Privacy Policy

This Privacy Policy explains how 187DEF SRL ("187DEF", "we", "us", "our") collects, uses, and protects personal data in connection with the website 187.ro and its subdomains (including blog.187.ro), and with our business communications.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and Romanian Law no. 190/2018 on implementing measures for the GDPR.

1. Who we are (Data Controller)

• Legal entity: 187DEF SRL
• Registered office: Bucharest, Romania
• Trade Registry no. (ONRC): J2026047519000
• Tax ID (CUI): 55343758
• Email: [email protected]

Change of controller. As of 30 July 2026, 187DEF SRL succeeded UNUOPTSAPTE SRL (Trade Registry no. J40/24630/2023, CUI RO49325390) as the controller of personal data processed in connection with the Site and our business communications. This is a change of legal vehicle only: the purposes, legal bases, and retention periods described in this policy are unchanged, and personal data collected before that date continues to be processed under this policy. You can exercise your rights, including in respect of data collected before that date, using the contact details above.

We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions can be sent to the email above.

2. What data we collect and why

2.1 When you contact us

If you reach out through a form, email, or any other channel, we collect the data you provide: name, organisation, professional role, email address, phone number (if given), and the contents of your message.

• Purpose: to respond to your enquiry and, where relevant, to discuss a potential business relationship.
• Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), or our legitimate interest in responding to business contacts (Art. 6(1)(f) GDPR).

2.2 When we contact you (business outreach)

We are a business-to-business company and we conduct outreach to organisations whose work is relevant to ours. For this, we may process professional contact data (name, role, organisation, professional email) obtained from you directly, from your organisation's website, or from public professional sources and registries.

• Purpose: to introduce our work and explore partnership, supply, or collaboration.
• Legal basis: our legitimate interest in business development and the legitimate interest of the recipient's organisation in receiving relevant professional proposals (Art. 6(1)(f) GDPR).
• Source (Art. 14 GDPR): where we did not obtain your data from you directly, we obtained it from publicly accessible professional sources or from your organisation.

You may object to this processing at any time (see Section 7). We will stop on request.

2.3 Server logs, CDN, and security

The Site sits behind Cloudflare, which acts as our CDN, WAF, and DDoS-protection layer. Cloudflare and our hosting infrastructure automatically record technical data when you visit the site: IP address, browser type, operating system, referring page, pages accessed, and timestamps. Cloudflare also sets strictly-necessary cookies (e.g. __cf_bm, cf_clearance) for bot management.

• Purpose: to operate the site reliably, diagnose faults, and protect against abuse, intrusion, scraping, and attack.
• Legal basis: our legitimate interest in the security and integrity of our systems (Art. 6(1)(f) GDPR).

2.4 Bot protection on the contact form

Our contact form is protected by Cloudflare Turnstile, a bot-detection challenge. It processes technical signals from your browser and stores a short-lived token so a submission can be verified as human. It does not profile you or track you across sites.

• Purpose: keep the contact form usable and free of automated abuse.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing our systems).

2.5 Analytics

We use Cloudflare Web Analytics: aggregate, cookieless traffic statistics (page views, referrers, country, device class). It does not set tracking cookies, does not use cross-site identifiers, does not build behavioural profiles, and is not shared with advertising networks. We track operations, not people.

See our separate Cookie Policy for what is set in your browser and on what basis. Any future non-essential cookies would only be set with your consent (Art. 6(1)(a) GDPR).

2.6 Legal and compliance records

Where we engage in a transaction or correspondence that touches regulated technology, we may retain records required by law, including for export-control and customer due-diligence purposes.

• Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR) and our legitimate interest in lawful trade (Art. 6(1)(f) GDPR).

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

3. Who we share data with

We do not sell personal data. We share it only with:

• Service providers (processors) acting on our instructions, such as our hosting provider, email provider, and Cloudflare, Inc. (CDN, WAF, DDoS protection, cookieless analytics). These are bound by data-processing agreements under Art. 28 GDPR.
• Professional advisers (legal, accounting) where necessary.
• Authorities, where we are legally required to disclose, including in connection with export-control and security obligations.

A current list of our key processors is available on request from [email protected].

4. International transfers

Some of our service providers may process data outside the European Economic Area. Where this happens, we rely on an adequacy decision of the European Commission or on appropriate safeguards under Art. 46 GDPR, principally the Standard Contractual Clauses. You can request a copy of the relevant safeguard from [email protected].

5. How long we keep data

• Enquiry / correspondence: for the duration of the exchange and up to 24 months after, unless a relationship continues.
• Business outreach contacts: until you object, or until the contact is no longer professionally relevant.
• Server logs: up to 12 months for security and diagnostics.
• Cookie data: as stated in the Cookie Policy.
• Legal / compliance records: for the period required by applicable law.

When a retention period ends, we delete or anonymise the data.

6. How we protect data

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), access controls, and infrastructure hardening. No method of transmission or storage is perfectly secure, but we work to maintain protection proportionate to the risk.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate data;
• request erasure ("right to be forgotten");
• request restriction of processing;
• data portability for data you provided, where processing is based on consent or contract;
• object to processing based on our legitimate interest, including business outreach;
• withdraw consent at any time where processing is based on consent, without affecting prior processing.

To exercise any of these, email [email protected]. We respond within one month, as required by Art. 12 GDPR.

You also have the right to lodge a complaint with the Romanian supervisory authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București
[email protected] · www.dataprotection.ro

8. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always the one published at this address, with the "Last updated" date above. Material changes will be noted clearly.

9. Contact

Questions about this policy or your data:
187DEF SRL · [email protected] · Bucharest, Romania