Limited / Google LLC). With your consent, we use Google Analytics to understand how visitors use our website. Google Analytics is loaded server-side through Cloudflare Zaraz and runs only after you accept analytics cookies. Analytics data is retained for 14 months. More information: policies.google.com/privacy

Cloudflare (Cloudflare, Inc.). Cloudflare provides content delivery, security and performance services for our website, and the Zaraz tag management platform through which analytics is loaded. Cloudflare processes technical data such as IP addresses to deliver and protect the website. More information: cloudflare.com/privacypolicy

Adobe Fonts (Adobe Systems Software Ireland Limited / Adobe Inc.). We use Adobe Fonts to display the typography of our website. Adobe Fonts does not set cookies and does not use the data for advertising or profiling. To deliver the fonts and calculate licensing, Adobe processes your IP address and information about the fonts and pages requested. More information: adobe.com/privacy/policies/adobe-fonts.html

Google reCAPTCHA (Google Ireland Limited / Google LLC). Our contact and quote forms are protected by reCAPTCHA to prevent spam and abuse, based on our legitimate interest in website security. reCAPTCHA processes hardware and software information, such as device and browser data, and may set cookies on Google domains. More information: policies.google.com/privacy and policies.google.com/terms

Cloudflare Turnstile (Cloudflare, Inc.). Our contact and quote forms are protected by Cloudflare Turnstile to prevent spam and abuse, based on our legitimate interest in website security. Turnstile verifies that a visitor is human by processing technical information such as IP address, browser and device characteristics. It does not use the data for advertising or to track visitors across websites. More information: cloudflare.com/privacypolicy

Hosting. Our website is built on WordPress and hosted by [HOSTING PROVIDER], which processes technical data as part of operating the server.

5. International data transfers

Some of the providers above are based in, or may transfer data to, the United States. Where this happens, transfers are covered by the EU-U.S. Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.

6. How long we keep your data

  • Enquiries and quote requests: up to 3 years from our last communication, unless a contract is concluded.
  • Contract and invoicing data: for the periods required by Romanian accounting and tax legislation.
  • Analytics data: 14 months.
  • Cookies: for the durations listed in section 4.

7. Who has access to your data

Your data is accessed only by the Creatif Agency team and by the service providers listed above, strictly for the purposes described in this policy. We may disclose data to public authorities only where required by law.

8. Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you;
  • request the correction of inaccurate data;
  • request the deletion of your data;
  • restrict or object to processing;
  • receive your data in a portable format;
  • withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, contact us at [email protected]. We will respond within one month.

You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania – www.dataprotection.ro

9. Data security

We apply appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access restrictions and regular updates of our website software. No method of transmission over the internet is completely secure, but we work to protect your data against unauthorised access, loss or misuse.

10. Changes to this policy

We may update this Privacy Policy when our services or legal requirements change. The current version is always available on this page, with the date of the last update shown at the top.