Legal information
Privacy Policy
Last updated: April 29, 2026
1. Data controller
LIGHTSUN STUDIO SRL, registered office at Str. Orizontului, no. 9, Apahida, Cluj County, Romania, registered with the Trade Registry under no. J2022001858125, tax ID 45943577, is the controller of personal data collected through this site, within the meaning of Regulation (EU) 2016/679 (GDPR). Contact: studio@lightsun.ro, phone +40 721 533 805.
2. Definitions
"Personal data" means any information that identifies you or makes you identifiable. "Controller" is us, Lightsun Studio SRL. "Data subject" is you, the person whose data is processed. "Processing" means any operation performed on the data (collection, storage, consultation, erasure, etc.). "Photographed subject" means the person appearing in the images, where identifiable.
3. Categories of data we collect
Contact form data: name, company, email, phone, service type, package of interest, target timing, your message. Technical data (on form submission): IP address and User-Agent (the browser used), for anti-spam protection. Browsing data (only if you accepted the "analytics" category in the banner): pages visited, source, time on page, device type, browser, in aggregated and pseudonymised form via Google Analytics 4 with IP anonymisation. Image data: if you are a photographed subject in a project contracted by a client, your image is a special category. Lightsun Studio processes these images as a processor or joint controller, based on your consent obtained by the client. We do not voluntarily collect sensitive data within the meaning of art. 9 GDPR (origin, political opinions, religion, health, etc.).
4. Purposes of processing
(a) Responding to your quote request and any subsequent commercial communication (contact form). (b) Preparing, concluding, and performing contracts with clients (invoicing data, order tracking, image delivery). (c) Complying with legal obligations: accounting (Accounting Law), tax (Fiscal Code), commercial archiving (National Archives Law). (d) Defence against claims and dispute management (legitimate interest). (e) Improving the site through aggregated statistics (only with your explicit consent).
5. Legal basis
For contact form and contract performance: art. 6(1)(b) GDPR (pre-contractual measures and contract performance). For legal obligations (accounting, tax): art. 6(1)(c) GDPR. For defence against claims: art. 6(1)(f) GDPR (legitimate interest). For analytics and marketing: art. 6(1)(a) GDPR (your explicit consent, withdrawable at any time). For images of photographed subjects: art. 6(1)(a) GDPR (the subject's consent), obtained as a rule by the client contracting the session.
6. Recipients of the data
Data is accessible only to authorised people in the Lightsun team. We share it, strictly as needed, with: the web hosting provider (Romarg, run by Romarg SRL, Romania) for site delivery and contact email transmission; Google Ireland Limited (Google Analytics 4), only if you accepted the "analytics" category; the external accountant, for tax compliance (invoicing data); public authorities, only on a written legal request (Romanian tax authority, courts, supervisory bodies). We do not sell, rent, or share data for third-party marketing.
7. International transfers (outside the EU/EEA)
Google Analytics 4 may transfer data to the United States. Google operates under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and applies Standard Contractual Clauses (SCCs) for transfers made outside that framework. At the time of publishing this policy, the Google Analytics integration is not active on the site; this section will be updated if that changes. Otherwise, we do not perform international transfers.
8. Retention periods
Contact form data, pre-contract conversations: 24 months after the last communication, then deleted or anonymised. Contractual data of active clients (invoices, contracts, associated deliverables): 10 years from the end of the financial year, per Romanian Accounting Law no. 82/1991. Original images of photographed subjects: minimum 12 months after delivery for follow-up work; afterwards, offline archiving or deletion. Aggregated analytics data (Google Analytics): per the GA4 default of 14 months. Technical logs from contact.php (IP, UA, timestamp): 30 days for anti-spam purposes.
9. Your GDPR rights
You have the right to: information and access to your data (art. 15), rectification of inaccurate data (art. 16), erasure ("right to be forgotten", art. 17), restriction of processing (art. 18), data portability in a structured format (art. 20), objection to processing based on legitimate interest (art. 21), not to be subject to a solely automated decision with legal effect (art. 22, we do not use profiling). If processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
10. How to exercise these rights
Send us a request at studio@lightsun.ro stating clearly which right you wish to exercise and, where relevant, the context (e.g., what data you want corrected). We may ask for identity verification if there is doubt, so we don't hand data to the wrong person. We respond within 30 days of receiving the request (extendable by another 60 days for complex requests, with notice to you). Exercising rights is free; only manifestly unfounded or excessive (repetitive) requests may be charged.
11. Data security
We apply reasonable technical and organisational measures to protect data: HTTPS for form submissions, restricted access to the inbox and storage systems, strong passwords and two-factor authentication where possible, regular backups. No system is 100% secure; if a security incident affects your data, we notify you in line with art. 33-34 GDPR.
12. Cookies and similar technologies
We use essential cookies and, with your consent, analytics cookies. Full details about each cookie (name, purpose, duration) and how to manage your consent are in the Cookie Policy at /cookies.
13. Minors
Our services are not intended for minors under 16, and we do not voluntarily collect personal data from them through the form. If you are a parent or guardian and believe a minor has provided us data, contact us at studio@lightsun.ro for immediate deletion. For photographs involving minors in a professional context (for example events with minor attendees), consent belongs to the parent or legal guardian and is obtained by the client contracting the project.
14. Changes to this policy
We may update this policy as the site, our services, or the legal framework evolve. The applicable version is the one displayed on the site at the time of processing. For significant changes affecting your rights, we will notify you proactively (email or site notice).
15. Complaints and supervisory authority
If you have questions or concerns about how we process your data, please contact us first at studio@lightsun.ro. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru, no. 28-30, sector 1, Bucharest, phone +40 318 059 211, email anspdcp@dataprotection.ro, web dataprotection.ro.
Next step
Let's talk about your project and build a clear plan.
We answer quote requests within 24 business hours with a recommended package, deliverables, and timeline.