Privacy Policy

1. Data Controller and Contact Information

The data controller responsible for the processing of personal data through this website is:

CORE ADVISORY S.R.L. has not appointed a Data Protection Officer (DPO). For questions regarding the processing of your personal data or the exercise of your rights, please contact us at dumitruim@gmail.com.

2. Categories of Personal Data Processed

Depending on how you interact with us (via the contact form or direct communication), we may process the following categories of data:

• Data submitted via the contact form: Name, email address, and message content (brief description of your project or situation), which are required fields for handling communications. Optionally, you may provide your company/winery name and phone number.
• Data from subsequent correspondence: Information exchanged during follow-up emails, phone conversations, or preliminary consultations regarding your viticultural project.
• Technical security data: Only to the extent automatically collected by the server hosting infrastructure (such as IP addresses and request headers in server security logs for threat prevention).

Submitting data through the contact form or by email is not a statutory requirement. However, your name, email address, and message details are practically necessary for us to understand your enquiry and provide a response. Without these, we may be unable to process your request.

We advise you not to submit sensitive categories of personal data (such as health information or political beliefs) or unnecessary personal information regarding third parties.

3. Current Technical Status of the Contact Form

Data is processed on the hosting server and sent to the Gmail mailbox used to manage enquiries. Spam protection uses a honeypot, frequency limits and identifiers derived using a secret key; it does not store the message in a website database.

If you contact us directly by email at contact@coreadvisory.ro or at dumitruim@gmail.com, or by telephone at +40 732 710 103, the information you provide will be processed in accordance with this policy.

4. Purposes and Legal Bases for Processing

We process personal data solely for legitimate and transparent purposes, based on the following grounds set forth in the General Data Protection Regulation (GDPR - Regulation (EU) 2016/679):

• Pre-contractual steps at the request of the data subject (Art. 6(1)(b) GDPR): When an individual contacts us on their own behalf to request an assessment or advisory services prior to entering into a contract to which they would be a party.
• Legitimate interests (Art. 6(1)(f) GDPR): For communicating with representatives, employees, or contacts of corporate entities seeking advisory services; for managing general business correspondence; and for maintaining website security and preventing spam or abuse, subject to balancing tests with your fundamental rights.
• Legal obligations (Art. 6(1)(c) GDPR): When communications or contracted engagements give rise to mandatory legal records (such as tax and accounting documentation).

Consent is not used as a blanket legal basis. Submitting an enquiry does not constitute consent for marketing communications and will not add you to any mailing list. CORE Advisory does not engage in automated direct marketing campaigns.

5. Data Access and Recipients

Within CORE ADVISORY S.R.L., messages and project enquiries are managed internally by the designated team member, Mihai Dumitru-Paverman. Data is not accessible to unauthorized personnel.

From a technical perspective, data may transit through or be stored by essential communications infrastructure providers:

• Email service providers: Correspondence via the address dumitruim@gmail.com utilizes the infrastructure of the Gmail service provider. The specific entity processing data, server locations, and applicable safeguards will be identified prior to launch.
• Hosting and infrastructure providers: The selected provider is DataHost, for website hosting and the contact@coreadvisory.ro email service. Its infrastructure processes web requests and messages sent through the email service.

CORE ADVISORY S.R.L. does not sell, rent, or trade personal data to third parties for commercial or advertising purposes.

6. Processing Locations and International Transfers

We do not claim that all data remains exclusively within the European Union. The use of global communications services (such as Gmail) may involve transit or storage through data centers outside the EEA. The applicable transfer mechanisms and corresponding safeguards will be identified upon finalising production service contracts.

7. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered:

• Enquiries without contract: Messages and contact information from enquiries that do not result in a consulting agreement are retained for a maximum of 12 months following the last relevant interaction, after which they are deleted, unless an earlier deletion request is made and no overriding legitimate grounds exist.
• Contractual engagements: Data relating to a contractual relationship is retained for the period necessary to perform the contract and fulfil the applicable legal obligations. Retention periods vary according to the category of records and the purpose of processing.
• Technical infrastructure data: Retention periods for anti-spam counter data, server security logs, and technical backup copies will be confirmed upon production infrastructure configuration.

Immediate erasure from passive technical backup archives or third-party email system snapshots cannot be guaranteed, but data will no longer be actively processed.

8. Your Rights Under the GDPR

As a data subject, you hold the following statutory rights under Regulation (EU) 2016/679, subject to the conditions established by law:

• Right of access (Art. 15 GDPR): The right to obtain confirmation as to whether we process your personal data and to receive information about the processing.
• Right to rectification (Art. 16 GDPR): The right to request the correction of inaccurate data or the completion of incomplete information.
• Right to erasure (“right to be forgotten”, Art. 17 GDPR): The right to request the deletion of your data when it is no longer needed or when you object to processing on legitimate grounds.
• Right to restriction of processing (Art. 18 GDPR): The right to limit the processing of your data under specific statutory circumstances.
• Right to data portability (Art. 20 GDPR): The right to receive your personal data in a structured, commonly used, and machine-readable format, where processing is based on a contract and performed by automated means.
• Right to object (Art. 21 GDPR): The right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests.
• Right to withdraw consent: Where any specific processing relies on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP):
  Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania
  Website: www.dataprotection.ro
  Email: anspdcp@dataprotection.ro
• Right to judicial remedy: The right to seek effective judicial remedy before competent courts of law.

To exercise these rights, please send your written request to our dedicated email: dumitruim@gmail.com.

We will respond to your request within one month of receipt. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests, in which case we will notify you within the initial month.

9. Automated Decision-Making and Profiling

CORE ADVISORY S.R.L. does not make decisions based solely on automated processing and does not perform user profiling producing legal effects concerning you or similarly significantly affecting you.

Technical abuse-prevention measures (such as honeypot traps or request rate limiting) operate strictly as protective measures for the web infrastructure and do not constitute automated individual decision-making under Article 22 of the GDPR.

10. Policy Updates

This policy may be revised periodically as our advisory scope or web infrastructure changes. Updated versions will be posted on this page with an updated review date.