Privacy Policy

Wisthera Agency operates under Tugulan Andreea PFA, Romania, CUI 48848553. For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Tugulan Andreea PFA is the data controller for personal data that we process for our own business purposes.

If you have any questions about this Privacy Policy or how we process your personal data, you can contact us at hello@wisthera.agency.

Depending on how you interact with Wisthera, we may collect the following categories of personal data.

We may use personal data for the following purposes:

• to respond to enquiries and communications;
• to provide information about Wisthera and our services;
• to schedule and manage consultations and meetings;
• to prepare proposals, quotations and agreements;
• to provide our services;
• to communicate with existing and prospective clients;
• to manage client relationships;
• to administer projects and deliverables;
• to issue invoices and maintain accounting and financial records;
• to administer and improve our website;
• to understand how visitors use our website;
• to measure and improve website performance;
• to improve our services, content and user experience;
• to maintain website and information security;
• to detect and prevent fraud, abuse or other unlawful activity;
• to comply with legal and regulatory obligations;
• to establish, exercise or defend legal claims; and
• where permitted by law, to communicate information about our services that may be relevant to you.

We will not use your personal data for purposes that are incompatible with the purposes described in this Privacy Policy without providing appropriate information and, where required, obtaining your consent.

We process personal data only where a valid legal basis under the GDPR applies. Depending on the circumstances, the applicable legal basis may be:

We use Google Analytics, a web analytics service provided by Google, to understand how visitors interact with our website. Google Analytics may collect information such as:

• pages visited;
• interactions with the website;
• approximate geographic location;
• browser and device information;
• referral information;
• date and time of visits;
• information about website traffic; and
• other technical and usage information.

Depending on the configuration of our website and applicable law, Google Analytics may use cookies or similar technologies to collect this information.

We use Google Analytics primarily to:

• understand website traffic;
• measure website performance;
• understand how visitors navigate our website;
• identify areas for improvement; and
• improve the functionality, content and user experience of our website.

Where required by applicable law, we will obtain consent before using non-essential analytics cookies or similar technologies. Google may process information in accordance with its own privacy practices and terms. For further information about how Google processes personal data, please consult Google's privacy documentation.

Our website may use cookies and similar technologies. Cookies are small files or pieces of information that may be stored on your device when you visit a website. We may use cookies for purposes including:

• essential website functionality;
• security;
• remembering preferences;
• website analytics;
• measuring website performance;
• improving the user experience;
• conversion measurement; and
• where applicable, advertising and remarketing.

Some cookies are necessary for the website to function and cannot be disabled through our systems. Where consent is legally required for non-essential cookies or similar technologies, we will request your consent before using them.

You may also control or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.

As our website and services develop, we may introduce additional technologies or services that use cookies or similar technologies. Where appropriate, information about the specific cookies and technologies currently in use will be provided through our cookie consent mechanism or our separate Cookie Policy.

We use Calendly to allow visitors and prospective clients to schedule meetings with Wisthera. Calendly may be embedded directly into our website. When you use the Calendly scheduling functionality, Calendly may process information such as:

• your name;
• email address;
• meeting date and time;
• meeting type;
• information submitted through scheduling questions;
• information relating to your appointment; and
• technical information associated with your interaction with the scheduling service.

We use this information to schedule and manage meetings, communicate with you regarding the meeting and facilitate our business relationship.

Calendly is a third-party service provider and may process personal data in accordance with its own privacy policy and terms. When you interact directly with the Calendly interface, Calendly may independently process certain information about you. We recommend reviewing Calendly's privacy documentation for further information about its processing of personal data.

We use third-party services and providers to operate our website, manage our business and provide our services. Depending on the circumstances, these may include providers of:

• website hosting and infrastructure;
• analytics and website measurement;
• appointment scheduling;
• email and communications;
• cloud storage and productivity tools;
• customer relationship management systems;
• accounting and invoicing;
• payment processing;
• advertising and marketing technology;
• website security;
• website development and technical services; and
• other business administration services.

Our website currently uses services including Google Analytics and Calendly. As our business develops, we may introduce additional third-party services, including analytics, CRM, email marketing, advertising, scheduling or other business tools.

Where such providers process personal data on our behalf, we will take appropriate steps to ensure that the processing is governed by appropriate contractual and data protection safeguards. Some providers may process personal data as independent controllers rather than as processors. In those circumstances, the provider's own privacy policy may also apply.

As a marketing agency, Wisthera may receive, access or otherwise process personal data belonging to our clients or their customers when providing services. This may occur in connection with services such as:

• digital advertising;
• Google Ads;
• Meta advertising;
• TikTok advertising;
• analytics;
• conversion tracking;
• email marketing;
• website optimisation;
• SEO;
• customer journey analysis; and
• other marketing services.

Where we process personal data on behalf of a client and the client determines the purposes and means of that processing, Wisthera may act as a data processor rather than as an independent data controller. In such circumstances, we process personal data in accordance with the client's documented instructions and applicable contractual arrangements.

Where required by GDPR, the relationship between Wisthera and the client will be governed by appropriate data processing terms or a Data Processing Agreement ("DPA"). This Privacy Policy primarily concerns personal data for which Wisthera acts as a controller for its own business purposes.

We do not sell your personal data.

We may share personal data where reasonably necessary with:

• service providers and data processors supporting our business;
• professional advisers, including accountants, lawyers and consultants;
• payment, banking and financial service providers;
• technology and software providers;
• competent authorities, courts or law enforcement bodies where required by law;
• parties involved in legal proceedings where disclosure is necessary to establish, exercise or defend legal rights; or
• another party where you have specifically authorised or requested the disclosure.

We seek to limit disclosures to information that is reasonably necessary for the relevant purpose.

Some of the third-party providers we use may be located outside the European Economic Area ("EEA") or may process personal data from countries outside the EEA. Where personal data is transferred outside the EEA, we will take appropriate measures to ensure that the transfer is lawful under applicable data protection legislation. Depending on the circumstances, this may include reliance on:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses approved by the European Commission;
• another legally recognised transfer mechanism; or
• other appropriate safeguards permitted under applicable data protection law.

Third-party providers may have their own international data transfer arrangements and privacy practices.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. The appropriate retention period depends on the type of information and the reason for which it is processed. For example:

• enquiry and communication data may be retained for as long as reasonably necessary to respond to the enquiry and maintain appropriate business records;
• client information may be retained for the duration of the business relationship and thereafter for as long as necessary to comply with legal, accounting, tax or contractual obligations;
• information relating to legal claims may be retained for as long as necessary to establish, exercise or defend those claims; and
• marketing information may be retained until you unsubscribe or until it is no longer reasonably necessary for the relevant purpose.

When personal data is no longer required, we will delete it or securely anonymise it where reasonably practicable.

We take reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• alteration;
• loss;
• destruction; and
• other unlawful or unauthorised processing.

Depending on the circumstances, these measures may include access controls, authentication procedures, secure service providers, appropriate permissions and other administrative, technical and organisational safeguards. However, no method of transmission or storage over the internet can be guaranteed to be completely secure.

Subject to the conditions and limitations provided by applicable law, you may have the following rights.

To exercise your rights or ask questions about how we process your personal data, please contact hello@wisthera.agency.

Please provide sufficient information for us to understand your request and, where necessary, verify your identity. We will respond to your request in accordance with the requirements and applicable time limits under data protection law.

If you believe that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority. As Wisthera operates under Tugulan Andreea PFA in Romania, the relevant supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP), Romania.

You can find information about the authority and how to exercise your rights on its official website. You may also contact us first at hello@wisthera.agency, and we will make reasonable efforts to address your concern.

Our website may contain links, embedded content or functionality provided by third parties. These may include scheduling tools, social media platforms, analytics services, advertising platforms or other external services.

Third-party providers may collect or process information independently of Wisthera and may have their own privacy policies and terms. Wisthera is not responsible for the privacy practices, security or content of third-party websites and services that operate independently from us. We recommend reviewing the privacy policy of any third-party service before providing personal information or using its functionality.

Our website and services are intended primarily for businesses and professional users and are not directed at children. We do not knowingly collect personal data from children where such collection is not permitted by applicable law.

If you believe that a child has provided personal data to us, please contact us at hello@wisthera.agency so that we can assess the situation and, where appropriate, delete the information.

We may update this Privacy Policy from time to time to reflect changes in:

• our business;
• our services;
• our website;
• technology;
• third-party providers;
• legal or regulatory requirements; or
• the way we process personal data.

When we make changes, we will update the "Last updated" date at the beginning of this Privacy Policy. Where changes are material, we may provide additional notice where required by applicable law. We encourage you to review this Privacy Policy periodically.

If you have any questions, concerns or requests regarding this Privacy Policy or the way we process your personal data, please contact Wisthera Agency, operating under Tugulan Andreea PFA, Romania, CUI 48848553, at hello@wisthera.agency.