Privacy Policy

Last updated: March 2026

1. Data Controller

KOSTEIN
Operated by Andreea Petre
Website: kostein.net
Email: wework@kostein.net

KOSTEIN is a construction consultancy based in Romania. We are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Romanian data protection legislation.

2. What Data We Collect

We collect personal data only when you voluntarily provide it through the following channels:

Contact form: name, email address, and message content
WhatsApp chat: phone number, name, and message content exchanged through the WhatsApp widget on our site
Cookies: essential cookies for site preferences and functionality (see Section 6)

We do not collect data automatically through analytics or tracking tools. Should we introduce such tools in the future, this policy will be updated accordingly.

3. Purpose of Data Processing

We process your personal data for the following purposes:

Responding to your inquiries submitted through the contact form
Communicating with you via WhatsApp regarding our services
Storing your site preferences through cookies

4. Legal Basis for Processing

We process your data based on the following legal grounds under GDPR Article 6:

Consent (Art. 6(1)(a)): when you voluntarily submit your data through our contact form or initiate a WhatsApp conversation
Legitimate interest (Art. 6(1)(f)): to respond to your inquiries and provide our services

5. Data Sharing

Your personal data is not sold, rented, or shared with third parties for marketing purposes. Data may be shared only with:

WhatsApp (Meta Platforms): messages sent via WhatsApp are processed according to WhatsApp's own privacy policy
Hosting provider: our website hosting provider may process data as part of delivering the service
Legal obligations: if required by Romanian or EU law

6. Cookies

Our website uses only essential cookies to store your site preferences (such as language selection). We do not use analytics cookies, advertising cookies, or third-party tracking cookies.

If we introduce additional cookies in the future, we will update this policy and request your consent where required.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined above:

Contact form submissions: retained for up to 24 months after the last communication, then deleted
WhatsApp messages: retained according to WhatsApp's data retention policies and our own records for up to 24 months
Cookies: expire according to their type; preference cookies are retained for up to 12 months

8. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

Right of access (Art. 15): request a copy of the personal data we hold about you
Right to rectification (Art. 16): request correction of inaccurate or incomplete data
Right to erasure (Art. 17): request deletion of your personal data
Right to restriction (Art. 18): request limitation of processing under certain conditions
Right to data portability (Art. 20): request your data in a structured, machine-readable format
Right to object (Art. 21): object to data processing based on legitimate interest
Right to withdraw consent: withdraw your consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at wework@kostein.net. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted communications (HTTPS) and secure data storage.

10. User Accounts

Our website does not offer user account registration. No login credentials or account-related data are collected or stored.

11. International Data Transfers

Your data is primarily processed within the European Economic Area (EEA). If data is transferred outside the EEA (for example, through WhatsApp/Meta), such transfers are conducted in compliance with GDPR requirements, including appropriate safeguards such as Standard Contractual Clauses.

12. Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that data has been collected from a child, we will take steps to delete it promptly.

13. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Romanian supervisory authority:

ANSPDCP (Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal)
Website: www.dataprotection.ro

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last updated" date. We encourage you to review this page periodically.

15. Contact

For any questions or requests regarding this Privacy Policy or your personal data, contact us at:

Andreea Petre / KOSTEIN
Email: wework@kostein.net
Website: kostein.net