Privacy Policy
Version 2.0 · Last updated: 24 April 2026
Applicable to the mitzuu.ro website and the services operated by MITZUU MEDIA S.R.L.
Controller
MITZUU MEDIA S.R.L.
CUI 42587777 · J2020005916403
Registered office
Str. Avrig 24, Bl. P19, Sc. A, Et. 1, Ap. 6, Sector 2, Bucharest
GDPR contact
contact@mitzuu.ro1. Introduction
The confidentiality of your personal data is a priority for MITZUU MEDIA S.R.L. ("Mitzuu Media", "we", "the controller"). This document explains, in a transparent manner, how we collect, use, store and protect your data when you visit the mitzuu.ro website or interact with our services.
This policy is drafted in accordance with:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data ("GDPR");
- Law no. 190/2018 on measures implementing the GDPR in Romania;
- Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector (regarding cookies);
- Guidelines published by the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) and the European Data Protection Board (EDPB).
By using the mitzuu.ro website you confirm that you have read, understood and agree to the provisions of this policy. If you do not agree, please do not use the site.
2. Data Controller
The controller of personal data collected through the mitzuu.ro website is:
Name: MITZUU MEDIA S.R.L.
Unique Registration Code (CUI): 42587777
Trade Register Number: J2020005916403
European Unique Identifier (EUID): ROONRC.J2020005916403
Registration date: 5 June 2020
Registered office: Str. Avrig nr. 24, Bl. P19, Sc. A, Et. 1, Ap. 6, Postal code 021575, Sector 2, Bucharest, Romania
Work location: Pantelimon, Ilfov County, Romania
Primary email: contact@mitzuu.ro
Website: https://mitzuu.ro
Data Protection Officer (DPO): Mitzuu Media S.R.L. is not legally required to appoint a DPO under Article 37 GDPR, as it does not carry out large-scale systematic monitoring activities. For any personal data request, please use the address contact@mitzuu.ro.
3. Definitions
- Personal data — any information relating to an identified or identifiable natural person (name, email, phone number, IP address, etc.);
- Processing — any operation performed on data (collection, storage, modification, transmission, deletion, etc.);
- Controller — the legal entity that determines the purposes and means of processing (in this case, Mitzuu Media S.R.L.);
- Data subject — the natural person whose data is being processed (you, the site visitor);
- Sub-processor (processor) — a third party that processes data on behalf of the controller (e.g. email service providers, hosting, anti-spam);
- Consent — a freely given, specific, informed and unambiguous indication of the data subject's wishes.
4. Categories of Personal Data Processed
The categories of data we collect depend on how you interact with the website:
4.1. Contact form (/contact)
- Full name
- Email address
- Subject
- Message content
4.2. Brands form (/branduri)
- Full name
- Company / brand name
- Business email
- Estimated campaign budget
- Campaign details / objectives
4.3. Careers application form (/cariere)
- Full name
- Email address
- Age (age-of-majority check)
- Phone number
- Role you are applying for
- Driving licence (Yes / No)
- Legal form (SRL / PFA / No, but I can set one up)
- How you would travel to the office
- Content you follow (media preferences)
- Portfolio / CV link
- Description of a personal project + motivation
4.4. Data automatically collected when visiting the site
- IP address (anonymised / pseudonymised by Cloudflare);
- Browser type and version;
- Operating system;
- Country / region (high level, via GeoIP);
- Page visited and time of access (in technical logs);
- Aggregated performance statistics (Largest Contentful Paint, load time) via Cloudflare Web Analytics — no cookies, no persistent identifiers, no fingerprinting.
4.5. Data generated by the anti-spam mechanism (Cloudflare Turnstile)
When any form is submitted, a cryptographic Cloudflare Turnstile token is generated to confirm you are not a bot. This token does not contain directly identifiable personal data.
Note: We do not collect or process special categories of data (health, religion, ethnicity, political views, biometric data, etc.) nor data of minors under 16 (career applications require a minimum age of 18).
5. Purposes and Legal Bases of Processing
We process your data only for legitimate purposes, each with a clear legal basis under Article 6 GDPR:
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to requests sent via the contact form | Art. 6(1)(a) — your consent |
| Negotiating, concluding and performing a brand / sponsorship collaboration | Art. 6(1)(b) — pre-contractual measures and performance of a contract |
| Recruitment process (candidate assessment, contact, hiring decision) | Art. 6(1)(b) — pre-contractual measures |
| Fraud and abuse prevention (anti-spam, bot detection) | Art. 6(1)(f) — legitimate interest in protecting the site |
| Site security, technical maintenance, aggregated technical statistics | Art. 6(1)(f) — legitimate interest of the controller |
| Compliance with tax, accounting and legal obligations | Art. 6(1)(c) — legal obligation |
| Defending our interests in the event of a dispute | Art. 6(1)(f) — legitimate interest |
Where the legal basis is consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
6. Sources of Data
All personal data we process comes directly from you, through the voluntary completion of forms on the site or by contacting us by email. We do not buy databases and do not collect personal data from public sources without a valid legal basis.
7. Recipients and Sub-processors
To operate, the site uses a limited number of service providers who may have access to your data as processors (sub-processors). All of these providers are selected for their GDPR compliance and have signed specific data processing agreements:
| Provider | Purpose | Country |
|---|---|---|
| Cloudflare, Inc. | CDN, security, DDoS protection, site hosting | USA / global (EU servers) |
| Cloudflare Web Analytics | Aggregated traffic statistics (privacy-first, no cookies, no unique identifiers, no fingerprinting) | USA / global |
| Cloudflare Turnstile | Anti-bot verification on form submissions | USA / global |
| FormSubmit.co | Form processing and email delivery | USA |
| Imgur, Inc. | Image hosting (logos, photos) — no personal data | USA |
| Google LLC (Fonts) | Serving the Space Grotesk and Manrope fonts | USA / global |
In addition, we may disclose data to:
- Competent public authorities, where there is a legal obligation to do so (courts, ANAF, ANSPDCP, criminal investigation bodies);
- Accounting, legal and tax advisors of the controller, under strict confidentiality obligations;
- Any legal successors, in the case of reorganisation or transfer of the controller's business.
We do not sell or rent your personal data to third parties for marketing purposes.
8. International Data Transfers
Some of our sub-processors (Cloudflare, FormSubmit.co, Imgur, Google) are established in the United States of America. These transfers are carried out in accordance with Chapter V of the GDPR, based on one or more legal mechanisms:
- EU-U.S. Data Privacy Framework (DPF) — European Commission adequacy decision of 10 July 2023, for certified providers;
- Standard Contractual Clauses (SCC) approved by the European Commission;
- Additional safeguards implemented by providers (encryption in transit and at rest, access control, independent audits).
For details on each sub-processor's policy, you can consult:
9. Data Retention Periods
We retain your data for periods that are strictly necessary to fulfil the stated purposes, after which we delete or anonymise it:
| Data category | Period |
|---|---|
| Messages received via the contact form | Maximum 12 months from the last interaction |
| Discussions and proposals received via the brands form (no signed contract) | Maximum 24 months from receipt of the request |
| Data associated with a signed collaboration contract | For the duration of the contract + 10 years (tax obligations under the Romanian Fiscal Code) |
| Applications received via the careers form (candidate rejected / no response) | Maximum 12 months from receipt of the application |
| Data of successful candidates (who become employees / collaborators) | For the duration of the employment relationship + 75 years (legal obligation for payroll records) |
| Technical logs (IP, browser, accesses) | Maximum 90 days |
| Turnstile tokens / anti-spam sessions | Maximum 15 minutes (token validity) |
After the above periods expire, the data is securely deleted or anonymised so that you can no longer be identified.
10. Rights of the Data Subject
As a data subject, you have the following rights under Chapter III of the GDPR:
Right of access (Art. 15)
To obtain confirmation of processing and a copy of your data.
Right to rectification (Art. 16)
To request correction of inaccurate data or completion of incomplete data.
Right to erasure — "right to be forgotten" (Art. 17)
To request deletion of your data when there are no longer grounds for retention.
Right to restriction of processing (Art. 18)
To request temporary blocking of processing in certain situations.
Right to data portability (Art. 20)
To receive your data in a structured, machine-readable format, or to request its transfer to another controller.
Right to object (Art. 21)
To object to processing based on legitimate interest.
Right to withdraw consent (Art. 7)
At any time, without affecting the lawfulness of prior processing.
Right not to be subject to automated decisions (Art. 22)
Including profiling. Mitzuu Media does not use automated decisions with legal effects.
Right to lodge a complaint (Art. 77)
With the supervisory authority — ANSPDCP (see section 12).
11. How to Exercise Your Rights
To exercise any of the above rights, you can contact us:
- By email: contact@mitzuu.ro
- By post: Str. Avrig nr. 24, Bl. P19, Sc. A, Et. 1, Ap. 6, Sector 2, Bucharest, postal code 021575
To help us respond accurately, please include in your request:
- Your first and last name;
- The email address used in your communications with us;
- The right you wish to exercise;
- A short description of your request.
We will respond to your request within no more than 30 days from receipt, in accordance with Art. 12(3) GDPR. For complex or numerous requests, this period may be extended by up to 2 months, with prior notice. Exercising your rights is free of charge, except where requests are manifestly unfounded, excessive or repetitive.
12. Complaints to ANSPDCP
If you believe your rights have been violated, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing — the Romanian data protection authority:
Name: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Address: B-dul G-ral Gheorghe Magheru nr. 28-30, Sector 1, Postal code 010336, Bucharest
Phone: +40.318.059.211 / +40.318.059.212
Email: anspdcp@dataprotection.ro
Website: www.dataprotection.ro
We encourage you to contact us first to try to reach an amicable resolution before filing a formal complaint.
14. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, modification, disclosure, loss or destruction. These include:
- Encryption in transit via HTTPS / TLS 1.3 across the entire site;
- DDoS protection and WAF (Web Application Firewall) via Cloudflare;
- Anti-bot and anti-spam mechanism (Cloudflare Turnstile + honeypot);
- Restricted access to the company email inbox (two-factor authentication);
- Pseudonymisation of IP addresses in technical logs;
- Internal data-minimisation policy — we only collect what is necessary.
In the unlikely event of a security breach that exposes your rights, we will notify ANSPDCP within 72 hours, in accordance with Art. 33 GDPR, and — if the risk is high — we will also inform you directly, in accordance with Art. 34 GDPR.
15. Changes to This Policy
We may update this Privacy Policy from time to time to reflect legislative changes, changes to our services, or emerging best practices. The version in force is always the one published on this page, with the last update date shown in the header. For significant changes, we will notify you by email (if we have your address) or through a visible announcement on the site.
16. Contact
For any question, clarification or request regarding the processing of your data, we are at your disposal:
MITZUU MEDIA S.R.L.
Str. Avrig nr. 24, Bl. P19, Sc. A, Et. 1, Ap. 6, Sector 2, Bucharest
CUI 42587777 · J2020005916403
Email: contact@mitzuu.ro
This document was last updated on 24 April 2026 and represents version 2.0 of the Mitzuu Media S.R.L. Privacy Policy.