Privacy Policy

Last updated: 16 October 2026

1. Who We Are and What This Policy Covers

UpwindLab provides content strategy, localization, multilingual websites, multimedia production, international event support and AI-enhanced content workflows. This policy explains how we handle personal data when you visit our website, contact us or discuss a project with us. In this policy, ‘we’, ‘us’ and ‘our’ refer to UpwindLab. For website inquiries and our own business communications, we determine why and how your personal data is used. You can contact us at hello@upwindlab.com, by phone on +40 770 978 273, or at 47j Oituz Street, Otopeni, 075100, Romania. When we process personal data in client-supplied materials on a client’s behalf, the client’s instructions and the relevant service agreement govern that processing. This draft should be reviewed and updated with the registered legal entity’s details before publication.

2. Information We Collect and Why

When you submit our contact form, we receive your first name, last name, email address, phone number and message, to the extent you provide them. If you contact us directly or become a client, we may also receive your company details, business correspondence, project requirements and information needed to prepare proposals, deliver services and manage invoicing. Please share only information relevant to your request and avoid sending sensitive personal data through the inquiry form. We use this information to answer questions, scope projects, prepare quotes, communicate with you, provide agreed services, maintain business records and meet legal obligations. Where the GDPR applies, we rely on steps requested before entering a contract or performance of a contract where you are a party; our legitimate interests in responding to business inquiries, managing client relationships and protecting our services where appropriate; and compliance with legal obligations for required records. If a particular activity requires consent, we will request it separately. Submitting an inquiry does not itself constitute consent to unrelated marketing.

3. Website Analytics and Cookies

This website is built and hosted with Framer and uses Framer Analytics to understand overall website usage, such as page views, referral sources and broad device or location trends. Framer Analytics is designed to work without cookies and does not use persistent identifiers to track visitors across websites. We do not use advertising trackers on this website. Hosting and website delivery may involve processing technical request data, such as IP addresses and browser information, to deliver pages and maintain security. Our legitimate interests in operating a reliable website and understanding aggregate usage support this processing where applicable. If we introduce non-essential cookies, advertising tools or additional tracking technologies, we will update this policy and request consent before activating them where required by law. You can also control cookies through your browser settings; blocking essential functionality may affect how a website works.

4. Sharing, International Transfers and Security

Providing our website and services can require access by hosting providers such as Framer, communications and business-support providers, professional advisers, and specialists involved in an agreed project. Access should be limited to what is needed for the relevant task and subject to appropriate confidentiality and data-protection terms. Disclosure may also be necessary to meet a legal obligation or establish, exercise or defend legal claims. Where personal data is transferred outside the European Economic Area, applicable data-protection law requires an appropriate transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, together with any necessary additional safeguards. You can contact us for information about safeguards relevant to your data. Appropriate technical and organisational safeguards are required to protect personal data against unauthorised access, loss or misuse. No website, email service or storage system can guarantee absolute security. Project-specific handling of confidential materials, recordings, participant information or AI-assisted workflows should be agreed before that data is shared.

5. How Long We Keep Information

We retain personal data for no longer than is necessary for the purpose for which it was collected. Inquiry records are assessed according to whether a discussion is active, follow-up is reasonably expected or a record is needed to resolve a dispute. Client and project records are retained according to the service agreement, operational needs and applicable legal limitation periods. Invoices and other mandatory business records are retained for the periods required by law. Materials processed on a client’s behalf are returned or deleted according to the client’s instructions and our agreement, subject to legal requirements. When retention is no longer justified, data should be securely deleted or anonymised. Contact us if you need information about the retention period applicable to a particular record.

6. Your Rights and How to Contact Us

Where the GDPR applies, you may request access to your personal data, correction of inaccurate information, erasure, restriction of processing and, where applicable, data portability. You may object to processing based on legitimate interests, including profiling based on those interests, and to any direct marketing. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. These rights are subject to the conditions and exceptions in applicable law. Send requests to hello@upwindlab.com, including enough information for us to identify the relevant interaction. We may need proportionate information to verify your identity. We normally respond within one month; if an extension is permitted because a request is complex or numerous, we will explain it within that period. You may lodge a complaint with Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro, or with the supervisory authority where you live, work or believe an infringement occurred. Our website and services are intended for business audiences, not children. External websites linked from our site have their own privacy practices. We may update this policy as our services or legal obligations change; the date above identifies the latest revision.