Privacy Policy

1. Who is responsible

The controller of the personal data described in this policy is:

Company

RITSEA S.R.L., a limited liability company (societate cu răspundere limitată) registered in Romania

Seat

Bdul. Ferdinand nr. 95, bl. A1, sc. A, et. 8, ap. 34, Constanța 900717, România

Trade register

J2025055174005

Tax code (CUI / VAT)

RO52211370

Contact

contact@ritsea.com, or the form on our Contact page

We have not appointed a data protection officer. None is required for what this policy covers: we do not monitor people regularly and systematically on a large scale, and we do not process special categories of data on a large scale (GDPR art. 37(1)(b) and (c)). Questions about privacy go to the address above.

2. What this policy covers

This policy covers three things: visits to the Website, emails you send us, and messages you send with the contact form. It does not cover our products.

When you use a product, the privacy notice of that product applies. It says who is responsible for your data in that product. Each product has a notice of its own:

• Cloudverest: privacy notice on cloudverest.com.
• Pactroom: privacy notice on pactroom.com.

The Website also links to two VR games, Toilet Toss and Poly Ego, which Steam lists as published by Poly Tool Design. This policy does not cover them: their own sites and the stores that sell them have their own privacy information.

The Website also links to sites we do not control, such as the stores and the authorities named in our legal documents. Once you follow a link to another site, including one of our products’ sites, that site’s own privacy information applies.

3. What we handle, why, and on what legal basis

Technical data of your visit

What

Your IP address, the date and time, the address of the page or file requested, the response code, the amount of data sent, the page you came from (if your browser says), and your browser and device type.

Source

Your browser, automatically, whenever it loads a page or file from the Website.

Why

To deliver the pages to you, keep the Website secure and available, and find and fix faults.

Legal basis

Legitimate interests (GDPR art. 6(1)(f)): our interest in running a Website you can reach and that is safe from abuse. We keep this to what the connection needs. You may object (section 8).

Required?

Your browser sends it whenever it connects to any website. Without it the Website cannot be delivered.

Who holds it

Our hosting provider, Netlify (section 5). We do not keep a copy of these records and we do not analyse them.

Emails you send us

What

Your email address, your name if it appears, the message and any attachments, and our replies.

Source

You.

Why

To answer you, to handle questions about our products, partnerships and the press, and to keep a record of what was said.

Legal basis

Legitimate interests (GDPR art. 6(1)(f)): our interest in answering people who write to us and in keeping a record of it. Where you write to ask for a product or a business arrangement, we also act to take steps at your request before a contract (GDPR art. 6(1)(b)).

Required?

No. You choose whether to write. If you do not, nothing is collected.

Who holds it

Our email provider, Google (section 5).

How long

See section 7.

Messages you send with the contact form

What

Your name, your email address and your message; the date and time you sent them; and technical data of the request that Netlify records with the submission, such as your IP address, your browser’s details and the address of the page you sent it from.

Source

You, when you send the form on our Contact page. The technical data comes from your browser.

Why

To read and answer your message, to keep a record of what was said, and to keep spam out of our mailbox.

Legal basis

Legitimate interests (GDPR art. 6(1)(f)): our interest in answering the people who write to us, in keeping a record of it and in filtering out spam. Where your message asks for a product or a business arrangement, we also act to take steps at your request before a contract (GDPR art. 6(1)(b)). You may object to processing based on our legitimate interests (section 8).

Required?

No. Sending the form is your choice. It asks for your name, your email address and a message; without an email address we cannot answer you.

Who handles it

Netlify receives and stores the submission and has it checked for spam by Akismet, a service of Automattic, Inc. Netlify emails the submissions that pass the check to our mailbox at Google. A submission that the check marks as spam is not emailed to us: it stays in Netlify’s list of spam submissions, where we can still find it and move it back (section 5).

How long

See section 7.

The email address on the Website is an ordinary link that opens your email program: clicking it sends us nothing until you send a message. The contact form sends nothing until you press its button, and the note under the button says in short what this section says. If you sent the form and have had no answer, you can also write to us at contact@ritsea.com.

4. What we do not do

• We do not set cookies and we do not store or read anything else on your device, including when you use the contact form. The Cookie Policy says so in detail.
• We use no analytics, advertising, tracking pixel, fingerprinting or social-media plug-in.
• Your browser loads every file of the Website from ritsea.com itself: no font, script or image comes from another site. The contact form is sent to ritsea.com too.
• The Website has no accounts or comment sections. The contact form is its only form, and it collects only what you type into it and send.
• We do not profile visitors and we make no decision about you based solely on automated processing (GDPR art. 22). Akismet’s spam check is automated, but it decides only whether a message is emailed to us or kept in the list of suspected spam.
• We do not sell or rent personal data.

If any of this changes, we will update this policy and the Cookie Policy first.

5. Who receives personal data

We use these providers to run the Website, the contact form and our email. Netlify and Google act on our instructions as processors, under data processing terms that form part of our contracts with them (GDPR art. 28). Automattic acts as a sub-processor of Netlify: Netlify’s data processing agreement requires it to impose on each sub-processor data protection obligations no less protective than its own. Netlify also relies on other sub-processors for its own service, such as providers of cloud infrastructure, and publishes the list of them on its website.

Beyond these providers, personal data may reach:

• advisers such as our lawyer or accountant, who are bound by confidentiality, and only where a matter needs it;
• courts, authorities and other bodies, where the law requires us to disclose it;
• a company that takes over our business, if it is reorganised or sold, for the same purposes as this policy describes.

6. Transfers outside the European Economic Area

Netlify, Inc. and Automattic, Inc. are United States companies, and Google may process our email in any country where it or its sub-processors have facilities. Data from your visit, your email or your form submission can therefore be processed outside the European Economic Area (EEA).

The safeguards, as each provider states them (read on 10 October 2026):

• Netlify, Inc. states that it complies with the EU–US Data Privacy Framework. Its data processing agreement provides that transfers from us to Netlify take place under that Framework and, where the Framework does not apply, under the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914).
• Automattic, Inc. states on Akismet’s website that, when it transfers Akismet data out of the EU, it does so under the standard contractual clauses. It works for us as a sub-processor of Netlify, on the terms described in section 5.
• Google states that Google LLC has certified its adherence to the EU–US Data Privacy Framework, and that Google relies on the standard contractual clauses where a transfer is not covered by an adequacy decision. Its data processing terms for Google Workspace provide for those clauses.

For organisations on the Data Privacy Framework List, the European Commission has decided that the United States ensures an adequate level of protection (Implementing Decision (EU) 2023/1795, under GDPR art. 45(1)), so those transfers need no specific authorisation. Elsewhere, the standard contractual clauses are an appropriate safeguard under GDPR art. 46(2)(c).

You can ask us at contact@ritsea.com for information about the safeguard that applies to a transfer and how to obtain a copy of it.

7. How long we keep personal data

8. Your rights

Under the GDPR you have the right to:

• know whether we hold personal data about you and get a copy (art. 15);
• have inaccurate data corrected and incomplete data completed (art. 16);
• have your data erased where the law gives you that right (art. 17);
• restrict our processing in the cases the law lists (art. 18);
• receive the data you gave us in a structured, commonly used, machine-readable form, where the processing rests on a contract or consent and is automated (art. 20). Here that covers only messages we handle to take steps you asked for before a contract; the rest rests on our legitimate interests, to which this right does not apply;
• object at any time, on grounds relating to your situation, to processing based on our legitimate interests (art. 21). We then stop unless we show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for a legal claim;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (art. 22). We make none.

How to use a right

Write to contact@ritsea.com or use the contact form. We may ask for what we need to be sure it is you, such as the address you wrote from. We answer without undue delay and within one month of receiving the request. If the request is complex or we have received many, we may extend that by two further months, and we will tell you why within the first month (art. 12(3)). It is free of charge, unless a request is manifestly unfounded or excessive (art. 12(5)). If we do not act on a request, we tell you why and that you may complain and go to court (art. 12(4)).

Complaints and courts

You may complain to a supervisory authority, in particular in the member state where you live or work or where the infringement took place (art. 77). In Romania this is:

You may also bring a claim before a court, in the member state where we are established or where you habitually live (art. 79), and claim compensation for damage caused by an infringement (art. 82).

9. Security

The Website and the contact form use encrypted connections (HTTPS) only. We keep to a minimum what we hold, which is the strongest protection: the Website has no accounts, no passwords and no database of visitors. Only the people at RitSea who handle our messages have access to our Netlify account and to the mailbox, and both are protected by the sign-in controls of the provider.

No system is perfectly secure. If a personal data breach happens, we notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people (GDPR art. 33). If it is likely to result in a high risk to you, we also tell you without undue delay (art. 34).

10. Children

The Website is a company website for adults and professionals. It is not directed at children and we do not knowingly collect personal data from them. Under the GDPR (art. 8(1)) a child under 16 cannot consent alone to an online service, and Romanian law has not set a lower age; we do not rely on consent here in any case. If a child has written to us, a parent or guardian can ask us at contact@ritsea.com to delete the message.

11. Changes to this policy

We update this policy when what we do changes or when the law does. The date at the top shows the current version, and the page you are reading is always the version that applies. Earlier versions are available on request. If a change affects how we use personal data you have given us, we tell you directly where we can, for example when we are in correspondence with you.

12. Contact

For any question about this policy or your personal data, write to us by email or post, or use the contact form: