Privacy Policy
FormaRoman Group is responsible for the personal data it receives through this website. This policy covers visitors, people who send an enquiry, clients and people who pay an invoice.
Who is responsible for your data
FormaRoman Group, Bulevardul Unirii 45, Bucharest 030827, Romania, decides why and how personal data from this website is used. This policy covers the website, its forms and the work we do for a client. "We" means FormaRoman Group.
To ask about your data, write to info@company-formation-in-romania.com or to the Bucharest address above, or call +40 21 987 6543. Our data protection officer is reachable at the same email address. You can also use the contact page. The cookies this site sets are listed in the cookie policy.
What we collect, why, and on what basis
The forms take no card numbers and no file uploads. Please do not type card numbers into a message box.
| Where it comes from | What we receive | What we use it for | Basis |
|---|---|---|---|
| The enquiry forms on the contact page and the home page, including the Request button of a ready-made company | Your name and email, a phone number if you give one, the topic you choose, the ready-made reference if there is one, a company name if you give one, your message, and the link parameters of the page you came from | To read and answer your enquiry | Steps you ask for before a contract; our legitimate interest in answering business enquiries |
| The onboarding form | Your name, email, phone and country of residence; your reply language and channel; the planned company (form, name ideas, activity, planned share capital, number of shareholders and directors, whether a company will hold shares, whether a director will live in Romania); the services you tick and the kind of authorisation named; your timing; your confirmation that the funds are of lawful origin; your message | To prepare a reply on the routes open to you and the documents that will be needed | Steps you ask for before a contract; our legitimate interest; the legal rules that apply to company-formation services, behind the confirmation of funds |
| The payment form | Invoice number, your name, email, amount, currency and method (card or crypto) | To match the request to the invoice, reply to you and keep payment records. Once card or crypto payment is live, the payment provider's own page collects the payment details | Performing the contract the invoice belongs to; our legal duties for accounting records |
| Every form, added automatically | The details listed under "Context sent with every form" below | To tell real enquiries from spam and to answer with the right context | Our legitimate interest in answering enquiries and in telling spam from enquiries |
| Email you send us | Your email address, your name if you give it, and what you write | To reply and to keep the correspondence | Steps you ask for before a contract; our legitimate interest in answering business enquiries |
| Our work for a client, after the client instructs us | Identity and company documents, powers of attorney, forms the founders sign, and the data needed for filings with the trade register, ANAF and OSIM | To do the work instructed, to file under the client's power of attorney and to keep the records the law requires | Performing the contract; legal obligations that apply to company-formation services |
| Visits to the site, only after you accept analytics | Pages viewed, device and browser, approximate location and events such as a completed form; with Clarity, recordings and heatmaps of clicks, scrolling and page views, with typed values masked | To understand how the site is used and to fix what does not work | Your consent, given in the cookie banner and withdrawable there; the cookie policy lists the cookies |
| Every visit, with or without consent | The request details a web server receives (IP address, browser, page requested); a bot check on pages with a form; a counter of messages per IP address against floods; cookie-less visit counts | To keep the site working and secure, and to count visits without cookies | Our legitimate interest in running and securing the site |
Context sent with every form
Every form on this site (the enquiry forms, the onboarding form and the payment form) sends technical details of your visit with your message. They reach us in the notification email and fall into the groups below.
From your network connection
Your IP address; the city-level location derived from the IP address (country, region, city, postcode and coordinates), which is the network's location and not your device's; and your internet provider or network operator.
From your browser
Your browser and operating system (user agent); your browser language preferences and time zone; and your screen and window size.
How you reached the form
The page or search that led here; the form page, with its link parameters; and the pages viewed on this site before the message was sent (only the form page without analytics consent).
Time and connection
The time spent on the page and your local time; the protocol and encryption version of the connection; and the Cloudflare data centre that served it.
Only after you accept analytics
The sequence of pages viewed in the visit; the first source, first visit date and landing page; the visit number; and the analytics identifier set by Google Analytics. Without consent, none of it is collected.
Cookies and your device
Whether cookies are enabled, yes or no, and whether you have accepted analytics. Cookie contents are never sent. The collector sets no cookie and writes nothing to your device before you accept analytics.
Why we collect it
To tell real enquiries from spam and answer with the right context, including the result of the spam check. The basis is our legitimate interest in answering enquiries and in telling spam from them.
How long we keep it
We keep the context with the enquiry email and for as long as we keep that email, 24 months if the enquiry leads to no engagement. The retention table below gives the other periods.
Who receives your data
Some of these recipients process data outside the European Economic Area, under their EU standard contractual clauses or the EU-US Data Privacy Framework.
| Recipient | What it does for us | What it receives, and when |
|---|---|---|
| Cloudflare | Hosts the site, runs the form handlers, holds the short-lived records listed under "How long we keep your data", checks that a sender is a person (Turnstile) and routes email sent to us | Every request to the site; each form submission as it passes through; the browser signals the bot check reads on pages with a form; email addressed to us |
| Resend | Sends the notification email of each form to our mailbox | The content of each submission, with the context listed under "Context sent with every form", on each submission |
| The provider that hosts our mailbox | Holds the mailbox that receives the notification emails and your emails | The notification emails and every email you send us |
| Telegram | Delivers a short notice of each form submission to our team | A short notice with the sender's name and email address, on each submission |
| Google Analytics | Measures how the site is used | Pages viewed, device and browser, approximate location, events such as a completed form, and an identifier kept in a cookie; the cookie and full measurement only after you accept analytics; before that, cookie-less signals in Google's Consent Mode (see the cookie policy) |
| Microsoft Clarity | Shows how visitors use pages, in recordings and heatmaps | Clicks, scrolling and page views, with typed values masked; only after you accept analytics (see the cookie policy) |
| Ahrefs Web Analytics | Counts visits without cookies | The page visited and basic browser and referrer details, with no cookie; on every visit |
| Google Maps | Shows the map on the contact page | Your IP address and browser details, and Google's own cookies; only when you press the map button (see the cookie policy) |
| Stripe | Takes card payments on its own page | The payer's name, email, amount and invoice number; card details are typed only on Stripe's page and never reach this site; only once card payment is live |
| NOWPayments | Takes crypto payments on its own page | The payer's name, email, amount and invoice number; only once crypto payment is live |
| The authorities and advisers a client's matter involves: the trade register, ANAF, OSIM, EUIPO, a Romanian lawyer where bespoke legal drafting is needed, and translators | File, draft or translate for the client | The data in the filing or the document; only on the client's instruction |
How long we keep your data
Each record has its own period. When a period ends, we delete the record unless a legal duty requires us to keep it longer.
| Record | Where it is held | How long |
|---|---|---|
| Enquiry emails, with the context listed under "Context sent with every form", and the notice of each form submission | Our mailbox and our team's Telegram chat | 24 months for an enquiry that leads to no engagement |
| A parked copy of an enquiry whose notification email could not be sent | Cloudflare KV store | 7 days |
| Message counters per IP address, against floods | Cloudflare KV store | 10 minutes, or 1 hour when the bot check runs on its alternative proof |
| A copy of an onboarding enquiry | Cloudflare KV store | 30 days |
| Payment requests, invoices and payment records | Our mailbox and our accounting records | As long as Romanian accounting law requires for invoices and accounting records |
| Client files: identity and company documents, powers of attorney, signed forms and filing data | Our client records | 5 years after the business relationship ends |
| Analytics events | Google Analytics | 14 months |
| Recordings and heatmaps | Microsoft Clarity | 13 months |
Your rights and how to use them
Under the General Data Protection Regulation, Regulation (EU) 2016/679, you have the rights below. Write to our data protection officer at info@company-formation-in-romania.com or to Bulevardul Unirii 45, Bucharest 030827, Romania. We may ask you to confirm who you are.
- See your data and receive a copy of it
- Have errors in your data corrected
- Have your data deleted where the law allows
- Restrict how we use your data while a question is settled
- Object to use that rests on our legitimate interest
- Receive the data you gave us in a portable form
- Withdraw your analytics consent at any time in the cookie settings, as the cookie policy explains
- Complain to a data protection authority: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP), or the one in your own country
Every change to this policy is dated at the top of this page.