1. Who is responsible for your data
SC PROPOSITUM LABS SRL ("Propositum Labs", "we", "us") is the data controller for personal data described in this policy.
- Registered office:
Bucharest, Romania - Trade Register:
J2026050901009· Fiscal code:55463100 - Data protection contact: [hello@propositumlabs.com]
- Phone: +40750410620
We are established in Romania and process personal data in accordance with the EU General Data Protection Regulation (Regulation 2016/679) and Romanian Law 190/2018. Where we serve clients in the United Kingdom, we also comply with UK GDPR and the Data Protection Act 2018. Where we serve clients in Canada, we act consistently with PIPEDA and, where applicable, Quebec Law 25. Where we serve clients in California, we act consistently with the CCPA/CPRA.
We are not required to appoint a Data Protection Officer, but the contact above handles all privacy matters.
2. What we collect, why, and on what legal basis
2.1 When you book a call
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, company, website | To schedule and hold the call | Contract / pre-contractual steps (Art. 6(1)(b)) | 24 months from last contact |
| Your answers to booking questions | To assess whether we're a fit | Contract / pre-contractual steps | 24 months |
| Time zone, meeting time | To schedule correctly | Contract / pre-contractual steps | 24 months |
Booking is handled by Cal.com, which processes this data on our behalf. See section 5.
2.2 When you become a client
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Contact and billing details | To deliver the service and invoice you | Contract (Art. 6(1)(b)) | Duration of contract |
| Invoices and payment records | To meet accounting and tax obligations | Legal obligation (Art. 6(1)(c)) | As required by Romanian accounting and fiscal law - currently up to 10 years, to be confirmed with our accountant |
| Footage you supply | To produce your deliverables | Contract | Deleted 90 days after final delivery |
| Feedback and correspondence | To manage the project and resolve disputes | Legitimate interests (Art. 6(1)(f)) | 3 years after contract ends |
2.3 When you email us
Your name, email address, and message content, to respond to your enquiry. Legitimate interests. Retained 24 months.
2.4 When you visit our website
If you consent to analytics cookies: IP address (truncated where possible), device and browser type, pages viewed, referring source. Consent (Art. 6(1)(a)). Retained up to 14 months.
We do not set any analytics or advertising cookies unless you accept them. Essential cookies required for the site to function are set without consent, as permitted.
2.5 What we do NOT collect
We do not collect payment card details - payments are handled by our payment provider. We do not knowingly collect data from anyone under 18. We do not sell or rent personal data to anyone, ever.
3. People appearing in client footage - our role as processor
Our clients send us video footage. That footage often contains personal data belonging to third parties - their customers, patients, staff, or members of the public.
For that footage, our client is the data controller and Propositum Labs acts as a data processor under Article 28 GDPR.
In that role we:
- Process footage only on the documented instructions of our client
- Ensure everyone with access is bound by confidentiality
- Apply appropriate technical and organisational security measures
- Engage sub-processors (see section 5) only under equivalent obligations
- Assist our client in responding to data subject rights requests
- Delete or return footage 90 days after final delivery, unless legally required to keep it
- Notify our client without undue delay if we become aware of a personal data breach
Our clients are responsible for obtaining valid consent from every identifiable person in the footage they send us - including, where health, biometric, or other special-category data is involved, explicit consent under Article 9 GDPR.
If you appear in a video we produced and want it removed, contact the business that commissioned it. You may also contact us at [privacy@propositumlabs.com] and we will forward your request to them and assist.
4. Portfolio use of client content
With our clients' agreement under our Terms & Conditions, we display finished videos in our portfolio and on our social media channels.
Where a video contains identifiable individuals other than the client themselves, we rely on the client's confirmation that appropriate consent was obtained. Clients may opt out of portfolio use in writing before production begins, and may request removal of specific content at any time.
5. Who we share your data with
We use the following processors and sub-processors. Each is bound by a data processing agreement.
| Provider | Purpose | Location |
|---|---|---|
| Cal.com (cal.com) | Call booking and scheduling | EU-hosted |
| [Google Workspace] | Email, calendar, file storage | EU/US - SCCs + Data Privacy Framework |
| [Hosting provider] | Website hosting | [LOCATION] |
| [Payment provider] | Invoicing and payments | [LOCATION] |
| [Analytics provider] | Website analytics (only with consent) | [LOCATION] |
| Freelance editors / contractors | Producing your deliverables | [LOCATIONS] - bound by confidentiality and data processing agreements |
We may also disclose data where required by law, court order, or a competent authority.
We never sell your personal data.
6. International transfers
Some of our providers and contractors are located outside the European Economic Area, including in the United States, the United Kingdom, and [OTHER COUNTRIES].
Where personal data leaves the EEA, we rely on one or more of:
- Standard Contractual Clauses approved by the European Commission
- Adequacy decisions (the UK and Canada both benefit from EU adequacy decisions)
- Additional safeguards, including encryption in transit and at rest, and access controls
You may request a copy of the safeguards in place by emailing [privacy@propositumlabs.com].
7. Your rights
Under GDPR and UK GDPR you have the right to:
- Access - get a copy of the personal data we hold about you
- Rectification - correct inaccurate or incomplete data
- Erasure - have your data deleted ("right to be forgotten")
- Restriction - limit how we process your data
- Portability - receive your data in a structured, machine-readable format
- Object - object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent - where processing is based on consent, withdraw it at any time without affecting prior lawful processing
- Not be subject to automated decision-making - we do not carry out automated decision-making or profiling
To exercise any right, email [privacy@propositumlabs.com]. We will respond within one month. We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Additional rights by region
- Canada (PIPEDA / Quebec Law 25): you may access and correct your data and withdraw consent. Quebec residents additionally have rights to data portability and to be informed of automated decisions.
- California (CCPA/CPRA): you have the right to know, delete, correct, and opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA. You will not be discriminated against for exercising these rights.
8. How to complain
If you are unhappy with how we handle your data, please contact us first at [privacy@propositumlabs.com] - we would like the chance to put it right.
You also have the right to lodge a complaint with a supervisory authority:
- Romania: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) - www.dataprotection.ro
- United Kingdom: Information Commissioner's Office (ICO) - www.ico.org.uk
- Canada: Office of the Privacy Commissioner of Canada - www.priv.gc.ca
- EU: the supervisory authority in your country of residence
9. Security
We apply appropriate technical and organisational measures, including encrypted file transfer and storage, access limited to those who need it, strong authentication on all accounts, confidentiality agreements with all contractors, and deletion of footage 90 days after delivery.
No system is completely secure. Clients must keep their own backup of all raw footage - we are not an archival service.
10. Cookies
Our website uses:
- Essential cookies - required for the site to function. Set without consent, as permitted by law.
- Analytics cookies - only if you accept them via our cookie banner.
You can change or withdraw your cookie choices at any time via the cookie settings link in our footer, or by clearing cookies in your browser.
11. Changes to this policy
We may update this policy. The "last updated" date at the top will change. Material changes affecting how we use your data will be notified by email where we hold your address.
Contact: [privacy@propositumlabs.com]