Controller and privacy contact
ANANKE LABS S.R.L., CUI 52645743, with registered office at STR PITAR MOȘ, NR.27, ET.5, AP.17, Bucharest, Romania, is the controller for the processing described in this notice.
For privacy questions or GDPR rights requests, email security@anankeos.com with enough information for us to identify the request.
Who this notice covers
This notice covers representatives, employees, and other professional contacts of organisations that use the website or discuss a potential or active B2B engagement with us. The website does not offer consumer services or conclude consumer contracts online.
Personal data we process
The website has no contact form. If you send an email, we may process your name, business contact details, role, organisation, message, attachments, and the subsequent conversation. If an engagement proceeds, we may also process contract, billing, project-contact, delivery, and professional correspondence data.
Website hosting, delivery, and security providers may process limited technical data such as IP address, request time, browser and device information, requested page, and security events to deliver and protect the website.
Do not send passwords, full payment-card data, authentication secrets, special-category data, or client evidence through ordinary email. A suitable secure channel will be agreed when sensitive engagement material is needed.
Purposes and legal bases
We use B2B enquiry data to answer your request and take steps you ask us to take before a contract. The usual basis is Article 6(1)(b) GDPR.
We use relevant data to deliver and manage an agreed service under Article 6(1)(b), meet legal, tax, and accounting duties under Article 6(1)(c), and pursue proportionate interests such as protecting systems, preventing abuse, maintaining continuity, recording material decisions, and establishing or defending legal claims under Article 6(1)(f).
We use consent only where it is specifically requested and appropriate, for example for a future optional marketing or analytics activity. Consent can be withdrawn without affecting earlier lawful processing.
Sources and whether data is required
Most data comes directly from you or your organisation. Professional contact data may also come from a colleague, referral partner, existing business relationship, or public professional source. Where Article 14 GDPR applies, we will provide the required information unless a lawful exception applies.
A name, business contact address, and enough context to understand an enquiry are normally necessary to respond or prepare a proposal. Additional information is optional unless it becomes necessary for a contract or legal obligation.
Recipients and transfers
Data is available only on a need-to-know basis to providers supporting website hosting, delivery, security, email, accounting, administration, legal advice, and approved subcontracting, or to public authorities where the law requires it. We do not sell personal data or use it for cross-site advertising.
Some technical providers may process limited data outside the European Economic Area. Where the GDPR requires it, Ananke Labs uses a valid transfer mechanism and appropriate safeguards. You can request information about the relevant safeguards by email.
Retention
Correspondence that does not become a client engagement is normally reviewed and deleted or anonymised within 12 months after the last meaningful contact, unless it remains needed for an active opportunity, security, a legal duty, or a potential claim.
If an engagement begins, relevant commercial, contractual, project, financial, and correspondence records are kept for the relationship and for periods required by contract, tax and accounting law, limitation rules, professional responsibilities, or other applicable duties. Technical logs follow provider operational schedules and are retained only as needed for security, reliability, investigation, and legal obligations.
Your rights
Subject to the GDPR and applicable conditions, you may request access, rectification, erasure, restriction, or portability, and may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it.
We normally respond within one month, although the GDPR permits an extension for complex or numerous requests. You may also complain to the Romanian supervisory authority, ANSPDCP.
Security and automated decisions
We limit access, use controlled business systems, minimise the data requested, and agree secure transfer and evidence-handling arrangements for engagements. No transmission or storage method can be represented as risk-free.
We do not use the website or B2B enquiry email to make decisions with legal or similarly significant effects through automated processing. Sending an enquiry does not place you in an automated marketing sequence.