For any question about your personal data, you can write to us at any of the addresses above or call us. We have not appointed a data protection officer (DPO) because appointing one is not mandatory for our activity (Art. 37 GDPR); requests are handled directly by the controller.
Who this policy applies to
This policy applies to visitors to mabisstudio.com, people who contact us (by form, phone, WhatsApp or email), prospective clients and our clients, as well as representatives of the legal entities we work with. Our services are: web design and development, management of Meta Ads campaigns (Facebook and Instagram) and drone filming.
What data we process and where we get it
The “Request a quote” form
Data
full name, email, phone, the service you want, your answers to the questions specific to the chosen service (for example the type of website, the monthly advertising budget, the type of filming), the optional message and the confirmation that you have read this policy.
Source
you, by filling in the form.
Direct communication
Data
phone number, display name, the content of messages and of files sent by phone, WhatsApp or email.
Source
you.
Contract and invoicing (clients)
Data
name or company name, tax identification data and address, contact details, the history of quotes, contracts and payments, and the materials and access you provide for the project.
Source
you or the company you represent.
Technical data
Data
IP address, device and browser type, pages visited, date and time of access.
Source
the website's hosting and security infrastructure, automatically.
We do not ask for, and ask that you do not send us, special categories of data (health, political or religious opinions, etc.), personal numeric codes (CNP) or card data. If you send us such data when it is not necessary, we delete it.
Why we process data, on what legal basis and how long we keep it
Replying to a quote request and pre-contractual discussions
Legal basis
Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). For company representatives: Art. 6(1)(f) (the legitimate interest in answering professional inquiries).
Retention
for as long as we are in discussions and, if no contract is concluded, up to 12 months after the last communication.
Concluding and performing the contract (including invoicing, delivery, support)
Legal basis
Art. 6(1)(b) GDPR.
Retention
for the duration of the contract, then according to the other purposes below.
the periods set by accounting and tax law, usually 5 years.
Defending rights and resolving complaints or disputes
Legal basis
Art. 6(1)(f) GDPR (the legitimate interest in defending our rights).
Retention
up to 3 years after the end of the relationship (the general limitation period) or until the final resolution of any dispute.
Website security, preventing spam and abuse
Legal basis
Art. 6(1)(f) GDPR (the legitimate interest in protecting the website and the form).
Retention
according to the infrastructure providers' logs, usually short periods.
Marketing. We do not send newsletters or unsolicited promotional messages. If we introduce such communications, we will send them only with your prior consent (Art. 6(1)(a) GDPR and Art. 12 of Law No. 506/2004), which you can withdraw at any time.
Automated decisions. We do not make decisions based solely on automated processing and we do not carry out profiling that produces legal effects on you.
Who else receives the data
We use providers that help us operate the website and communicate with you. They act as processors or, where applicable, as independent controllers, under their own terms:
Cloudflare, Inc. — hosting and delivery of the website, protection against abuse.
Google (Google Workspace / Gmail, Google Apps Script) — receives the content of the form and forwards it to our email inbox.
Google (Gmail) — receiving and archiving email messages.
Google Fonts — the website's fonts are loaded from Google's servers; when loading, Google receives your IP address and technical information about your browser.
Meta Platforms (WhatsApp) — if you message us on WhatsApp, the conversation is subject to WhatsApp's policies. The WhatsApp button on the website does not transmit any data until you open the conversation.
Accountant, banks and payment processors, where applicable, and public authorities, when the law requires us to.
We do not sell your data and we do not pass it to third parties for marketing purposes.
Transfers outside the European Economic Area
Some of the providers above (for example Cloudflare, Google, Meta) may process data outside the EEA, including in the United States. In these cases we rely, as applicable, on the European Commission's adequacy decision on the EU–US Data Privacy Framework (for certified entities) or on standard contractual clauses (Art. 45–46 GDPR). You can request information about the safeguards applied by writing to us at the contact addresses.
Your rights
Under the GDPR, you have the right:
of access to your data (Art. 15);
to rectification of inaccurate or incomplete data (Art. 16);
to erasure, the “right to be forgotten” (Art. 17);
to restriction of processing (Art. 18);
to data portability (Art. 20);
to object, in particular to processing based on legitimate interest (Art. 21);
to withdraw your consent at any time, where processing is based on it, without affecting the lawfulness of the processing carried out before (Art. 7(3));
not to be subject to a decision based solely on automated processing (Art. 22).
To exercise your rights, write to us atand, or at our registered office, or call+40 729 370 390. We reply without undue delay and, in any case, within one month of receiving the request; this period may be extended by up to two months for complex requests, in which case we will inform you. Exercising your rights is free of charge. We may ask for additional information to confirm your identity.
Complaints and the supervisory authority
If you are dissatisfied with how we handle your data, please contact us first so that we can resolve the issue. However, you always have the right to lodge a complaint with the supervisory authority and to apply to the competent court:
Authority
National Supervisory Authority for Personal Data Processing (ANSPDCP)
Address
Bd. G-ral Gheorghe Magheru no. 28–30, Sector 1, postal code 010336, Bucharest
We take reasonable technical and organizational measures to protect data: an encrypted connection (HTTPS) between your browser and the website, access to data limited to the people who need it, and the use of providers with recognized security measures. If a data security breach affects you, we will notify the authority and, when the law requires, you as well (Art. 33–34 GDPR).
Data processed for our clients
When we manage Meta Ads campaigns or carry out filming on behalf of a client, we may process personal data (for example leads generated by ads, audiences, people appearing in footage) on the client's behalf. In this situation the client is the controller and we act as the processor, on the client's instructions and under a data processing agreement (Art. 28 GDPR), which we make available on request. Data subjects' requests regarding this data should be addressed to the client.
Minors
Our website and services are aimed at people acting in a professional capacity and at adults. We do not knowingly collect data from persons under 16. If you have found out that a minor has sent us data, write to us and we will delete it.
Links to other websites
The website contains links to portfolio projects and to third-party services (for example WhatsApp). We do not control those sites and are not responsible for their privacy policies; please read them separately.
Changes to this policy
We update this policy when the way we process data or the applicable law changes. The current version is the one published on this page, with the date of the last update shown above (28 October 2026).
Legal basis
Regulation (EU) 2016/679 (GDPR);
Law No. 190/2018 on measures implementing the GDPR;
Law No. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector (transposing Directive 2002/58/EC);