--- title: "Privacy notice | B&C Associates" description: "What personal data this site collects, on what legal basis, who else sees it, how long it is kept, and how to exercise your rights under the GDPR." language: "en" canonical: "https://bcass.net/legal/privacy" --- # Privacy notice Last updated 16 September 2026 ## Who is responsible B&C ASSOCIATES S.R.L. is the controller of the personal data described in this notice, within the meaning of Article 4(7) of Regulation (EU) 2016/679, the General Data Protection Regulation. Registered office: Str. Episcop Augustin Pacha nr. 10, SAD 8, Birou 9C, Sc. A, Et. 1, Timișoara, Timiș County, Romania. Trade register number J35/1925/2018. VAT identification number RO39456410. Telephone +40 256 206 541. Email admin@bcass.net. We do not meet any of the conditions in Article 37(1) that make a data protection officer compulsory, and we have not appointed one voluntarily. The address above reaches the people who decide how this data is used. ## What this notice covers This notice covers the website at bcass.net and the email conversations that start from it. Work we do for a client is governed by the data processing terms in the signed contract for that engagement, not by this notice. We collect personal data from you and from nobody else. There is no data broker, no enrichment service and no purchased list behind this site. ## The contact form When you send the contact form we receive your name, your email address, your company name if you give one, and the message you wrote. We use them to answer you and, if the conversation continues, to prepare a proposal. The legal basis is Article 6(1)(b) of the GDPR: steps taken at your request before entering into a contract. Providing this data is not a statutory or contractual requirement. You are free not to send the form. The only consequence is that we cannot reply, and you can write to admin@bcass.net instead. The message is delivered to our mailbox and is not stored in a database on this site. This site has no database. ## Spam protection on the form Before a submission reaches us it passes through Cloudflare Turnstile, which decides whether the request looks automated. To do that it processes the IP address, the browser characteristics and the interaction with the page. The legal basis is Article 6(1)(f), our legitimate interest in an inbox that is not filled by bots. We balanced that interest against your rights and considered it proportionate because the check runs once, assesses the request rather than the person, and produces no profile. If a check blocks you wrongly, email us directly and nothing is lost. ## Server logs Our hosting provider records the IP address, the page requested, the time, the response status and the browser user agent of every request, as any web server does. These records exist to keep the site available, to diagnose faults and to block attacks. The legal basis is Article 6(1)(f), our legitimate interest in a site that works and is not abused. We do not connect these records to the contact form or to any identified person. ## What we do not do This site sets no cookies. It runs no analytics beacon, no advertising tag, no session recording and no heatmap. There is no embedded map, no embedded video and no social media widget. Nothing on the page reports your visit to a third party for marketing purposes. We do not sell personal data. We do not share it with advertising networks. We do not use it to train any model, neither a model of our own nor a third party model. ## Who else processes it We use a small number of processors, each under a written data processing agreement that meets Article 28. They act only on our documented instructions. - Cloudflare, Inc. hosts and delivers this site, runs the spam check on the contact form, and relays form submissions to our mailbox. - Our email hosting provider stores and serves the mailbox that receives your message. We will name the current provider on request. - Our accountants and, where we take advice on a dispute, our lawyers, both bound by professional confidentiality. - A public authority, where a law we are subject to requires us to disclose. We will tell you if this happens unless the law forbids it. ## Transfers outside the European Economic Area Our processors run global networks, so a request may be handled outside the EEA, in practice most often in the United States. Where that happens the transfer relies on the standard contractual clauses adopted by the European Commission under Article 46(2)(c), together with the supplementary technical measures the processor applies. You can ask us for a copy of the clauses that cover a specific transfer by writing to admin@bcass.net. ## How long we keep it When a retention period ends the data is deleted. Where a backup still holds a copy, that copy is isolated from active use and is removed on the backup cycle of its own. - Enquiries that do not become projects: deleted 24 months after the last message. Long enough to pick a conversation back up, short enough not to be a hoarding exercise. - Enquiries that become projects: kept for the length of the engagement, then for the period Romanian accounting and commercial law requires, which is ten years for any document connected to an invoice. - Server logs: up to 30 days, then deleted or aggregated beyond recovery. - The Turnstile assessment: not retained by us at all. We receive a pass or a fail, not the evidence behind it. ## Your rights Under Articles 15 to 22 of the GDPR you may exercise the following rights over data we hold about you. - Access: ask whether we hold data about you and receive a copy of it. - Rectification: have data that is wrong corrected, and data that is incomplete completed. - Erasure: have data deleted where one of the grounds in Article 17 applies. - Restriction: have us hold data without using it while a dispute about it is resolved. - Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another controller. - Objection: object at any time to processing we base on legitimate interest, including the spam check and the server logs. - Withdrawal of consent: where we ever rely on consent, withdraw it at any time, without affecting the lawfulness of what happened before. ## How to exercise them Write to admin@bcass.net. We answer within one month of receiving the request, as Article 12(3) requires, and we will tell you if a complex request needs the two-month extension that article allows. There is no charge. We will not ask you to justify the request. We may ask for information that lets us confirm the request comes from you, and we will ask for no more than that. If you believe we have handled your data unlawfully you can complain to the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, website dataprotection.ro. You may instead complain to the supervisory authority of the EU country where you live or work, or where the alleged infringement took place. ## Automated decisions and profiling Nothing on this site takes a decision based solely on automated processing that produces legal effects for you or similarly significantly affects you, within the meaning of Article 22(1). The spam check assesses a request, not a person, and a blocked submission can always be sent to us by email instead. ## Security The site is served over HTTPS only, with a content security policy that blocks scripts we did not publish. Form submissions travel encrypted and are rate limited. Access to the mailbox is restricted to the people who answer it. No measure is perfect. If a breach ever puts your rights at risk we will notify the supervisory authority within 72 hours under Article 33 and tell you directly where Article 34 requires it. ## Children This site sells professional services to businesses. It is not directed at children and we do not knowingly collect data from anyone under 16, the age Romania sets under Article 8(1) of the GDPR through Law 190/2018. ## Changes to this notice If this notice changes materially, the date at the top changes with it. We keep the previous versions and will send you one on request.