Skip to content

Privacy Policy on the Data Collected through the Signature Form

Last updated: 02/11/2026

1. Who we are

The controller of the data is Lumos Studio (a natural person, Roman, Neamț County, Romania), at hello@lumosstudio.ro.

This page describes the privacy policy that applies to collecting signatures through the online form published on this site, in support of the open letters on www.exploredacia.ro. The data is collected for a civic purpose, without a commercial character.

2. What data we collect and why

By filling in the form we collect the following personal data:

  • First name (required)
  • Surname (required)
  • Email address (required)
  • The date and time of your consent
  • A fingerprint (HMAC) of your IP address, not the IP address itself

The purpose of collecting this data is:

  • Validating the participation of the signatory
  • The public count of approved signatures: the site shows only the total number, never names, email addresses or other data
  • Archiving the signatures for possible later civic actions (for example, sending the manifesto to institutions)

The IP fingerprint helps us limit abusive submissions: the one used to limit submissions is deleted after 24 hours.

3. The legal basis for processing

Under Regulation (EU) 2016/679 (GDPR), the legal basis is your explicit consent (Art. 6(1)(a)), given by ticking the boxes under the form. By ticking them you also confirm that you are at least 16 years old. You can withdraw your consent at any time.

4. Who has access to your data

Access is limited to the controller, in our administration panel, strictly for the purposes above. The data is not sold and is not used for commercial purposes.

We process the data through providers that work on our behalf: Supabase (the database, in the European Union, in Frankfurt), Vercel (website hosting) and Cloudflare (the Turnstile anti-robot check, USA).

5. How long we keep the data

  • Approved signatures: for as long as the civic initiative lasts and 12 months more, then they are deleted.
  • Signatures under review or rejected: 90 days, then they are deleted.
  • The fingerprint used to limit submissions: 24 hours.

You can ask for deletion at any time.

6. Your rights

In accordance with the GDPR, you have the following rights:

  • The right of access to personal data
  • The right to rectification
  • The right to erasure (“the right to be forgotten”)
  • The right to restriction of processing
  • The right to withdraw your consent at any time

How to use them: write to us at hello@lumosstudio.ro. We reply within 30 days at most. We check the request through the email address you signed with: we reply only to that address and, if needed, ask you to confirm from it. You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

7. Age

The form is not aimed at people under 16 and we do not knowingly collect data from them.

8. Changes to the policy

We reserve the right to update this policy. All changes will be shown on this page, with an updated date.

For any questions about the privacy of data in the context of this manifesto, please write to us at hello@lumosstudio.ro.