Foreheed SRL

Privacy policy

Last updated: 8 October 2026

1. Who is responsible for your data

Foreheed SRL, Romania, is the controller for personal data processed through foreheed.com. For privacy questions or requests about your data, email contact@foreheed.com.

This policy covers our public website and inquiries sent through it. If we provide services to you, separate contractual privacy terms may also apply.

2. Inquiries and correspondence

When you submit the contact form, we receive your name, email address, subject, message and the IP address used for the submission. These details are sent to our business inbox. If you email us directly, we receive your email address, message and any information you choose to include.

We use this information to respond, discuss potential work and keep relevant business correspondence. Our legal basis is taking steps at your request before entering a contract (GDPR Article 6(1)(b)), where applicable, or our legitimate interest in handling business inquiries and correspondence (Article 6(1)(f)).

The form fields are needed to process a form inquiry. You can contact us by email instead. Please avoid including sensitive personal information or confidential information that is unnecessary for the initial discussion.

3. Website operation and security

Serving the website and protecting the contact form involves technical information, including IP addresses, request times, requested resources and browser or device information. Our application uses IP addresses to limit repeated form submissions and records limited submission metadata, including the IP address and subject length, rather than the message contents.

The contact form uses Google reCAPTCHA v3. Its script loads when you submit the form. Google processes technical and interaction information to evaluate whether the submission is likely to be automated. Our server sends the reCAPTCHA token and your IP address to Google for verification. A submission can be rejected if the security checks fail.

We rely on our legitimate interest in securing the website and preventing spam and abuse (Article 6(1)(f)). reCAPTCHA is separate from optional analytics. Google's Privacy Policy and Terms of Service apply to its service.

We do not use website data to make automated decisions with legal or similarly significant effects on you. Automated security checks can reject a form submission; you can contact us by email instead.

4. Optional Google Analytics

If you allow website analytics, we use Google Analytics 4 to understand visits, traffic sources, campaign performance, pages viewed, browser language, device types, approximate geographic location and engagement. We also measure contact-link clicks, email-link clicks, LinkedIn-link clicks, form starts and successful contact submissions.

Analytics uses cookie identifiers and collects technical information. Google derives approximate location from IP addresses and states that GA4 does not log or store individual IP addresses. We do not send contact-form names, email addresses, subjects or messages to Analytics. We exclude arbitrary URL query parameters and fragments from our configured page address, keeping only campaign tags; campaign tags should not contain personal information.

Our legal basis for optional analytics is your consent (Article 6(1)(a)). Until you accept website analytics, we do not load the Analytics tag or send Analytics measurements, including cookieless measurements. Analytics is also disabled on our local and development hosts.

5. Optional audience insights

If you also allow audience insights, Google Signals can enrich Analytics with aggregated age ranges, gender and interests. Google may associate website activity with information from Google accounts belonging to consenting, signed-in users who have enabled Ads Personalization, and use Google's advertising cookies for this reporting.

Our legal basis is your separate consent. You can allow website analytics while leaving audience insights off. Reports cover only eligible users and may be withheld for small audiences. We receive aggregated reports rather than individual Google account identities. We disable use of our Analytics events for personalized advertising.

For details about Google's handling of data, see how Google uses information from sites that use its services and Google's advertising controls.

6. Cookies, storage and your choices

Select Accept all to allow both optional categories, Reject optional to decline both, or Settings to choose separately. Neither optional category is preselected for a first-time visitor.

You can reopen Privacy settings here or in the website footer. Withdrawing consent stops further Analytics collection and removes accessible first-party Analytics cookies. The page reloads to unload the Google tag. Withdrawal does not affect processing that occurred before it. Google cookies on other domains must be managed through your browser or Google account settings.

Choices apply to this browser and website origin. Clearing browser storage or using a different browser can cause us to ask again. If your browser blocks local storage, your choice applies to the current page and may not be remembered for the next visit.

7. Who receives data and international processing

Authorized people at Foreheed and providers supporting hosting, infrastructure and email delivery can process the information needed for their work. Google receives data when reCAPTCHA runs, and receives Analytics data only according to your optional consent choices. We may also disclose information where necessary to comply with a legal obligation or protect legal rights.

Google and other providers may process information outside the European Economic Area, including in the United States. Applicable contractual terms and transfer safeguards govern that processing. Google's safeguards may include an applicable adequacy framework or Standard Contractual Clauses; see Google's international transfer information. You can contact us for information about safeguards applicable to your data.

Following a LinkedIn link takes you to a separate website governed by LinkedIn's own privacy terms.

8. How long data is kept

We retain inquiry correspondence for as long as needed to handle the inquiry, relevant follow-up and any resulting business relationship. If correspondence becomes a contractual, accounting or legal record, its retention is determined by the applicable record-keeping obligations and the need to establish or defend legal claims. Security records are retained for the time needed to detect and investigate abuse and resolve relevant incidents. You can contact us about the retention criteria for a particular record.

Your website consent choice and our first-party Analytics cookies have the 180-day limits described above. Google Analytics user- and event-level retention is controlled separately in the Analytics property settings, with standard-property options of 2 or 14 months. Google applies a two-month retention period to age, gender and interest data. Standard aggregated reports are not subject to the same user/event retention setting. Google controls retention for its own account information and reCAPTCHA data under its policies.

9. Your rights

Subject to the conditions of applicable data-protection law, you can request access to your personal data, correction, deletion, restriction of processing and portability. You can object to processing based on legitimate interests and withdraw optional consent at any time.

Email contact@foreheed.com to make a request. We may need information to verify your identity and locate the relevant records. We normally respond within one month; where the law permits an extension for a complex request, we will explain it.

You can complain to a supervisory authority, including Romania's Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), or the authority where you live or work.

10. Changes to this policy

We may update this policy when the website, services or data practices change. The date at the top identifies the latest version. Material changes to optional processing will require an updated consent choice where applicable.