Green gradient background
Back to Home

Privacy Policy

Last updated: 8 October 2026

Who we are

Clean Code Culture SRL ("we", "us") is the controller of the personal data described below. We are a software company based in Bucharest, Romania, founded in 2023.

This policy covers this website. It does not cover the software we build for clients — in those projects the client is normally the controller and we act as a processor under a separate data processing agreement.

What we collect, why, and on what legal basis

When you send us a message

The contact form collects your first and last name, email address, phone number, company name, industry and your message. The guide request form collects your name, email address and phone number. We use this to answer you and, if it goes that way, to prepare a quote.

Legal basis: your consent, given with the checkbox on the form (art. 6(1)(a) GDPR). We store the moment you gave it, because art. 7(1) requires us to be able to demonstrate it. Where your enquiry turns into a proposal, we also rely on steps taken at your request before entering into a contract (art. 6(1)(b) GDPR).

Submissions arrive as email in our company mailbox. There is no CRM behind this site, no automated scoring, and no newsletter list — we do not add you to a mailing list, because we do not have one.

When you book a call or sign up for training

The "book a consultation" buttons take you to Calendly, and the training sign-up takes you to curs.cleancodeculture.com. Those are separate platforms with their own forms and their own privacy notices. What you type there is collected there; we receive the resulting booking or registration.

When you just read the site

Our host records technical request data (IP address, user agent, requested URL, timestamp, response status) in server logs, for availability and security. Those logs exist whether or not you accept analytics.

Legal basis: our legitimate interest in keeping the site up and defending it against abuse (art. 6(1)(f) GDPR).

Analytics — only if you say yes

We would like to measure traffic with Google Analytics 4 (property G-886FF53BTW) and Vercel Analytics, to see which pages are read and which are not. Both are loaded only after you accept in the consent banner. Until then no analytics script runs and no measurement request leaves your browser.

Legal basis: your consent (art. 6(1)(a) GDPR and art. 4(5) of Romanian Law 506/2004, which requires consent before anything non-essential is stored on your device).

You can change your mind at any time — withdrawing is as easy as giving (art. 7(3) GDPR):

The full list of what is set, and the one entry we store before you decide anything, is in our Cookie Policy.

Who else sees your data

We do not sell personal data and we do not share it for advertising. These are the processors actually involved in running this site:

  • Vercel Inc. — hosting and content delivery, and Vercel Analytics (the latter only with your consent).
  • Google Ireland Ltd. / Google LLC — Google Analytics 4, only with your consent.
  • Google Workspace (Gmail) — delivery and storage of the email that your form submission becomes.
  • Calendly LLC — scheduling, if you book a call.

We may also disclose data where the law requires it, or to our accountants and lawyers under a duty of confidentiality.

Transfers outside the EEA

Vercel, Google and Calendly are US-headquartered. Where personal data reaches the United States, the transfer relies on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, as set out in each provider's terms. You can ask us for details.

How long we keep it

  • Form submissions (email): for as long as the conversation is live, and up to 3 years after our last contact, so we can pick a discussion back up. Then deleted.
  • Signed contracts and invoices: for the periods Romanian accounting and tax law requires, which override any deletion request.
  • Analytics: no longer than 14 months, the maximum retention a standard Google Analytics 4 property allows.
  • Your consent choice: stored in your own browser until you clear it or change it.
  • Server logs: kept by our host for a short technical period, then rotated out.

Artificial intelligence

We build AI systems for a living, so it is fair to be explicit about where AI is and is not involved here.

  • No AI talks to you on this site. There is no chatbot, no assistant and no AI system that interacts with visitors — so there is nothing that could be mistaken for a human.
  • No automated decisions about you. Nothing on this site profiles, scores, ranks or filters you. Your form goes to a person's inbox and a person replies. There is no automated decision-making in the sense of art. 22 GDPR.
  • Some images are AI-generated. Parts of the illustration and background imagery on this site were produced with generative AI tools. No image on this site depicts a real, identifiable person doing or saying something they did not do or say.
  • The articles are written and reviewed by people. Where an AI tool assisted with drafting, a named human reviewed the result and is responsible for it.
  • We do not use what you send us to train AI models. Your enquiry is not fed into model training, ours or anyone else's.

Case studies on this site describe AI systems we built for clients — for example tools that read legal or regulatory documents. Those descriptions are portfolio material. Nothing on this website is legal, tax or financial advice.

Security

The site is served over HTTPS. Form credentials and API keys live in environment variables, never in the code we ship. Access to the mailbox that receives form submissions is limited to the people who need it and protected by two-factor authentication. No transmission over the internet is ever perfectly secure, and we do not claim otherwise.

Your rights

Under the GDPR you can ask us to:

  • tell you what we hold about you, and give you a copy (art. 15);
  • correct anything inaccurate (art. 16);
  • delete it (art. 17);
  • restrict how we use it (art. 18);
  • hand it to you or another controller in a portable format (art. 20);
  • stop processing based on legitimate interest (art. 21);
  • withdraw a consent you gave, at any time, without it costing you anything (art. 7(3)).

Write to hello@cleancodeculture.com and we will answer within one month. If you are not satisfied, you can complain to the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro, or to the authority in your own country.

Children

This is a business-to-business website and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us something, tell us and we will delete it.

Changes to this policy

When our stack changes, this page changes with it, and the "last updated" date at the top moves. If a change materially affects you, we will say so here rather than bury it.

Contact us