Privacy Policy
Strict data governance adhering to the European Union General Data Protection Regulation (Regulation (EU) 2016/679).
Confidentiality by Architecture
Cristian Văduva processes personal data strictly in accordance with principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, and confidentiality under Regulation (EU) 2016/679.
1. Data Controller Identity & Contact
The data controller responsible for the processing of personal data on this platform is:
2. Categories of Data, Purposes & Legal Bases
| Processing Activity | Data Categories | Purpose | GDPR Legal Basis |
|---|---|---|---|
| Direct Inquiries (Email / WhatsApp) | Name, email address, telephone number, inquiry context | Responding to strategic consultation and property advisory requests | Art. 6(1)(b) — Pre-contractual steps & Art. 6(1)(f) Legitimate Interests |
| Specialized Questionnaires (Jotform) | Property specifications, investment criteria, contact details | Structuring tailored acquisition dossiers and asset protection assessments | Art. 6(1)(a) — Explicit Consent & Art. 6(1)(b) Pre-contractual steps |
| Technical Server Logs | IP address, browser user-agent, timestamp, requested URI | Network security, DDoS defense, server stability | Art. 6(1)(f) — Legitimate Interests in infrastructure security |
| Local Preferences Storage | Cookie consent status, motion preference | Remembering user choices across browser sessions | Art. 6(1)(c) — Legal compliance (ePrivacy / GDPR consent proof) |
3. Recipients & Third-Party Processors
We do not sell, rent, or trade personal data. Data is processed only by necessary service providers under strict confidentiality:
- Hosting & Infrastructure: Vercel / Cloudflare hosting platforms operating under Standard Contractual Clauses (SCCs).
- Video Media Delivery: Google YouTube (privacy-enhanced embed configuration).
- Form Processing: Jotform Inc. (EU data residency where configured for structured questionnaires).
- Direct Messaging: WhatsApp (Meta Platforms) and Telegram for user-initiated confidential messaging.
4. Data Retention Period
Inquiry communications are retained only for the duration required to handle the engagement or mandate. Pre-contractual consultations that do not lead to an active engagement are deleted within 24 months, unless longer retention is required by statutory European tax or commercial compliance regulations.
5. User Rights Under GDPR
Under GDPR Articles 15–22, you possess the right to access, rectify, erase (right to be forgotten), restrict, or object to the processing of your data, as well as the right to data portability.
For detailed instructions on submitting a data subject request, consult our dedicated GDPR Rights Guide or email cristianvaduva@duck.com.
Competent Supervisory Authority
If you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with a supervisory authority. In Romania, the national supervisory authority is: