Privacy Policy

Who controls the data

The website is operated for Adrian Paul Popescu, a Romanian artisan creating handmade knives, leather goods, accessories, and hunting trophies.Adrian Paul Popescu is responsible for the personal data used to operate this website, measure visits with permission, handle phone and WhatsApp inquiries and orders, and publish customer testimonials.

The website is a static site. It does not provide user accounts, checkout, online payments, or a customer dashboard.

Contact location: Sector 2, Bucharest, Romania.

What personal data is processed

Cloudflare delivers and protects this website. Serving a page involves processing request information such as your IP address, browser details, requested URL, referrer and time of access. Cloudflare also processes traffic and security information to detect abuse and keep the site available.

If you choose to contact Adrian by phone or WhatsApp, the personal data processed is the information you decide to provide, such as your name, phone number, WhatsApp profile details, message content, product interest, order details, delivery context, or other information needed to answer the inquiry.

If you accept analytics, Google Analytics processes pseudonymous visitor and session identifiers, pages viewed, interactions, referral information and device/browser information. Reports may be aggregated, but collecting data to create those reports is still personal-data processing. Google states that GA4 does not log or store individual IP addresses.

Analytics data will not be used to identify individual visitors.

Customer testimonials can include an approved name, occupation, review, product context and photograph. They are published with permission and can be seen by website visitors and search engines.

WhatsApp and Facebook are external links, not embedded feeds or chat widgets. Opening a link takes you to that provider, which processes information under its own privacy policy. Choosing WhatsApp is optional; you can contact Adrian by phone instead.

Why the data is processed

Each use has its own purpose and legal basis under the GDPR:

• Website delivery and security: legitimate interests in making the portfolio available and preventing abuse, Article 6(1)(f).
• Requested quotations and orders: steps you request before a contract and performance of that contract, Article 6(1)(b).
• Other correspondence: legitimate interests in responding to relevant questions and providing customer support, Article 6(1)(f), where the response is not required by a contract.
• Accounting, tax and other statutory records:compliance with applicable legal obligations, Article 6(1)(c).
• Handling legal claims: legitimate interests in establishing, exercising or defending legal rights, Article 6(1)(f).
• Optional analytics and publication of testimonials:your consent, Article 6(1)(a). These are separate choices.

Analytics is not required to browse or make an inquiry. Contact details, commission specifications and, for an order, necessary delivery and billing information are needed to respond and complete the work. Without that information, Adrian may be unable to provide a quotation, deliver an order or issue the documents required by law. Please do not send unnecessary identity documents or sensitive information.

There is no mailing list or use of inquiry details for unsolicited promotional messages. This website does not make solely automated decisions that have legal or similarly significant effects on you.

Cookies and analytics

This website uses a cookie consent tool to remember your privacy choice. That preference cookie is necessary because it prevents the site from asking the same question on every page.

Google Analytics is optional and is loaded only after you accept it. Rejecting it keeps the tag blocked. Withdrawing permission disables measurement, clears the website's analytics cookies and reloads the page so the loaded tag is removed. The website does not use Google advertising personalization or Google Signals.

Swipe or scroll the table to see all cookie details.

You can change your choice at any time by using the Cookie settings link in the footer. Your browser may shorten the lifetimes shown above.

You can also delete this website's stored cookies or block cookies in your browser's privacy or site-data settings. Deleting the preference cookie means the site will ask for your choice again. Browser instructions: Chrome, Firefox and Safari.

Retention rules

• Analytics cookies: the visitor identifier (_ga) lasts up to 180 days from creation, without extending expiry on ordinary visits. The session cookie lasts up to 180 days from your most recent visit. Both are deleted if you withdraw consent.
• Analytics records: the retention period for GA4 user- and event-level data is two months, with the user-data retention reset on new activity switched off. Google performs deletion on its monthly schedule. This setting does not govern standard aggregated reports.
• Website request and security data: the static website does not create its own application-level visitor log. This website uses Cloudflare's Free plan, for which Cloudflare publishes retention periods of 24 hours for Security Events and 7 days for Security Analytics. Other Cloudflare operational records have their own service-specific retention rules. See Cloudflare's retention information.
• Diagnostic extracts kept by Adrian: delete within 30 days of collection. If an extract is needed for a particular incident or legal claim, retain only the relevant evidence until the incident or claim is resolved and any applicable legal requirement ends.
• Inquiries and orders: keep correspondence while the request is being handled. Order records needed for delivery, warranty, accounting or legal claims are retained for the relevant obligation; unrelated messages are not retained merely because an invoice must be kept.
• Testimonials: while permission remains in place and the testimonial is used on the website. You can ask to withdraw permission for the name, text or photograph through the contact routes below.

Who receives data

• Cloudflare, Inc.: website delivery, hosting and security. Cloudflare processes customer logs and website content on behalf of its customer, and acts separately as controller for some service-operation data under its Privacy Policy. Its Data Processing Addendum describes processor obligations and international-transfer safeguards.
• Google Analytics: measurement data, only with your consent. Google's Data Processing Terms describe processing on behalf of Analytics customers. Its international-transfer information explains use of the EU–US Data Privacy Framework and Standard Contractual Clauses where applicable.
• WhatsApp Ireland Limited: when you choose WhatsApp, the service processes information under its EEA Privacy Policy. Adrian remains responsible for using your inquiry and order information.
• Meta Platforms Ireland Limited: when you visit Facebook using an external link, Facebook processes your use of its service under its Privacy Policy.
• Order-related recipients: where needed, delivery providers receive contact and delivery details, and accounting advisers, payment providers or competent authorities receive information required to document an order, process payment or comply with law.

These services use international infrastructure, including in the United States, so processing is not limited to Romania or the EEA. An EU–US Data Privacy Framework transfer relies on the European Commission's adequacy decision for covered, certified recipients. Where that mechanism does not apply, the relevant provider terms describe Standard Contractual Clauses and applicable additional safeguards. You can consult the linked terms or contact Adrian to request information or a copy of the safeguards relevant to your data. Accepting analytics does not waive these transfer protections.

Personal inquiry details are not sold. They are used only when needed to answer you, complete agreed work, comply with law, or protect legal rights.

Your rights

• Access and correction: ask for access to your personal data, a copy, and correction of inaccurate or incomplete information.
• Deletion and restriction: ask for deletion or limited use where the GDPR conditions are met. Data needed for a legal obligation or to establish, exercise or defend legal claims may need to be retained.
• Objection: object, for reasons relating to your situation, to processing based on legitimate interests. Such processing must stop unless overriding grounds or legal claims justify continuing it.
• Portability: where processing is automated and based on consent or a contract, ask for data you provided in a structured, commonly used, machine-readable format and, where technically feasible, transmission to another controller.
• Withdraw consent: use Cookie settings to withdraw analytics consent, or contact Adrian about testimonial permission. Withdrawal does not affect the lawfulness of processing before withdrawal.

Requests are normally free and answered without undue delay and within one month. Complex or numerous requests may require up to two additional months; if so, you will be told within the first month, with reasons. Reasonable identity verification may be needed, limited to what is necessary. If a request cannot be met, you will receive the reasons and information about your options to challenge the response.

You also have the right to lodge a complaint with the Romanian data protection authority, ANSPDCP, at dataprotection.ro, or with the competent supervisory authority where you live, work, or believe an infringement occurred. You can also seek a judicial remedy.