Privacy notice
Last updated: 16 October 2026
We keep personal information limited to what is needed to respond to enquiries, run this website and deliver our services. This notice explains how that works under the GDPR and applicable Romanian law, including Laws no. 190/2018 and no. 506/2004.
1. Who we are
DUMAREX CONSULTING FORUM SRL, trading as Dumarex, is the controller for this website and our own business communications. CUI: 18710744. Registered office: Str. Preot Sebe Costin nr. 21M, Dudu, comuna Chiajna, 077040, Ilfov, Romania.
For privacy questions or requests, email [email protected] or write to our registered office. For general enquiries, use our contact form or [email protected].
2. Information we use
Enquiries. We receive your name, email address, optional phone number and the information you include in your message. We use these details to reply, discuss potential work and send an acknowledgement. Name, email and a message are required by the form; a phone number is optional. Without suitable contact details, we may be unable to respond. Please avoid including sensitive personal information or unnecessary details about other people.
Our legal basis is taking steps at your request before entering a contract where you are the prospective contracting party (Article 6(1)(b) GDPR). For company representatives and general enquiries, we rely on our legitimate interest in responding to correspondence and managing business relationships (Article 6(1)(f)). Sending an enquiry does not subscribe you to marketing.
Website security. Cloudflare processes technical information such as IP addresses, browser and device signals, request details and security events to deliver and protect the website. Opening the contact panel loads Cloudflare Turnstile to help prevent automated abuse. Our basis is our legitimate interest in maintaining a reliable, secure website (Article 6(1)(f)).
Business records. If we work together, we use necessary contact, contractual and billing details to manage the engagement, meet accounting and tax obligations and, where necessary, handle legal claims. The bases are contract performance, legitimate interests in business administration and legal claims, and compliance with applicable legal obligations (Articles 6(1)(b), (f) and (c)).
We normally obtain information directly from you. Where a client or colleague provides your professional contact details, we use them only for the relevant business relationship and provide any additional information required by Article 14 GDPR.
3. Service providers and disclosures
The website and enquiry workflow use Cloudflare for hosting, security and email forwarding; Resend (Plus Five Five, Inc.) for message delivery and acknowledgements; and Google Gmail for receiving and managing correspondence. Relevant information passes through these services as needed to operate the website and respond to you. Access within Dumarex is limited to authorised people who need it.
We do not sell personal data, share enquiries for third-party marketing or automatically submit enquiry messages to AI services. Necessary business records may be disclosed to professional advisers or competent authorities where required for the relevant purpose or by law.
4. International processing
We work primarily from Romania and the EU. Our providers operate internationally and may process information outside the European Economic Area, including in the United States. Resend’s Ireland sending region does not mean all message content and records are stored exclusively in the EU.
Applicable provider arrangements may include European Commission adequacy decisions or standard contractual clauses for international transfers, depending on the recipient and service. Details are available in Cloudflare’s data processing terms, Resend’s data processing terms and Google’s privacy policy. You may contact us for information about the transfer arrangements relevant to your data and copies of applicable safeguards, subject to necessary redactions.
5. How long we keep data
For enquiries that do not become projects, we delete correspondence and associated contact details under our control within 30 days after the last substantive exchange, including copies in our mailbox and trash. This is a manually administered retention rule.
Resend states that email and log data is retained for 30 days on its standard Free, Pro and Scale plans. Technical security records and restricted backup copies follow the relevant provider’s retention and deletion arrangements; the mailbox rule does not mean every provider record expires on the same date.
If an enquiry becomes a project, we retain relevant information as needed to deliver the engagement and meet contractual or statutory obligations. Accounting, tax, privacy-request and dispute records are retained for the applicable legal period or as long as necessary for the specific documented purpose. We limit access to information retained under an exception.
6. Cookies and similar technologies
We do not use advertising or analytics cookies, audience tracking, or browser storage to save enquiry details. Fonts and visual assets are hosted with the website. Our own site code does not set cookies.
Cloudflare provides security and anti-spam services, including Turnstile when the contact panel is opened. Turnstile pre-clearance is disabled in our current configuration. Cloudflare may use strictly necessary security cookies or similar mechanisms when required to protect the service. We do not activate optional tracking without first providing any legally required information and consent controls.
7. Client engagements
Our usual delivery model is to work directly on client-managed hardware and within client-managed accounts and infrastructure. Project information remains in that environment; we do not routinely copy it into separate Dumarex systems or introduce additional providers to process it.
Where the work involves access to personal data on a client’s behalf, the relevant role, instructions, confidentiality, security, assistance and deletion or return obligations are governed by the engagement and applicable data processing agreement. Client-controlled data requests should normally be directed to that client. Any exception involving another system or provider requires the applicable client authorisation and contractual safeguards. The providers used for this website are separate from this client-work model.
8. Security and your rights
We apply proportionate technical and organisational safeguards, including restricted access, confidentiality obligations, account protection and incident handling. Requirements for work in client environments follow the applicable client policies and engagement.
Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability of your data. You may object to processing based on legitimate interests on grounds relating to your situation. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We do not make solely automated decisions with legal or similarly significant effects.
Contact [email protected] to exercise your rights. We normally respond within one month. If a permitted extension is necessary, we explain it within that month; the extension may be up to two further months. Requests are normally free, subject to GDPR exceptions, and any identity checks are proportionate.
You may complain to ANSPDCP, the Romanian data protection authority, or the competent supervisory authority in your EU Member State of habitual residence, workplace or alleged infringement. You may also seek a judicial remedy. You do not have to contact us first.
9. Updates
We update this notice when our practices or relevant requirements change and show the revision date above. Our services are directed to business users and are not intended for children.