Privacy

Structural information about data, contact and site use.

Updated: 2026-10-06

Krack Street Wear SRL
Bulevardul Basarabia nr. 256C, etaj 1, camera L1, Sector 3, București, România
CUI: 33281646 · J2014007080400
hq@krckbrnd.ro

Scope and controller

Krack Street Wear SRL is the controller for personal data collected through KRCKBRND Custom. This notice covers enquiries, staff accounts and this website. The separate retail shop has its own privacy information. Contact hq@krckbrnd.ro for privacy questions and requests.

Enquiries and legal bases

We receive the name, email, company and any phone number, location, project description, timing, budget and other details you choose to submit. We use them to evaluate your request, prepare a quote and communicate about the project. Avoid sensitive personal information or unnecessary information about other people.

For an individual requesting a contract, the basis is Article 6(1)(b) GDPR: steps taken at your request before a contract. For representatives of organisations, we rely on our legitimate interest in managing business enquiries and relationships under Article 6(1)(f). Statutory records rely on Article 6(1)(c). Required contact and project fields are needed to answer your request; optional fields may be left blank.

The privacy checkbox records acknowledgement of this notice. It is separate from optional marketing consent. If you choose marketing, we record that choice and rely on consent for those messages. You can withdraw it at any time at hq@krckbrnd.ro, without affecting your enquiry or earlier lawful processing.

Staff accounts and security

For invited staff we keep name, email, role, a salted password hash, sessions and records of administrative actions. Passwords are not stored in plain text. We use these records to administer access and protect the service, based on legitimate security interests.

Rate limiting uses pseudonymous identifiers and attempt counters. Cloudflare processes connection and browser information, including IP addresses, to host and secure the site. Turnstile checks requests for abuse. These checks do not make decisions producing legal or similarly significant effects about you.

Cookies and browser storage

The krk_csrf session cookie protects forms. Staff sign-in uses krk_session, valid for up to 12 hours or until sign-out or revocation. These support essential authentication and security functions.

The brief form stores a working draft in this browser tab’s session storage to help you continue your enquiry. Closing the tab normally clears it; browser restoration settings may affect this. Avoid confidential information on shared devices. Turnstile processes browser signals for security; see the Cloudflare information below.

Optional audience analytics are disabled in this version. We do not load advertising trackers. Linked websites, including the retail shop, have separate practices. Future non-essential tracking requires a separate assessment and prior consent where legally required.

Recipients and international transfers

Access is limited to authorised staff and providers needed for hosting, security, communications and the project. Cloudflare supplies hosting, database and object storage, and abuse protection. Necessary records may be disclosed to professional advisers or competent authorities where required by law. We do not sell personal data.

Providers may process information outside the EEA. Where GDPR requires it, transfers must rely on an applicable adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses. Contact us for information about the safeguards applicable to your data.

Retention

We keep enquiry data while assessing and responding to your request and managing any resulting project. Once the matter is closed, continued retention is limited to identified legal obligations, reasonably necessary business records or establishing, exercising or defending claims. The record type, project status and applicable limitation periods determine the period.

Staff records are kept while necessary for the account and security. Team setup links expire after 24 hours. First-owner setup is available only until the initial administrator password is chosen. Expiry prevents use but does not imply that every related database record has already been erased. Contact us to request deletion or a retention explanation; legally required records may need to be retained.

Your rights

Subject to GDPR conditions and exceptions, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. You can object to direct marketing at any time and withdraw consent where it is the legal basis.

Write to hq@krckbrnd.ro. We may request proportionate information to verify identity. We normally respond within one month and explain any permitted extension within that period. You may complain to ANSPDCP, Romania’s supervisory authority, or the competent authority where you live or work.

Changes

We update this notice when the service or processing changes and show the revision date above. Material changes will be communicated appropriately. This notice concerns this site, not every activity of the company.