Privacy policy.

01Who we are

Really ("we") is a design and brand strategy studio, and the controller of the personal data described in this document. You can contact us through the brief form.

02What data we collect

We collect data in the following ways:

• -The contact details you give us when you send a brief: name, email address, phone number, project type, goal, audience, timeline, budget range, message and how you heard about us
• -Messages you send us by email or phone
• -Technical data collected automatically when you visit the website, such as your IP address, browser and device type and the pages viewed, through strictly necessary cookies only

03How we use the data

• -To reply to requests sent through the brief form
• -To deliver, manage and invoice our clients' projects
• -To keep the accounting and tax records required by law
• -To keep the website secure and working
• -To meet our legal obligations

04Legal basis for processing

We rely on the following bases under the GDPR, depending on the purpose:

• -Legitimate interest, to reply to your request and run our business, where this does not override your rights and interests
• -Contract, to perform it once we start working together, or to take steps at your request before a contract is made
• -Legal obligation, for accounting, tax and other requirements set by law
• -Consent, for the optional information you choose to give and for non-essential cookies, where required (see the Cookie policy)

05Who we share data with

We do not sell your personal data. We may share it with service providers who help us run our business, such as email hosting, cloud storage or accounting software, under contracts that require them to protect it. We may also share it with professional advisers, such as accountants or lawyers, where necessary, or with authorities where the law requires us to.

06International transfers

Some service providers may store or process data outside the European Economic Area, including in the United States. In these cases we rely on adequacy decisions or appropriate safeguards, such as the European Commission's Standard Contractual Clauses, so that your data receives equivalent protection.

07How long we keep data

If your enquiry does not lead to a project, we keep the brief and the correspondence for up to 24 months, so we can pick up earlier conversations, and then delete them. If you become a client, we keep the project records and the financial records for as long as the applicable accounting and tax rules require.

08Cookies

We use a small number of cookies and similar technologies, described in full in the Cookie policy.

09Your rights

Under the GDPR, you have the right:

1. 1.To be informed about how we use your personal data, as set out in this document
2. 2.To access a copy of the personal data we hold about you
3. 3.To ask for inaccurate or incomplete data to be corrected
4. 4.To ask for your personal data to be deleted, in certain situations
5. 5.To ask us to restrict how we use it
6. 6.To receive the data in a portable format or ask for it to be transferred to another organisation
7. 7.To object to processing based on our legitimate interests
8. 8.Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you; we do not currently do anything like this

10How to exercise your rights

For any of these rights, write to us through the brief form and mark the message "Personal data request". We reply within one month at most. We may need to verify your identity before we process the request.

11Complaints

If you are not happy with how we handle your data, we would prefer the chance to put it right, so please contact us first. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro, or with the supervisory authority in your country of residence.

12Data security

We use appropriate technical and organisational measures to protect data against unauthorised access, loss or misuse, including access controls and encrypted connections. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.

13Children's data

This website is aimed at businesses and individuals looking for design services. It is not aimed at children, and we do not knowingly collect personal data from anyone under 18.

14Changes to this document

We may update this document to reflect changes in our practices or in the law. The date at the top shows when it was last reviewed.

15Contact

Questions about this document or about how we handle your data: write to us through the brief form.