We review this page regularly and update it whenever our privacy, project delivery, or data protection practices change.
1. Our commitment to GDPR
Acefina is committed to protecting personal data in line with the General Data Protection Regulation (GDPR). This page explains how we handle personal data tied to EU residents.
2. Data controller and processor roles
For personal data collected through our own website or marketing activity, Acefina generally acts as the data controller. For client engagements, we typically act as a data processor and handle information according to the client's instructions.
3. Legal basis for processing
- Consent: For Google Analytics cookies, which load only after you accept them
- Steps before a contract: When you send a project brief and ask us to respond or quote
- Contract: When processing is necessary to fulfill an agreement with you or your business
- Legitimate interests: For operational activity that does not override your rights
- Legal obligation: When we are required to retain or disclose data by law
4. Your rights under GDPR
EU residents may have the right to:
- Request access to personal data
- Correct inaccurate or incomplete data
- Request deletion of data where applicable
- Restrict certain processing activity
- Receive personal data in a portable format
- Object to processing based on legitimate interests
- Request review where automated decision-making would apply (we do not currently rely on automated decision-making for these processes)
5. Data protection measures
- Encryption in transit using HTTPS/TLS
- Access controls and credential hygiene
- Regular security review and project-level safeguards
- Internal handling practices designed to reduce unnecessary exposure
- Incident response procedures where sensitive systems are involved
6. International data transfers
Cloudflare, Zoho (which delivers contact-form email), Google and Ahrefs process data outside the EU and EEA in some cases. We rely on safeguards such as the EU-US Data Privacy Framework or standard contractual clauses. The privacy policy lists every tool and what it receives.
7. Data retention
Personal data is retained only for as long as needed for the stated purpose, to meet contractual obligations, or to comply with legal requirements. When retention is no longer required, data is deleted or anonymized where appropriate.
8. Data processing agreements
For client work that involves personal data processing, we can enter into a Data Processing Agreement (DPA) that clarifies responsibilities, handling boundaries, and compliance expectations.
9. Exercising your rights
To exercise a GDPR right or ask a related question, contact hello@acefina.com. We aim to respond within 30 days where GDPR applies. You may also contact your local data protection authority if you believe your rights have not been handled properly.