Privacy Policy

Last updated: November 6, 2025

1) Data Controller

This website is operated by CGX Consulting SRL (“CGX”, “we”, “us”).
Registered office: 20 Unirii Blvd., 040107 Bucharest, Romania
Trade Register No.: J2025076276001

CGX Consulting SRL is the Data Controller for personal data processed via this website under Regulation (EU) 2016/679 (GDPR).

Websites covered: This Privacy Policy applies to cgxconsulting.com.
The related domains cgxconsulting.ro and cgxc.ro are used solely for redirection to this main site and do not collect or process personal data.

2) What personal data we collect

We collect personal data only when you submit our contact form:

We do not sell, rent, or share your personal data for marketing purposes.

3) Purpose and legal basis

Purpose: to read and respond to your inquiry and, where applicable, to take steps at your request (e.g., discussing a potential engagement).

Legal basis: GDPR Art. 6(1)(a) — Consent (you tick the consent checkbox), and GDPR Art. 6(1)(b) — Pre-contractual steps (responding to your request).

You may withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal.

4) Processing by our form provider (Processor)

We use FormBackend to receive and manage form submissions. Under the terms and the Data Processing Addendum (DPA) incorporated by reference into FormBackend’s Agreement, CGX acts as Data Controller and FormBackend acts as Data Processor. Details are available on FormBackend’s GDPR / DPA page: https://www.formbackend.com/gdpr.

Form submissions are transmitted securely to FormBackend and stored/managed for our access. FormBackend lists certain sub‑processors (e.g., DigitalOcean, AWS/S3, Postmark, Cloudflare, CleanTalk, Stripe/Paddle, PostHog). Some sub‑processors are located in the United States. International transfers are handled under appropriate safeguards (e.g., Standard Contractual Clauses) as described in the DPA to ensure protection essentially equivalent to that required in the EEA.

5) Security

Our site uses HTTPS/TLS. FormBackend applies technical and organizational measures (secure transmission, access controls, incident response, breach notification) and anti‑spam filtering (via CleanTalk) to protect submissions.

6) Data retention

We retain messages only as long as necessary to respond and manage your inquiry. If our correspondence leads to a contract, related data may be retained for the duration of the engagement and for the applicable legal retention period (e.g., accounting/archival). Otherwise, we aim to delete routine contact submissions within 12 months.

7) Your rights (GDPR)

You have the right to access, rectification, erasure, restriction, portability, objection (where applicable), and to withdraw consent at any time.

You may also lodge a complaint with the supervisory authority: ANSPDCP — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (Romania).

To exercise your rights, contact us at contact@cgxconsulting.com. For submissions handled through FormBackend, you can also request deletion via the mechanism described on their GDPR page.

8) Cookies and trackers

This is a static website and we do not use our own analytics or marketing cookies.

Any functional cookies strictly necessary to deliver and protect the form (e.g., spam‑prevention mechanisms provided by our Processor) may be set when using the form; these are used only for security/anti‑spam.

9) Data recipients and confidentiality

Access to submissions is limited to authorized CGX personnel bound by confidentiality. We do not disclose personal data to other third parties unless legally required or strictly necessary to respond to your request (in which case you will be informed, where appropriate).

10) International transfers

Where our Processor or its sub‑processors store/process data outside the EEA (e.g., in the United States), such transfers are governed by appropriate safeguards as described in FormBackend’s DPA (e.g., Standard Contractual Clauses) to ensure a level of protection essentially equivalent to that required in the EEA.

11) Contact

Data Controller: CGX Consulting SRL
Email: contact@cgxconsulting.com

12) Updates

We may update this Privacy Policy to reflect legal, technical, or business changes. The "Last updated" date will be revised accordingly. Material changes will be highlighted where appropriate.

13) Cookie Policy

a) What are cookies

Cookies are small text files placed on your device by websites you visit. They are used to ensure proper technical operation and security of the website, and—where applicable—to analyse usage or personalize content.

b) What cookies we use

The cgxconsulting.com website uses only strictly necessary cookies that enable the secure and functional operation of the contact form. These cookies are set automatically when the form is used and may originate from our form service provider FormBackend and its integrated anti-spam system CleanTalk.

We do not use:

c) Purpose and retention

Essential cookies are used solely to:

Their lifetime is limited to the active browser session or, in some cases, up to 30 days (for CleanTalk anti-spam cookies).

d) Legal basis

Processing through essential cookies is based on the legitimate interest of the Controller (Article 6(1)(f) GDPR) to ensure the security and proper functioning of the website. No cookies requiring consent under Article 4(5) of the Romanian Law 506/2004 or Article 6(1)(a) GDPR are used.

e) Managing cookies

You can delete or block cookies at any time through your browser settings (Privacy / Security section). Disabling strictly necessary cookies may affect the proper operation of the contact form or other secure areas of the website.

f) Updates

This Cookie Policy may be updated periodically to reflect technical or legal changes. Any material updates will be indicated on this page, and the "Last updated" date will be revised accordingly.

© CGX Consulting — Strategic expertise for decisive impact