Last reviewed: 26 October 2026 · NITU M ADRIAN PFA
Who is responsible
Cinematic Web Design is operated by NITU M ADRIAN PFA, tax identification number (CUI) 51772633, trade register F2025016373009, registered office at Viforata 15, Buzău, Romania. The operator is the controller for personal information processed for website operation and business correspondence.
Contact [email protected] for privacy questions or requests. You can also reach us at +40 735 610 202 or the registered office above.
The website enquiry tool
The form uses your name, optional company, reply email and existing website, the selected service and industry, and your project description to prepare a draft locally in your browser. It does not submit those fields to a website server, create a customer account or write the draft to localStorage or sessionStorage.
The draft remains in the current page while you use it. A downloaded text file remains on your device until you manage or delete it. Your browser may separately offer autofill under its own settings. Please do not include passwords, payment-card details, identity documents, health information or other sensitive material.
When you choose a contact channel
Opening an email draft passes the prepared recipient, subject and message to your chosen email application. Opening WhatsApp passes the prepared message to WhatsApp. You decide whether to send it in that application. Direct email, telephone and WhatsApp links are also available.
The website does not embed these communication services. Their providers handle information under their own privacy terms when you choose to use them. Do not use a channel for information you are not comfortable sharing with its provider.
Correspondence and the purposes of processing
If you send an enquiry or contact us, the operator receives the information you choose to share, such as your identity, contact details, business information, project requirements and correspondence. We use it to reply, assess the request, prepare a proposal and, for accepted work, administer the project.
The applicable basis is steps requested before entering a contract or performing a contract, where relevant (GDPR Article 6(1)(b)); our legitimate interest in handling business communications, maintaining records and protecting legal claims (Article 6(1)(f)); and compliance with legal obligations for records such as accounting documents (Article 6(1)(c)). An enquiry does not subscribe you to a marketing list.
Recipients, external providers and international processing
Information is handled by the operator and, where needed, the communication, technical, accounting or professional service providers involved in the enquiry or project. It may also be disclosed when required by law or necessary to establish or defend a legal claim. It is not sold as a contact list.
Email and messaging providers can operate internationally. Their privacy notices explain their own processing and transfer arrangements. Where the operator arranges a transfer that requires safeguards, the applicable legal requirements must be met. Contact us before sending sensitive material if you need information about a particular recipient or project arrangement.
How long information is kept
A draft prepared only in the current page has no server-side retention. A downloaded copy is under your control. Correspondence received by the operator is kept while needed to deal with the enquiry, the project and necessary follow-up.
Project, contract, invoice and related records may need to be retained for applicable legal obligations or the establishment and defence of claims. The appropriate period depends on the record and circumstances. Contact us for information about a particular record or to request deletion where applicable.
Website delivery, cookies and measurement
The website is delivered through Cloudflare’s network to a Nginx web server operated for this business. Fonts, images and application scripts are served with the website. Optional Google Analytics loads only after Analytics consent on this domain. Advertising, media embeds, maps, chat and checkout are not activated. The application stores the privacy preference described in the cookie policy.
Delivering and protecting the website involves technical information such as IP addresses, requested resources, timestamps, response status and browser headers. Cloudflare processes requests under its delivery and security arrangements, and the web server can record technical access and error logs for operation, diagnostics and security. These records are used as needed for those purposes and are subject to the provider and operational retention arrangements. Contact the operator for information about a particular record. The cookie policy distinguishes application storage from provider security features.
Your rights and how to contact us
Depending on the circumstances and legal basis, you may request access, correction, erasure, restriction or portability of personal data, object to processing, and withdraw consent where consent is the basis. These rights have conditions. Send requests to [email protected]; we may need proportionate information to confirm your identity.
We respond without undue delay and normally within one month. If a permitted extension is necessary, we explain it within that first month. You may complain to a competent supervisory authority, including Romania’s ANSPDCP. No solely automated decision with legal or similarly significant effects is made through this website.
Optional Google Analytics
If you accept Analytics, Google Analytics 4 measures page visits and a limited set of interactions: email, telephone and WhatsApp link clicks, locally prepared briefs and brief-download clicks. A prepared brief is not recorded as a delivered lead or a purchase. The application sends event names and fixed context, not the name, email, telephone number, website URL or message you enter in the form. Full query strings, fragments and referrer URLs are excluded from the application’s measurement.
The legal basis for this optional measurement is your consent (GDPR Article 6(1)(a)). We use strict prior-consent loading: no Google tag, Analytics cookie or Analytics request is sent by this integration before permission, including no cookieless pre-consent measurement. Advertising consent remains denied, and Google signals and advertising personalisation are disabled.
Google receives pseudonymous cookie identifiers, usage events and technical request information needed for its service. Google services may involve international processing; applicable provider terms and transfer safeguards are separate from your cookie choice. Ask the privacy contact for information about the operator’s arrangements.
The current property settings observed on 26 October 2026 retain event-level data for 2 months and user-level data for 14 months, with reset on new user activity enabled. These controls do not apply to most standard aggregated reports. Browser Analytics cookies are separately configured for up to 180 days. Withdrawal prevents future measurement through this integration; exercising a data-deletion right is a separate request.
Data categories, sources and choices
We receive contact and business details directly from you when you choose to send an enquiry. Technical request data comes from your browser when it requests pages. We do not obtain advertising audience data, buy lead lists through this website, or use its enquiry tool for profiling.
| Information | Why it is used | Who receives it / retention criteria |
|---|---|---|
| IP address, browser headers, requested resources, time and response status | Delivery, troubleshooting and security; legitimate interests in maintaining a safe, functioning website | The hosting operator and Cloudflare. Technical records are subject to operational rotation and provider retention; security incidents may require records for investigation or claims. |
| Name, email, company and project correspondence you send | Replying, assessing a project, pre-contract steps and project administration | The operator and necessary communication or professional providers. Retained until the enquiry or project and relevant legal obligations or claims no longer require it. |
| cwd_privacy_v1 preference | Remembering the privacy setting you request | Your browser only; 180 days or until reset/cleared. It contains a version, your Analytics choice and dates, not your enquiry. |
California and other U.S. privacy choices
We do not sell personal information, share it for cross-context behavioural advertising, or run targeted advertising through this website. Advertising stays off. Optional Analytics is subject to a separate choice; this website also keeps Analytics off when Global Privacy Control (GPC) or Do Not Track is detected. GPC is not overridden by Accept all or a saved record. Do Not Track is also recognised by the settings panel.
U.S. privacy laws apply according to residency, the business and the processing involved. Where applicable, you may have rights to know or access, obtain a portable copy, correct or delete information, opt out of sale, sharing, targeted advertising or certain profiling, and receive equal treatment when exercising your rights. We do not use sensitive information for advertising or make automated decisions with legal or similarly significant effects through this website.
Send a privacy request to [email protected], call +40 735 610 202, or write to the registered office. Tell us the right you wish to exercise and enough context to locate your correspondence. An authorised agent may contact us; we may request proportionate evidence of authority and identity where permitted. Please do not send identity documents unless we request an appropriate secure method. Cookie settings are available without registration or identity verification.
Where California response rules apply, we acknowledge access, correction or deletion requests within 10 business days and respond within 45 calendar days; a permitted additional 45 days requires notice and an explanation. Applicable sale/sharing opt-outs are actioned as soon as feasible and within 15 business days. Other jurisdictions may set different deadlines. If a request is refused, we explain why and how you can seek review; email the privacy contact with “Privacy appeal”. This does not limit a complaint to your state Attorney General or privacy authority.
EEA, UK and other international visitors
The operator is established in Romania. GDPR rights apply where its processing falls within the GDPR; UK GDPR and other national laws may apply depending on the circumstances. You do not have to agree to optional tracking or marketing to ask about a project. Providing enquiry information is voluntary, though we need enough information and a usable contact channel to respond.
For GDPR requests, the usual response period is one month, with up to two further months where legally permitted for complexity or the number of requests; we explain any extension within the initial month. You may object to legitimate-interest processing, and object to direct marketing at any time. Consent, if separately requested for a future purpose, may be withdrawn without affecting the lawfulness of earlier processing.
You may complain to ANSPDCP, your EEA supervisory authority or the UK Information Commissioner where relevant. We do not require you to contact us before approaching a regulator. Local mandatory rights continue to apply even if a proposal is written in English.
Children and sensitive information
The services are intended for business website projects and are not directed to children. We do not knowingly seek personal information from children under 16 through the enquiry tool, including children under 13 in the United States. If you believe a child has sent information, contact us so we can assess the request and remove information where appropriate. This statement does not rely on a child accepting terms or cookies.
Updates and sensitive information
These notices are reviewed when the website or its data practices change. The review date is shown on this page. The services are intended for business website projects and are not directed at children. Discuss any project involving sensitive personal data separately before sharing it.