Effective date: May 24, 2026

1. Data Controller

The data controller responsible for processing your personal data is:

Company name: HADASSA WORLD SRL
Registered office: Strada 1 Decembrie 1918, No. 2, Târgu Secuiesc, Covasna County, Romania, 525400
CUI: 27983573
Email: info@marketingsweb.com
Phone: +40 740 45 49 64
Website: https://marketingsweb.com

In this Privacy Policy, “we”, “us” and “our” refer to HADASSA WORLD SRL.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR), Romanian Law No. 190/2018 and other applicable Romanian and EU legislation, including Law No. 506/2004 concerning privacy in electronic communications, where applicable.

2. Personal Data We Process

The personal data we process depends on how you interact with our website and services.

Depending on the circumstances, we may process the following categories of data:

• Identification data: name and surname.

• Contact details: email address, telephone number and other contact details you provide.

• Business and project information: company name, website address, project requirements, business goals and information submitted through contact forms or during consultations.

• Account and interaction data: account details, comments and other information you provide, where these features are available.

• Order and transaction data: order details, billing information, delivery address, order history and payment transaction identifiers, where online purchasing is available.

• Technical data: IP address, browser type, device information, server logs and information relating to your use of the website.

• Cookie and analytics data: information collected through cookies and similar technologies, subject to your preferences and applicable law.

• Marketing preferences: newsletter subscription status, consent records and communication preferences, where applicable.

Payment card details: We do not intend to collect or store complete payment card details on our website. Where online payments are offered through Stripe, payment processing is handled by Stripe in accordance with its own terms and privacy policy. We may receive limited transaction-related information necessary to confirm and manage a payment.

Please do not submit sensitive personal data through our contact forms unless it is necessary and we have an appropriate legal basis to process it.

3. Purposes, Legal Bases and Retention Periods

We process personal data only for specified purposes and where a valid legal basis applies under Article 6 of the GDPR.

Purpose	Categories of data	Legal basis	Retention period
Responding to enquiries and contact forms	Name, contact details, message and project information	Legitimate interest in responding to business enquiries; pre-contractual steps where you request a service proposal	For as long as necessary to handle the enquiry and any reasonable follow-up, then deleted or archived where legally justified
Preparing proposals and providing services	Contact details, business information, project details and communications	Taking steps at your request before entering into a contract; performance of a contract	For the duration of the relationship and afterwards for the applicable legal limitation and recordkeeping periods
Processing orders and deliveries, where applicable	Name, contact details, billing and delivery information, order details	Performance of a contract and compliance with legal obligations	For the time necessary to fulfil the order and afterwards for applicable statutory and limitation periods
Invoicing and accounting	Billing details, invoices and transaction records	Legal obligation	For the period required by applicable Romanian accounting and tax legislation
Managing accounts and comments, where available	Account details, profile information and comments	Performance of a contract where relevant, or legitimate interests in operating and protecting the website; consent where legally required	Until the account or content is deleted, subject to necessary backups, legal obligations and legitimate recordkeeping
Newsletter and direct marketing	Name, email address and marketing preferences	Consent where required by law	Until consent is withdrawn or you unsubscribe, subject to retaining a minimal suppression record where necessary to respect your preference
Website security and technical operation	IP address, server logs, device and browser information	Legitimate interest in maintaining website security, preventing abuse and ensuring reliable operation	For a limited period appropriate to the security purpose, unless a longer period is necessary to investigate an incident or comply with the law
Analytics and website performance	Cookie identifiers, online identifiers and usage information	Consent where required by applicable cookie rules; the relevant GDPR legal basis as disclosed through the applicable consent mechanism	According to the applicable analytics settings, cookie preferences and retention configuration
Advertising and audience measurement, where enabled	Online identifiers, cookie data and website interactions	Consent where required by applicable law and the relevant GDPR legal basis	According to the advertising platform’s settings, consent status and applicable retention configuration
Handling legal claims and exercising legal rights	Relevant communications, transaction records and supporting evidence	Legitimate interests in establishing, exercising or defending legal claims, or compliance with legal obligations	For the period necessary to handle the matter and any applicable limitation period

We determine retention periods according to the purpose of processing, legal requirements, applicable limitation periods and the need to establish, exercise or defend legal claims. When personal data is no longer needed, we delete it or anonymise it where appropriate.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. We may retain certain information where the law requires it or where retention is otherwise legally justified.

4. Who May Receive Your Personal Data?

We may disclose personal data to service providers and other recipients where necessary for the purposes described in this Privacy Policy or where required by law.

Depending on the services and features actually used, these recipients may include:

• Website hosting and technical infrastructure providers, which store or support the operation of the website.

• Website, form and communication service providers, which help us manage enquiries and communications.

• Payment service providers, such as Stripe Payments Europe, Ltd., where online payments are offered.

• Courier and delivery companies, such as FAN Courier or Sameday, where orders require delivery.

• Accounting and professional advisers, where necessary for accounting, tax, legal or other professional services.

• Analytics providers, including Google Ireland Limited, where Google Analytics is used.

• Advertising platforms, including Meta Platforms Ireland Limited, where Meta advertising or tracking tools are enabled.

• Public authorities, courts and regulators, where disclosure is required by law or necessary to protect our legal rights.

We share only the information reasonably necessary for the relevant purpose. Service providers processing personal data on our behalf are subject to appropriate contractual and data protection requirements where applicable.

Each provider may also process certain information as an independent data controller under its own privacy terms. Please consult the relevant provider’s privacy policy for further details.

5. International Transfers of Personal Data

Some service providers may process personal data outside the European Economic Area (EEA), including in countries outside the European Union.

Where personal data is transferred to a country outside the EEA, we rely on an applicable legal transfer mechanism under the GDPR, where required. Depending on the recipient and the transfer, this may include:

• an adequacy decision adopted by the European Commission;

• the EU-U.S. Data Privacy Framework, where the recipient is eligible and appropriately certified; or

• Standard Contractual Clauses and, where necessary, supplementary safeguards.

The applicable mechanism depends on the provider, the recipient and the particular transfer. Further information about the safeguards applicable to a specific transfer may be requested using the contact details in Section 1.

6. Cookies and Similar Technologies

Our website may use strictly necessary cookies and, where enabled, analytics, functionality and marketing cookies.

Strictly necessary cookies are used to provide features explicitly requested by visitors or to ensure the technical operation of the website. Other cookies, including analytics and advertising cookies, will be used only in accordance with applicable law and your consent choices where consent is required.

Depending on the tools enabled on the website, these technologies may include:

• Google Analytics: to measure website traffic and understand how visitors use the website.

• Meta Pixel: to measure advertising performance and, where configured and permitted, support advertising audiences and conversion measurement.

You can manage your cookie preferences through the cookie consent banner or the available cookie settings on our website. Where consent is required, non-essential cookies and associated tracking technologies should not be activated before the relevant consent is given.

You may withdraw or change your consent at any time through the available cookie settings. You may also manage cookies through your browser settings, although blocking certain cookies may affect website functionality.

For further information about the specific cookies, their providers, purposes and durations, please consult our separate Cookie Policy.

7. Profiling and Automated Decision-Making

Where enabled and permitted by your consent choices, analytics and advertising tools may analyse website interactions to measure performance, understand visitor behaviour or support advertising audience creation.

Such activities depend on the configuration of the relevant tools and the choices you make through the cookie consent mechanism.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

8. Embedded Content and Third-Party Websites

Our website may include embedded content or links to third-party websites, such as videos, maps, images or social media content.

When you interact with embedded content, the relevant third-party provider may collect information about your device or interaction and may use cookies or similar technologies according to its own privacy practices.

Where applicable, such content should be activated in accordance with your cookie preferences and the relevant legal requirements.

We do not control the privacy practices of third-party websites. We recommend reviewing their privacy policies before using their services.

9. Your Data Protection Rights

Under the GDPR, and subject to the applicable conditions and exceptions, you have the following rights:

• Right of access: to obtain confirmation of whether we process your personal data and access to that data.

• Right to rectification: to request the correction of inaccurate or incomplete personal data.

• Right to erasure: to request the deletion of personal data where the legal conditions are met.

• Right to restriction of processing: to request restriction of processing in certain circumstances.

• Right to data portability: to receive personal data you provided to us in a structured, commonly used and machine-readable format, where the legal conditions apply.

• Right to object: to object to processing based on legitimate interests on grounds relating to your particular situation. You have an unconditional right to object to the processing of your personal data for direct marketing.

• Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

• Right not to be subject to certain automated decisions: to the extent provided by applicable law.

To exercise your rights, contact us at info@marketingsweb.com. We may request information reasonably necessary to verify your identity before responding.

We will respond to requests within the period required by the GDPR, generally within one month of receipt. This period may be extended by up to two further months where permitted by law, taking into account the complexity and number of requests. If an extension is necessary, we will inform you within the initial one-month period.

These rights are subject to applicable legal conditions and exceptions. For example, we may need to retain certain accounting records or information necessary to establish, exercise or defend legal claims even if you request deletion.

10. Data Security and Personal Data Breaches

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Depending on the systems used, these measures may include SSL/TLS encryption, access restrictions, secure authentication, software updates, backups and security monitoring.

No method of transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security, but we take reasonable measures to protect the information entrusted to us.

If a personal data breach occurs, we will assess the incident and take the measures required by applicable law, including notifying the competent supervisory authority within the applicable timeframe and informing affected individuals where required.

11. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. You may also seek an effective judicial remedy in accordance with the GDPR.

In Romania, the supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Website: https://www.dataprotection.ro/

Please consult the authority’s official website for its current contact details and procedures for submitting a complaint.

You may also exercise your rights directly with us using the contact details in Section 1.

12. Children’s Privacy

Our website and services are not specifically directed at children. We do not knowingly collect personal data from children where doing so would be unlawful or require consent that has not been obtained.

If you believe that a child has provided us with personal data in circumstances where it should not have been collected, please contact us so that we can review the situation and take appropriate action.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website functionality, data processing practices or applicable legal requirements.

The updated version will be published on this page, together with its effective date. We encourage you to review this page periodically.

If a change requires additional information or action under applicable law, we will take the measures required in the circumstances.

14. Contact Us

If you have questions about this Privacy Policy or how we process personal data, or if you wish to exercise your data protection rights, please contact:

HADASSA WORLD SRL
Email: info@marketingsweb.com
Phone: +40 740 45 49 64
Website: https://marketingsweb.com