Contents16 sections
In short
- The controller is Compass Marketing Real Estate SRL, a Romanian company. The GDPR and Romanian law apply, plus the privacy laws of your country.
- We use the details you give us (name, phone, email, your message) to answer you and arrange meetings. Analytics and advertising cookies run only if you agree.
- We do not sell your personal data. We send marketing messages only with your consent, and you can unsubscribe at any time.
- Enquiries are kept for 24 months from our last contact, unless the law requires longer or you ask us to delete them sooner.
- You can ask to see, correct or delete your data, or object to its use, by writing to [email protected].
Who is responsible for your data
The controller of your personal data is Compass Marketing Real Estate SRL, tax identification code (CUI) 41138230, VAT code RO41138230, registered office at Calea Moșilor nr. 158, parter, modul P246, Sector 2, Bucharest, Romania (“Compass”, “we”, “us”). We operate the website www.compassgroup.ro and market the Compass on the Lake project in Balotești, Romania.
Our group company Compass Real Estate Management SRL manages the project and the property after handover. Where it uses personal data for its own purposes (for example the administration of the residential complex), it does so as a separate controller, and this policy also applies to it.
For any question about your data, or to exercise your rights, write to [email protected]. We have not appointed a data protection officer; privacy requests are handled by the person in charge of data protection at Compass, at the same address.
Who this policy covers
This policy covers visitors to the site; people who contact us by form, chat, WhatsApp, phone, email, social networks or in person; people who book a meeting or attend an event; prospective and actual buyers, owners and tenants at Compass on the Lake; and contact persons at our business partners and suppliers.
Because we are established in Romania, an EU Member State, our processing is governed by the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Romanian laws that complement it, in particular Law No. 190/2018 and Law No. 506/2004 on electronic communications. The privacy laws of the country where you live may give you additional rights, explained further below.
What data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact details | Name, phone number, email address, preferred language | You, through forms, meeting bookings, chat, WhatsApp, phone or email |
| Your request | Villa or villa type you are interested in, how you would like to meet (Zoom, in Israel, in Romania), the content of your messages and of your conversations with our chat assistant | You |
| Meeting details | Date and time you chose, the email address for the invitation | You, through Calendly |
| Marketing preferences | Whether you agreed to receive marketing, and when; unsubscribe requests | You |
| Purchase and contract data (only if you go ahead) | Identity document details, personal identification number, address, marital status documents, bank and financing details, payment details, tax residency information, documents on the source of funds required by anti-money-laundering law | You, your bank, the notary, public registers |
| Technical and usage data | IP address, browser and device type, pages visited, the page you came from, campaign parameters (utm), and, if you agree, cookie identifiers | Your browser, cookies and similar technologies |
| Settings stored on your device | Your cookie choices, accessibility settings, chat conversation identifier | Your browser (local storage); not linked to your identity |
We do not ask for special categories of data (such as health data). Please do not send them to us.
Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering your enquiry, sending the information you asked for, calling you back | Steps taken at your request before entering into a contract (Art. 6(1)(b)); our legitimate interest in answering enquiries (Art. 6(1)(f)) |
| Arranging and holding meetings (Zoom, by phone, in person) | Steps taken at your request (Art. 6(1)(b)) |
| Keeping a record of our contact with you in our CRM system, to follow up properly and not to contact you twice | Legitimate interest in managing our customer relationships (Art. 6(1)(f)) |
| Marketing: newsletters, offers and project news by email, SMS, WhatsApp or phone | Your consent (Art. 6(1)(a)), given separately from accepting this policy; for electronic messages also Article 12 of Law No. 506/2004 |
| Reservation, sale, financing, notarial deed and land registration of a villa | Performance of a contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) |
| Legal obligations: anti-money-laundering checks (Law No. 129/2019), accounting and tax, the obligations of real estate developers (including Law No. 207/2025), requests from authorities | Legal obligation (Art. 6(1)(c)) |
| Management of the residential complex and the property after handover (owners and tenants) | Performance of a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Operating and securing the site, remembering your choices | Legitimate interest (Art. 6(1)(f)); strictly necessary storage permitted by Article 4(5) of Law No. 506/2004 |
| Statistics and advertising measurement with cookies and similar technologies | Your consent (Art. 6(1)(a)) and Article 4(5) of Law No. 506/2004 |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
| Working with business partners, suppliers and brokers | Contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, you may object at any time (see “Your rights”). Where we rely on consent, you may withdraw it at any time; this does not affect processing carried out before the withdrawal.
Giving us your details is voluntary. Without them, we cannot answer your enquiry, arrange a meeting or, later, prepare an agreement. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Our chat assistant
The chat on the site is run by Compass on our own server. Answers are generated automatically by an artificial-intelligence model provided by Anthropic (United States), which processes the messages on our behalf only to produce the answer. Members of our team can read the conversation and take it over. Please do not write sensitive information in the chat.
Conversations are stored on our server and kept like other enquiries (see “How long we keep your data”). Your browser keeps only a random conversation identifier, so that the conversation continues if you return.
Who we share your data with
We share personal data only when necessary for the purposes above, and only with:
- Our group companies, Compass Marketing Real Estate SRL and Compass Real Estate Management SRL.
- Service providers who process data on our behalf (processors), under written agreements: website hosting and our lead and analytics server; our CRM system; email and SMS marketing (Smoove, Israel); email and office tools (Google Workspace); meeting scheduling (Calendly, United States); video meetings (Zoom, United States); the AI model behind the chat assistant (Anthropic, United States).
- Advertising and analytics providers, only if you agree to the matching cookies: Google (Analytics, Tag Manager), Meta (Facebook and Instagram), Outbrain and Hotjar. See “Cookies” below.
- Messaging platforms you choose to contact us through, such as WhatsApp (Meta), under their own terms.
- Professional advisers: lawyers, notaries, accountants, auditors, translators and insurers.
- Banks and financing institutions, if you apply for financing.
- Real estate brokers or agents who introduced you to us, to the extent needed to settle the introduction.
- Contractors, utility providers and the management company, after you buy or rent a villa, as needed to deliver and maintain it.
- Public authorities and courts, when the law requires it: for example the Romanian tax authority (ANAF), the anti-money-laundering office (ONPCSB), the land registry, notaries and courts.
We do not sell personal data, and we do not give it to third parties for their own marketing.
Transfers outside the European Union
Some recipients are located outside the European Economic Area:
- Israel: the European Commission has recognised that Israel provides an adequate level of protection (Decision 2011/61/EU), so no further safeguards are needed.
- United States: we use providers certified under the EU–U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or, where a provider is not certified, the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) with additional safeguards where needed.
You may ask us for information about these safeguards at [email protected].
How long we keep your data
- Enquiries, meeting requests and chat conversations: 24 months from our last contact with you, then deleted or anonymised.
- Marketing: until you withdraw your consent. After that we keep only your email or phone number on a “do not contact” list, so that we respect your choice.
- Purchase, contract and accounting records: for the periods required by Romanian accounting, tax and civil law, and for as long as claims may be brought.
- Anti-money-laundering records: 5 years after the end of the business relationship, as required by Law No. 129/2019.
- Cookies: for the periods shown in the cookie table below.
We may keep data longer if the law requires it or if it is needed for a legal claim, and only for that purpose.
Security and a warning about fraud
We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access control and confidentiality obligations for our staff and providers. No transmission over the internet is completely secure, and we keep improving our measures.
Beware of fraud (phishing). Compass will never ask you by email, SMS or WhatsApp for passwords, card details or bank account access, and will never ask you to transfer money based on a message alone. Payments for a villa are made only according to a signed agreement, to the account stated in it. If you receive a suspicious message in our name, do not click on its links: contact us first at [email protected] or +40 312 294 781.
Your rights
Under the GDPR you have the right to:
- Access your personal data and receive a copy (Art. 15);
- Rectification of inaccurate or incomplete data (Art. 16);
- Erasure of your data, subject to legal exceptions (Art. 17);
- Restriction of processing in the cases set out in the GDPR (Art. 18);
- Data portability: receive the data you gave us in a structured, machine-readable format (Art. 20);
- Object to processing based on legitimate interest, and at any time to direct marketing (Art. 21);
- Withdraw your consent at any time (Art. 7(3));
- Not to be subject to a decision based solely on automated processing that significantly affects you (Art. 22).
To exercise your rights, write to [email protected]. It is free of charge. We will reply within one month; for complex or numerous requests this may be extended by two further months, and we will tell you why. We may ask you to confirm your identity.
You also have the right to lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro. You may also complain to the authority of the EU country where you live or work, or go to court.
Marketing messages and how to unsubscribe
We send marketing by email, SMS, WhatsApp or phone only if you ticked the separate marketing box or otherwise gave us your consent. You can stop at any time, free of charge: click the unsubscribe link in any email, reply to a message asking us to stop, or write to [email protected]. We will process your request promptly and within the time limits set by law.
Children
The site is intended for adults and is not directed at children. We do not knowingly collect personal data of children under 16. If you believe a child has sent us personal data, please contact us and we will delete it.
In the United States, the site is not directed to children under 13, and we do not knowingly collect personal information from them within the meaning of the Children’s Online Privacy Protection Act (COPPA).
Cookies and similar technologies
Cookies are small files that a website stores on your device. Similar technologies include local storage in your browser, pixels and scripts that send information to a server. We use them in four categories, the same ones you see in our cookie banner. Only strictly necessary ones run without your consent.
| Category | What it does | Your consent |
|---|---|---|
| Strictly necessary | Keeps the site working and secure: remembers your language, your cookie choices and your accessibility settings; lets the chat continue your conversation | Not required; cannot be switched off |
| Analytics | Helps us understand, in aggregate, which pages are read and where visitors come from, so we can improve the site | Only if you agree |
| Marketing | Measures whether our ads work and lets the networks show you more relevant ads | Only if you agree |
| Preferences | Remembers settings that improve your experience and enables embedded content such as videos, the meeting calendar and maps | Only if you agree |
The tools on this site
| Tool and provider | Category | What it stores or sends | How long |
|---|---|---|---|
| Your consent choice (Compass) | Strictly necessary | cg_consent and lr_consent_v1 in local storage | Until you change it or clear your browser |
| Accessibility menu (Compass) | Strictly necessary | cg_a11y in local storage: text size and display settings | Until you reset it or clear your browser |
| Chat assistant (Compass) | Strictly necessary | compass_bot_cid (conversation identifier) in local storage, compass_bot_seen for the session | Until you clear your browser; the session |
| Google Tag Manager (Google) | Strictly necessary | Loads the other Google tags in “consent mode”: until you agree, Google tags set no analytics or advertising cookies. Google may still receive limited signals without cookies (such as that a page was viewed), with advertising data redacted | No cookies |
| Ahrefs Web Analytics (Ahrefs) | Strictly necessary (statistics without cookies) | Aggregated, cookieless page statistics | No cookies |
| Google Analytics 4 (Google) | Analytics | _ga, _ga_<ID>: distinguish visits and visitors | Up to 2 years |
| Hotjar (Hotjar Ltd., Malta) | Analytics | _hjSessionUser_*, _hjSession_*: heatmaps and anonymised recordings of how pages are used | Up to 1 year; 30 minutes |
| Meta Pixel and Conversions API (Meta) | Marketing | _fbp and similar: measure Facebook and Instagram ads; with your consent the same events are also sent from our server | Up to 90 days |
| Outbrain pixel (Outbrain) | Marketing | Outbrain identifiers: measure Outbrain ads | According to Outbrain’s policy |
| Calendly (Calendly LLC, United States) | Preferences | The meeting calendar embedded on the “next step” page | According to Calendly’s policy |
| YouTube (Google) | Preferences | Embedded videos, loaded in YouTube’s privacy-enhanced mode (youtube-nocookie.com) | According to Google’s policy |
Our own server also records conversions (for example that a form was sent) together with the page and campaign parameters. Without your consent to analytics or marketing, only the fact that an enquiry was sent is recorded, without identifiers; with your consent, the events are forwarded to Google and Meta with the same event identifier so that nothing is counted twice.
Fonts on the site are loaded from Google Fonts (Google, United States). To deliver them, Google receives your IP address; Google Fonts does not set cookies. We rely on our legitimate interest in displaying the site consistently and quickly (Art. 6(1)(f) GDPR); Google LLC is certified under the EU–U.S. Data Privacy Framework.
You can change your choice at any time: . The same button is in the footer of every page (“Cookie settings”). You can also block or delete cookies in your browser settings; some parts of the site may then not work as intended.
Notice for residents of California and other U.S. states
This section applies to residents of California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and to residents of other U.S. states with similar comprehensive privacy laws, to the extent those laws apply to us.
What we collect and why
In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described above: identifiers (name, email, phone, IP address, cookie identifiers); commercial information (the villa you are interested in, meetings booked, and, if you buy, purchase records); internet or other electronic network activity (pages visited, interactions with the site); and approximate location derived from your IP address. If you buy a villa, we also collect government identification numbers and financial information, which are sensitive personal information; we use them only to complete the purchase and to comply with the law, and not to infer characteristics about you.
Selling and sharing
We do not sell personal information for money. If you accept marketing cookies, the Meta and Outbrain pixels may receive identifiers and browsing information for advertising, which may be considered “sharing” for cross-context behavioural advertising under the CCPA. These pixels never load unless you accept marketing cookies.
Do Not Sell or Share My Personal Information: to opt out, do not accept marketing cookies or change your choice at any time with , and/or write to [email protected] with the subject “Do Not Sell or Share”. We do not knowingly sell or share personal information of consumers under 16.
Your rights
- Right to know what personal information we collect, use, disclose and share, and to receive a copy;
- Right to delete and right to correct your personal information;
- Right to opt out of the sale or sharing of your personal information;
- Right to limit the use of sensitive personal information (we already use it only for permitted purposes);
- Right not to be discriminated against for exercising these rights.
To make a request, email [email protected]. We will confirm receipt within 10 business days and respond within 45 days, which may be extended once by another 45 days if needed. We will verify your request by matching the details you give us with those we hold. You may use an authorised agent, who must provide your signed permission. We keep personal information for the periods described in “How long we keep your data”.
California’s “Shine the Light” law (Civil Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.
Email, calls and text messages
Our commercial emails comply with the CAN-SPAM Act: they identify us as the sender, include our postal address and contain a working unsubscribe link, and we honour unsubscribe requests within 10 business days. Under the Telephone Consumer Protection Act (TCPA), we make marketing calls or send marketing text or WhatsApp messages to you only with your prior express written consent. Consent is not a condition of any purchase, and you can revoke it at any time by any reasonable means, for example by replying “STOP” or telling us so.
Changes to this policy
We may update this policy when our processing or the law changes. The date at the top of this page shows the current version. If a change is material, we will highlight it on the site and, where appropriate, inform you by email.
Contact
For any question about this policy or your data: [email protected], or by post to Compass Marketing Real Estate SRL, Calea Moșilor nr. 158, parter, modul P246, Sector 2, Bucharest, Romania.