Privacy Policy

1. Controller

The controller responsible for processing personal data on this website is Mihail Carbune, owner of the sole proprietorship Mihail Carbune Digital Solutions, St.-Georgen Str. 45, 75175 Pforzheim, Germany. Contact for privacy matters: support@carbunedigital.com.

2. About This Website

carbunedigital.com is the official website of Carbune Digital Solutions. It presents the company, its services and portfolio, and provides a project request form through which prospective clients can submit inquiries. This website does not offer user accounts, e-commerce transactions or subscription services.

3. Information We Collect

3.1 Project Request Form

When you submit a project request through the form on this website, we collect and store the following categories of information:

• Contact information: name, email address, phone number (optional), company name (optional)
• Selected website service
• Project requirements: project goal, business description, required pages or functionality, language requirements
• Budget and timeframe information (optional)
• Current website URL (optional)
• Additional notes in free-text fields (optional)
• Submitted language/locale
• Submission timestamp
• Internal database identifier (UUID)
• Public request reference (CDR-XXXXXXXXXXXX format, shown to you after submission)
• Technical idempotency identifier (used to prevent duplicate submissions)
• Request processing status
• Email delivery and provider message status information

3.2 Technical and Server Data

Standard server and infrastructure logs may be processed by our hosting provider. This may include:

• IP address
• Browser type and version
• Pages visited and time of visit
• Referring URL

4. Purposes and Legal Bases

We process your information for the following purposes and on the following legal bases:

• Receiving and administering your project inquiry — Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract)
• Evaluating whether and how we can provide the requested service — Article 6(1)(b) GDPR
• Communicating with you about your inquiry — Article 6(1)(b) GDPR
• Sending transactional confirmation and internal notification emails — Article 6(1)(b) GDPR
• Preventing duplicate submissions and abuse — Article 6(1)(f) GDPR (legitimate interest in secure and reliable operation)
• Documenting pre-contractual communication — Article 6(1)(f) GDPR
• Complying with statutory retention obligations where applicable — Article 6(1)(c) GDPR

5. We Do Not Sell Your Data

Your personal data is never sold to third parties. The information you submit is not used for advertising, profiling or marketing purposes. It is used solely to process and respond to your project inquiry.

6. Processors and Recipients

We use the following service providers to operate this website and process project requests: Supabase (database and storage infrastructure) — project request data is stored in a Supabase-managed database. The primary database region is Frankfurt, Germany (EU). Supabase acts as a data processor under a Data Processing Agreement pursuant to Article 28 GDPR. Supabase may use authorised subprocessors in accordance with that DPA. Resend (transactional email delivery) — we use Resend to send confirmation emails to you and internal notification emails to our team. Resend acts as a data processor under its contractually incorporated DPA. Resend's primary processing operations take place in the United States. Open Tracking and Click Tracking are disabled. Email transport is configured with Enforced TLS. Our hosting and infrastructure providers may process standard server log data as part of normal operations. We do not sell project-request data or disclose it to unrelated third parties. Access within Carbune Digital is limited to what is necessary to process the inquiry. Authorised processors and subprocessors may process data only as required to provide their contracted services.

7. International Transfers

The primary Supabase database region is Frankfurt, Germany (EU). Authorised subprocessors may process data outside the EEA where necessary; the applicable Data Processing Agreement provides the required contractual transfer safeguards. Resend primarily processes transactional email data in the United States. This transfer is covered by the EU–US Data Privacy Framework and, where applicable, EU Standard Contractual Clauses, as described in Resend's DPA. For questions about the applicable safeguards or to request further information, contact us at support@carbunedigital.com.

8. Cookies and Tracking

This website does not currently use analytics tools, advertising scripts, tracking pixels, social media embeds or non-essential cookies. No consent banner is required at this time. If technically necessary storage is used (for example, by the infrastructure or framework), it is limited to what is required for the website to function. We will update this policy if any consent-requiring technology is added in the future.

9. Data Retention

Project inquiries that are rejected or become inactive are deleted or anonymised no later than six months after the last substantive communication, unless continued retention is required for legal claims or another legal obligation. For accepted projects, relevant information may be transferred into the contractual project record and retained according to contractual and statutory requirements. Provider logs and transactional email delivery metadata are retained according to the applicable provider configuration and justified operational requirements. Deletion of individual records is performed manually by Carbune Digital in accordance with this policy. No automatic deletion mechanism currently exists.

10. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — you may request a copy of the personal data we hold about you
• Right to rectification — you may request correction of inaccurate data
• Right to erasure — you may request deletion of your data, subject to legal retention obligations
• Right to restriction of processing — you may request that we restrict processing in certain circumstances
• Right to object — you may object to processing based on legitimate interests
• Right to data portability — where applicable, you may request your data in a structured, machine-readable format
• Right to lodge a complaint with the competent supervisory authority — the supervisory authority for Baden-Württemberg is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW)

To exercise any of these rights, contact us at support@carbunedigital.com.

11. No Automated Decisions

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects. Submitting a project request does not automatically result in project acceptance, contract conclusion or price generation. All decisions are made manually by Carbune Digital.

12. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in our practices or applicable law. The updated version will be published on this page with a revised date.

13. Contact

For any privacy-related questions, rights requests or complaints, contact Carbune Digital Solutions at: support@carbunedigital.com