GDPR Compliant • Transparent Data Ethics

Privacy Policy

How Criss Design collects, handles, and protects your information across our website and client services.

Effective Date: October 14, 2026 • Jurisdiction: Romania / European Union

1 Data Controller & Contact

The data controller responsible for the processing of personal data on this website (criss-design.eu) is:

Cristian Istrate (Criss Design)

Location: Bucharest / Ilfov, Romania

Website: https://criss-design.eu

Direct Inquiries: Contact Form or email via studio communications

2 Information We Collect & Why

We strictly limit data collection to what is necessary to operate our studio, deliver design & code contracts, and protect our infrastructure:

Direct Inquiries & Orders

When you fill out our contact form or purchase a sprint package, we collect your name, email address, and project details so we can evaluate your requirements, reply, and generate formal invoices.

Cloudflare Turnstile (Anti-Spam)

We use Cloudflare Turnstile to block automated spam bots on form submissions. Turnstile runs privacy-preserving checks and does not use interactive tracking cookies or collect sensitive personal profiles.

Google Analytics 4 (Opt-In Only)

If you explicitly consent via our cookie banner, Google Analytics measures aggregate traffic (e.g. which case studies are read). IP addresses are anonymized, and nothing loads until you grant permission.

Payment Processing (PayPal)

Payments for sprint passes and tool packages are processed directly on PayPal's secure checkout. We never see, process, or store your credit card numbers or banking credentials.

3 Legal Basis for Processing (GDPR Article 6)

Consent (Art. 6(1)(a)): Applicable for optional analytics cookies. You may revoke consent at any moment via the cookie settings in our footer.
Contractual Necessity (Art. 6(1)(b)): Applicable when processing your contact data and requirements to prepare proposals, execute sprint agreements, or fulfill software delivery.
Legitimate Interests (Art. 6(1)(f)): Securing the website from malicious attacks, preventing fraud, and maintaining infrastructure stability.

4 Data Storage, Security & Retention

Our infrastructure is hosted on Google Cloud Firebase within the European Union (europe-west1). All communication is strictly encrypted in transit using modern TLS 1.3 encryption, enforced with Strict-Transport-Security (HSTS) and robust Content Security Policies (CSP).

We retain contact and client project data only for the duration of the commercial relationship or as required by statutory accounting and tax retention periods under Romanian law (typically 5 to 10 years for fiscal invoices).

5 Your Rights Under GDPR

As a resident of the European Union, you have full statutory rights regarding your personal data:

Right of Access Request confirmation and a copy of any personal data we hold about you.

Right to Erasure Request deletion of your personal records ("Right to be Forgotten").

Right to Rectification Request immediate correction of inaccurate or incomplete information.

To exercise any of these rights, simply reach out to us via our contact form. Requests are addressed within 30 days without fee.

6 Cookie Preferences

You can change your consent preferences for analytics cookies at any time: