Privacy policy

This policy explains what personal data Abode & Grove collects, why, the legal basis for it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Romanian data-protection law. We collect as little as possible and we never sell your personal data.

Who is responsible for your data

The data controller for this site is:

Ciprian Jitaru
B-dul Bucureștii Noi, 136, et. Parter, ap. 5, Sector 1, București, Romania
Email: contact@abodeandgrove.com

What we collect, why, and our legal basis

• Contact form: your name, email and message, plus the IP address it was sent from (kept with the message to block spam), so we can reply and act on your request. Legal basis: your consent and our legitimate interest in responding to enquiries.
• Site security (Wordfence): we use Wordfence Security, provided by Defiant, Inc., to help protect the website against malicious traffic, unauthorized access, brute-force login attempts, malware and other security risks. For this purpose, Wordfence may process technical and security-related data such as your IP address, browser details and the pages requested. Legal basis: our legitimate interest in keeping the site secure.
• Server logs: like any website, our web server logs each request it receives: the IP address, the date and time, the page requested, the referring page and your browser’s user-agent. We use these logs only to run the site, fix errors and stop abuse. Legal basis: our legitimate interest in keeping the site running.
• Analytics: we use Ahrefs Web Analytics to see which pages get read and where visitors arrive from. It is cookieless: it stores nothing on your device and does not follow you across sites, devices or days. Your IP address is used only to derive an approximate location (country and city) and, combined with your browser’s user-agent and a salt that is thrown away every 24 hours, to produce a one-way hash that counts a device once per day. The raw address itself is never stored. It also records the page address, the referring address, your browser and device type, your language preference and basic interactions such as link clicks. Legal basis: our legitimate interest in understanding how the site is used.
• Google Analytics, only with your consent: if you allow it in our consent banner, we also use Google Analytics 4, provided by Google Ireland Limited, to count visits and see how the site is used. It sets two cookies holding a random identifier (listed in our cookie policy) and records the pages you view, how you arrived (the referring page or search), how long you stay, your device type, browser, language and screen size, and your approximate location (country and city), which Google derives from your IP address. Google Analytics 4 does not store your IP address. Legal basis: your consent, which you can withdraw at any time.
• Embedded videos and posts: an article can embed content from YouTube, Vimeo, TikTok, Instagram, Spotify, X or Reddit. Nothing is loaded from those services until you click the placeholder. When you do, your browser connects to that provider, which receives your IP address, browser details and the address of the page. Legal basis: your consent, given by clicking.

Who we share it with

We use a small number of trusted processors to run the site: Bluehost (hosting: its server holds the site, its database and the messages you send us, and our replies go out from that server rather than through an email-marketing provider) and Defiant, Inc. (its Wordfence Security service filters malicious traffic and blocks attacks before they reach the site, processing the security data described above solely for that purpose).

Ahrefs Pte Ltd acts as our analytics processor. It handles the cookieless usage data described above solely to produce our traffic reports, and does not use it to build advertising profiles or to identify you.

Google Ireland Limited provides Google Analytics to us as a processor, under Google’s data processing terms, and receives the usage data described above only when you allow analytics cookies. Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Video and social-media providers receive data only when you click to load their embedded content, and handle it under their own privacy policies.

International transfers

These providers process data outside the European Economic Area, mainly in the United States, and each transfer rests on a safeguard the GDPR recognises.

The server this site runs on is operated by Bluehost (Newfold Digital, Inc.) in the United States, so what the site stores (messages and server logs) is held there. Newfold relies on the European Commission’s Standard Contractual Clauses for these transfers. Defiant, Inc. (Wordfence) processes security data in the United States and offers the same Standard Contractual Clauses as a safeguard for such transfers.

This also includes Ahrefs Pte Ltd, which is incorporated in Singapore and stores analytics data in the United States, relying on the European Commission’s Standard Contractual Clauses as the safeguard for those transfers.

Google Analytics data may also be processed by Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google’s data processing terms add the European Commission’s Standard Contractual Clauses.

How long we keep it

We keep personal data only as long as needed for the purpose it was collected, then delete or anonymise it. In practice, contact messages are kept for up to 12 months after your enquiry is resolved. Where the law requires us to retain certain records for longer, we keep them only for that required period.

Security logs collected by Wordfence are kept for up to 30 days, and only as long as necessary for website protection, troubleshooting, abuse prevention and security investigations.

Ahrefs analytics data carries no identifier that can be traced back to you (the daily hash cannot be reversed once its salt is deleted), so it is kept in aggregate in our analytics account for as long as we use the service.

Google Analytics keeps the event data linked to its cookie identifier for 14 months and then deletes it automatically. After that, our reports hold only aggregated totals. The Google Analytics cookies expire 13 months after your last visit, and withdrawing consent deletes them straight away.

Raw web-server logs on our hosting account are rotated within days, and we do not archive them.

How we protect it

The whole site is served over encrypted HTTPS connections only. Access to the hosting account and the WordPress admin is limited to the people who run the site, and the Wordfence firewall screens traffic before it reaches the site.

We use only a small number of cookies: to remember your consent choices and to keep the site secure. Google Analytics cookies, which help us understand how the site is used, are set only if you allow them. A functional cookie, which remembers embedded content you chose to always display, is set only if you allow functional cookies. Ahrefs Web Analytics is cookieless, so it sets nothing on your device. We run no advertising cookies. See our cookie policy for the full list and how to control them.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these, email contact@abodeandgrove.com and we will reply.

Automated decisions

We make no decisions about you by automated means and build no profiles of visitors. Google Analytics shows us traffic in aggregate, never a named person.

Right to complain

If you believe we have mishandled your data, you can lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), at www.dataprotection.ro, or with the authority in your own EU country.

Children

The site is intended for general audiences and is not directed at children under 16. We do not knowingly collect their data.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. If a change affects what you agreed to in the cookie banner, the banner asks you again.

We keep this policy up to date as the site evolves. It is written to reflect our actual practices but is not a substitute for tailored legal advice.