Privacy Policy
Last updated: 5 August 2026
This Privacy Policy explains how Hotsurge Dragz Solutions SRL, operating as Ispas Studio, collects and uses personal data when you visit https://ispas.studio or contact us. Full company details are in Contact below.
We process personal data in line with the EU General Data Protection Regulation (GDPR) and applicable Romanian law.
What data we collect
Information you send us
When you use the contact form or email us, we may collect:
- Name
- Email address
- Message content and any project details you choose to share
If we work together, we may also process billing and contract details needed to issue invoices as a Romanian company (for example legal name, address, CUI/VAT number, and payment references).
Information collected automatically
When you visit the website, our infrastructure and tools may process:
- IP address and approximate location derived from it
- Browser and device information
- Pages visited, referring URL, and timestamps
- Basic server/security logs from hosting and DNS/CDN providers
Cookies and analytics
We use:
- Essential cookies / storage needed for the site to work (for example theme preference, if enabled)
- Google Analytics to understand how the site is used (traffic, popular pages, rough geography, device/browser)
Analytics cookies and similar technologies that are not strictly necessary are used only with your consent. You can refuse or withdraw consent through the cookie banner (Cookie settings in the footer) or by adjusting your browser settings.
Why we use your data
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Respond to inquiries | Contact form, email replies | Legitimate interests (Art. 6(1)(f)), or steps prior to a contract (Art. 6(1)(b)) |
| Deliver client work & Care | Project communication, maintenance | Contract (Art. 6(1)(b)) |
| Invoicing & accounting | Romanian invoices, tax records | Legal obligation (Art. 6(1)(c)) |
| Run and secure the website | Hosting, DNS, abuse prevention | Legitimate interests (Art. 6(1)(f)) |
| Measure site performance | Google Analytics | Consent (Art. 6(1)(a)), where required |
We do not sell your personal data. We do not use contact-form details for unrelated marketing lists.
Who we share data with
We use trusted providers that process data on our behalf or as independent controllers where applicable:
- Vercel — website hosting
- Cloudflare — domain DNS and related network services
- Google — Google Workspace (email and business communication) and Google Analytics
- Professionals we engage when needed (for example an accountant), under confidentiality where appropriate
Some providers may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards (such as Standard Contractual Clauses) offered by those providers.
We may also disclose data if required by law or to protect our legal rights.
How long we keep data
- Contact inquiries: as long as needed to handle your request, then typically up to 24 months unless a project continues or a longer retention is needed
- Client / project records: for the duration of the relationship and a reasonable period afterward
- Invoices and accounting records: for the periods required under Romanian tax and accounting law
- Analytics data: according to the retention settings configured in Google Analytics
- Server / security logs: for a short operational period, unless needed longer for security or legal reasons
Your rights
Subject to GDPR and Romanian law, you may request:
- Access to your personal data
- Correction of inaccurate data
- Erasure (“right to be forgotten”), where applicable
- Restriction of processing
- Data portability, where applicable
- Objection to processing based on legitimate interests
- Withdrawal of consent at any time (without affecting earlier lawful processing)
To exercise these rights, email [email protected]. We may need to verify your identity before responding.
You also have the right to lodge a complaint with the Romanian supervisory authority:
ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)
https://www.dataprotection.ro
Security
We take reasonable technical and organisational measures to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Children’s privacy
This website is aimed at businesses and adult professionals. We do not knowingly collect personal data from children.
Links to other sites
Our site may link to third-party websites. Their privacy practices are their own. We recommend reading their policies before sharing personal data.
Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the website after updates means you should review the revised policy.
Contact
Controller: Hotsurge Dragz Solutions SRL (Ispas Studio)
CUI: RO47186032
Address: Nerva Traian 12, Bucharest, Romania
Email: [email protected]