Legal · GDPR

Privacy Policy

What personal data DOIMIH DESIGN S.R.L. collects, why, who receives it and the rights you have under the GDPR. Last updated: 1 October 2026.

Your rights Cookies Policy

privacy.sh

$ collect --only what-is-needed
$ store --region eu-finland
$ trackers --require consent
$ sell --data
> refused
$ rights --gdpr all

This Privacy Policy explains how personal data is collected and used when you visit projects.doimih.net, contact us or buy a package from the shop. It is written to meet the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Romanian Law no. 190/2018.

1. Who is responsible for your data

The data controller is DOIMIH DESIGN S.R.L., operating the Doimih Code brand (also "we", "us").

Sole registration code (CUI): 27344782
Trade Register no.: J40/8350/2010
Address: Drumul Gura Putnei 137A, Bucharest, Romania
Email for any privacy request: support@doimih.net

We have not appointed a Data Protection Officer, as the law does not require one for an activity of this size. Every privacy question is handled directly at the address above.

2. What data we collect

2.1. When you browse the site

technical data sent by your browser: IP address, browser and operating system, the page requested, the referring page, date and time;
the cookies and similar technologies described in our Cookies Policy. Analytics and marketing cookies are only set after you agree to them.

2.2. When you fill in a form

Contact form and project estimate: name, business email, company or project name, phone number (optional), the service you need, estimated budget and your project description;
Support request: name, priority, incident date and the description of the issue;
for every form, the IP address and browser user agent at the time of sending, kept to prevent spam and abuse.

2.3. When you buy a package

name, email address, the package bought, the amount, the currency and the payment status, together with the Stripe payment reference;
after payment, the project brief you send through the onboarding form: name, the email used at checkout, the package, the project or company name, the app specifications and any design or reference link you choose to share.

Card details are entered directly on Stripe's secure payment page. We never see or store your card number.

3. Why we use your data and on what legal basis

Purpose	Data	Legal basis (GDPR)
Delivering the website, keeping it secure, preventing spam and abuse (incl. reCAPTCHA)	technical data, IP, user agent, necessary cookies	legitimate interest, Art. 6(1)(f)
Answering your message or support request and preparing an estimate	contact and form data	steps taken at your request before a contract, Art. 6(1)(b); otherwise legitimate interest, Art. 6(1)(f)
Selling packages, processing payments, delivering the project	order, payment and brief data	performance of a contract, Art. 6(1)(b)
Invoicing and keeping accounting records	order and payment data	legal obligation, Art. 6(1)(c)
Website statistics (Google Analytics)	analytics cookies, pseudonymous usage data	consent, Art. 6(1)(a)
Measuring LinkedIn campaigns (LinkedIn Insight Tag)	marketing cookies, pseudonymous usage data	consent, Art. 6(1)(a)
Establishing, exercising or defending legal claims	any data relevant to the dispute	legitimate interest, Art. 6(1)(f)

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. reCAPTCHA only estimates whether a form is sent by a person or a bot.

4. Who receives your data

We do not sell or rent personal data. We share it only with providers that help us run the site and the business, under contracts that require them to protect it:

Hosting provider – the server and database are located in a data centre in Helsinki, Finland (EU);
Email service – to send our replies and confirmations;
Stripe Payments Europe Ltd. (Ireland) – payment processing. Stripe also acts as an independent controller for payment and fraud-prevention data, under the Stripe Privacy Policy;
Google Ireland Ltd. – reCAPTCHA (spam protection), Google Fonts (the web fonts are loaded from Google's servers, which receive your IP address) and, only with your consent, Google Analytics. See the Google Privacy Policy;
LinkedIn Ireland Unlimited Company – only with your consent, the LinkedIn Insight Tag. See the LinkedIn Privacy Policy;
accountants, lawyers and public authorities, only when the law requires it or to defend a legal claim.

5. Transfers outside the European Economic Area

Our own server is in the EU. Google, LinkedIn and Stripe belong to groups based in the United States and may transfer data there. These companies are certified under the EU–US Data Privacy Framework, and also use the European Commission's Standard Contractual Clauses, which are the safeguards recognised by Art. 45 and Art. 46 GDPR. You can ask us for more information about these safeguards.

6. How long we keep your data

Contact and support messages: up to 2 years after our last exchange, unless they lead to a contract;
Project and onboarding data: for the duration of the contract and 3 years after it ends, the general limitation period under Romanian law;
Orders, payments and invoices: 10 years, as required by Romanian Accounting Law no. 82/1991;
Server logs: for a limited period, not longer than 90 days, unless needed to investigate a security incident;
Cookies: for the periods listed in the Cookies Policy.

When the period ends, data is deleted or anonymised.

7. Your rights

Under the GDPR you have the right to:

access your data and receive a copy (Art. 15);
have inaccurate data corrected (Art. 16);
have your data erased ("right to be forgotten", Art. 17);
restrict processing (Art. 18);
data portability – receive your data in a structured, machine-readable format (Art. 20);
object to processing based on legitimate interest, and at any time to direct marketing (Art. 21);
withdraw your consent at any time, without affecting processing done before the withdrawal. For cookies, use the fingerprint button in the bottom-left corner of any page or change your cookie settings here.

To exercise a right, write to support@doimih.net. We reply within one month; this can be extended by two more months for complex requests, in which case we will tell you why. We may ask you to confirm your identity first.

You also have the right to lodge a complaint with the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro, or with the authority in the EU country where you live or work.

8. Do you have to provide your data?

Browsing the site does not require you to give us any data. The fields marked as required in a form are needed to answer you or to deliver what you bought; without them we cannot process the request.

9. How we protect your data

All traffic is encrypted with HTTPS. Access to the administration area and the database is restricted and password-protected, forms are protected against spam and CSRF attacks, and payments are handled only by Stripe. Backups are kept on infrastructure we control.

10. Children

This site and our services are meant for businesses and adults. We do not knowingly collect data from children under 16.

11. Changes to this policy

We may update this policy when the site or the law changes. The date of the latest version is shown at the top of the page, and important changes will be announced on the site.