Privacy Policy

The controller of personal data is Aurelian Ursulescu, an authorised holistic therapist, operating on the territory of Romania.

Contact: contact@aurelianursulescu.ro

Website: aurelianursulescu.ro

Depending on the services you access, we collect the following categories of data:

• Identification data: surname, first name
• Contact data: email address, telephone number
• Sensitive data (health): information you provide voluntarily about your state of health, symptoms and history, for the purpose of personalising the therapeutic services. This data is provided exclusively by you, freely and knowingly.
• Partial financial data: confirmation of payments processed through Stripe (we do not store card data)
• Technical data: IP address, browser type, pages visited — collected automatically through technical cookies

We do not collect data concerning racial or ethnic origin, political opinions, religious beliefs or biometric data.

We process your data on the following legal bases, in accordance with Regulation (EU) 2016/679 (GDPR):

• Art. 6(1)(b) — Performance of a contract: processing necessary to provide the booked services
• Art. 6(1)(a) — Consent: for sending the newsletter, promotional communications or using health data
• Art. 6(1)(c) — Legal obligation: retention of financial and accounting documents
• Art. 6(1)(f) — Legitimate interest: improving the website, security, fraud prevention
• Art. 9(2)(a) — Explicit consent: for health data, provided voluntarily by you in the therapeutic context

• Contact and session data: 3 years from the last interaction or until consent is withdrawn
• Financial data: 10 years, in accordance with Romanian tax legislation (Accounting Law no. 82/1991)
• Newsletter: until unsubscription
• Technical data (logs): a maximum of 12 months

Upon expiry of the periods above, the data is deleted or irreversibly anonymised.

We do not sell or transfer your personal data. We disclose it exclusively to:

• Stripe Inc. — online payment processor, with GDPR safeguards under the “Standard Contractual Clauses”
• Email service providers (e.g. newsletter) — under contractual data protection clauses
• Public authorities — exclusively when we are required to do so by law

All our partners process the data strictly for the purposes for which we transmitted it and may not use it for any other purpose.

In accordance with the GDPR, you benefit from the following rights, which you may exercise at any time:

• Right of access — to request a copy of the data we hold about you
• Right to rectification — to correct inaccurate or incomplete data
• Right to erasure (“right to be forgotten”) — to request the deletion of the data, within the limits of legal obligations
• Right to restriction of processing — in specific situations provided for by the GDPR
• Right to data portability — to receive the data in a structured, commonly used, machine-readable format
• Right to object — to processing based on legitimate interest or for direct marketing purposes
• Withdrawal of consent — at any time, without affecting the lawfulness of prior processing

Rights are exercised by means of a request sent to contact@aurelianursulescu.ro. We will respond within a maximum of 30 calendar days.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

The website uses:

• Strictly necessary cookies: the technical operation of the website (no consent required)
• Analytics cookies: understanding how the website is used (consent required)

You can manage or delete cookies from your browser settings.

We implement appropriate technical and organisational measures to protect the data against unauthorised access, disclosure, alteration or destruction. Data is transmitted exclusively over encrypted connections (HTTPS/SSL). Payments are processed exclusively through Stripe's secure infrastructure — we do not store and do not have access to card data.

In the event of a security incident affecting your rights and freedoms, we will notify you in accordance with our GDPR legal obligations.

Some service providers may be located outside the European Economic Area (e.g. the USA). Any such transfer is carried out exclusively with appropriate safeguards (standard contractual clauses approved by the European Commission or equivalent mechanisms), ensuring a level of protection comparable to that within the EU.

We reserve the right to update this policy. Any significant change will be communicated by posting the new version on the website, together with an update to the date in the document header. We recommend that you consult this page periodically.