privacy?

who I am

nhg.design is run by NHG Design SRL, Soarelui 25, Giarmata, Timiș, Romania. Robert Csaszar is the person responsible for data protection and the one who answers when you write in.

Reach me about anything on this page at robert@nhg.design. I reply within 15 days.

your rights and how to use them

You can see, correct, download or delete anything I hold about you. There is no portal and no form: email me and I will act within the same window. Using a right never costs you anything, and I will not treat you differently for exercising one.

Depending on where you live you may have the right to access, correct, delete, port, object to or restrict processing, and to withdraw a consent you gave.

contact and brief forms

Sending the contact form or the project brief delivers what you typed to my inbox: your name, your email address, and your message or answers. Nothing else rides along.

how it is obtained

Typed into the form and posted to Formspree, which forwards it to my email.

where it is stored

My mailbox, and a copy in my Formspree inbox.

how long I keep it

Until the conversation or the project is over and I clear it, or until you ask me to delete it.

legal basis

Taking the steps you asked for before a contract, and my legitimate interest in answering you.

shared with

Formspree (see processors below).

the newsletter

Signing up stores your email address so I can send an occasional note from the studio.

how it is obtained

Typed into the newsletter form and posted to Formspree.

where it is stored

My mailbox and my Formspree inbox; the list itself is kept by me.

how long I keep it

Until you unsubscribe. Reply to any issue and say so, or email me; you are off the list the same day.

legal basis

Your consent, given when you sign up and withdrawn when you unsubscribe.

shared with

Formspree.

page views

I count page views with vues, a self-hosted Umami-style tool that sets no cookies and builds no profile. I can see that a page was visited, from which country and on what kind of device, not who you are.

how it is obtained

A small script sends the page path, referrer, browser, operating system, device type and country. Visitors are counted by a salted hash that rotates, so no persistent identifier exists.

where it is stored

My own instance at visitors.nhg.app. Nothing leaves my infrastructure.

how long I keep it

Aggregate statistics only.

legal basis

My legitimate interest in knowing which pages are read and whether the site is up.

cookies and browser storage

This site sets no cookies. There is no cookie wall because there is nothing to consent to.

what is stored

One value in your browser, nhg-scheme, remembering whether you chose light or dark mode.

set by

The theme toggle, using the browser's localStorage.

kept for

Until you clear your browser data. It never reaches my server.

legal basis

Strictly necessary to remember a choice you made.

request logs

The site is static files served by Cloudflare Pages. Cloudflare sees each request as any host does; I do not ship its logs anywhere, and I keep no IP addresses of my own.

where it is stored

Cloudflare's edge, under its own retention.

legal basis

Legitimate interest in serving the site securely.

who else processes your data

These are the only third parties involved, and on what footing.

Formspree (forms)

Delivers form submissions and newsletter sign-ups to my inbox. United States; standard contractual clauses under Formspree's data-processing terms.

Cloudflare Pages (hosting)

Serves the site and holds its request logs. Global edge; Cloudflare is certified under the EU–US Data Privacy Framework and its data-processing addendum applies.

cal.com (booking)

Only if you follow the booking link. From that point you are on cal.com's site under its own policy; nothing is shared until you do.

vues (page views)

My own self-hosted tool, not a third party. Nothing about you leaves my infrastructure for it.

international transfers

Data is processed in the European Union unless stated above. Formspree is a US company working under standard contractual clauses; Cloudflare is certified under the EU–US Data Privacy Framework.

if you are in the EEA

NHG Design SRL is the controller. The legal bases are named for each entry above. You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where I rely on it (the newsletter). You can complain to your local supervisory authority; mine is the Romanian ANSPDCP at dataprotection.ro.

if you are in the united kingdom

The same rights apply under the UK GDPR. You can complain to the Information Commissioner's Office at ico.org.uk. No UK representative is appointed; this site has no material use there.

if you are in california

I do not sell or share your personal information and show no cross-context behavioural advertising. You may request access to or deletion of what I hold by email, and I will not discriminate against you for asking.

what I never do

I do not sell your data. I do not run ad trackers or tracking pixels. There are no marketing cookies, no fingerprinting, and no third-party scripts beyond the ones named above.

changes to this policy

When something material changes I update the effective date and add a line to the changelog below. That dated entry is the notice; the current version always lives here.

changelog

2026-09-27

Rewritten as a ledger: every use case with how it is obtained, where it lives, for how long and on what basis; processors, transfers and regional rights added; operator named as NHG Design SRL.

2026-07-10

First plain-language version.