Privacy policy

Last updated: 16 October 2026

1. Who we are

The website bellesoft.ro is operated by BelleSoft, company ID (CUI) [CUI], registered office [Adresă sediu – registered address]. You can reach us at contact@bellesoft.ro or by phone at 0740 902 102.

We are the controller of the personal data described below, under Regulation (EU) 2016/679 (GDPR).

2. What data we process and why

Contact form

• Data: name, email, company (optional), phone (optional), subject, message and page language. For abuse protection we also keep a cryptographic hash of your IP address, from which the address can't be reconstructed, and your browser type.
• Purpose: to reply and prepare a possible quote; to limit abuse and spam.
• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), the consent you give with the form's checkbox (Art. 6(1)(a)) and our legitimate interest in protecting the website (Art. 6(1)(f)).
• Retention: as long as needed to handle your request, and at most 24 months after the last correspondence if no contract follows. The IP hash is used only to rate-limit messages.

Cloudflare (hosting, CDN and security)

The website is hosted and protected by Cloudflare (Cloudflare, Inc.). To deliver pages and block attacks, Cloudflare processes technical data such as your IP address, browser type and the pages requested, based on our legitimate interest in a secure, fast website (Art. 6(1)(f)). Messages sent through the form are stored in a Cloudflare D1 database.

Cloudflare Turnstile (anti-spam)

The contact form uses Cloudflare Turnstile, a privacy-friendly CAPTCHA alternative that checks you are human. Turnstile processes technical browser signals and your IP address. It doesn't use advertising cookies or track you across websites. The legal basis is our legitimate interest in preventing spam (Art. 6(1)(f)).

Google Analytics 4 (only with your consent)

If you accept analytics cookies, we use Google Analytics 4 (Google Ireland Limited) for aggregate statistics: pages viewed, visit duration, device type, approximate country or city and traffic source. We also record, without personal data, the successful submission of the contact form.

• Without your consent, the Google script isn't loaded at all.
• The advertising signals (ad_storage, ad_user_data, ad_personalization) always stay denied.
• GA4 does not store full IP addresses.
• Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Retention: GA4 data is kept for at most 14 months, and the cookies for 13 months.

3. Recipients and transfers

Data is processed by our providers, Cloudflare and Google, as processors under contract. It may be transferred to the USA. In that case, the transfer relies on the EU-US Data Privacy Framework, under which both companies are certified, or on the European Commission's Standard Contractual Clauses. We do not sell or rent your data.

4. Your rights

You have the right to access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting earlier processing. Write to us at contact@bellesoft.ro; we reply within one month. You may also lodge a complaint with the Romanian supervisory authority (ANSPDCP), www.dataprotection.ro, or with the authority in your EU country of residence.

5. Security

We use HTTPS everywhere, strict security policies (CSP, HSTS), authentication-only access to the admin area (Cloudflare Access) and data minimisation: we don't collect more than we need.

6. Cookies

For details on cookies and how to change your choice, see the Cookie policy.

Open cookie settings

7. Changes

We may update this policy; the date of the last change is shown at the top of the page.