Privacy notice

FORCENT DEVSECOPS SRL ("Forcent", "we") is the data controller for personal data processed through this website.

• Registered in Romania · VAT RO44833630
• Bucharest, Romania
• contact@forcent.io

We have not appointed a Data Protection Officer. We are not required to, and saying otherwise would be misleading. Privacy questions go to the address above and are handled by us directly.

This notice describes what happens to personal data you give us through this website — the contact form, the careers form, and the technical data generated by visiting the site.

It does not cover data processed during a client engagement. When we deliver consulting, testing or recruitment work, the processing is governed by the contract and data processing agreement for that engagement, where we normally act as processor rather than controller. If you are a client, that agreement is the document that applies, not this page.

Contact form

Name, email address, company (optional), the topic you select, and your message. We use it for one thing: to read your enquiry and reply. It is not added to a mailing list, not enriched from third-party sources, and not passed to anyone for marketing.

Lawful basis: Article 6(1)(b) — steps taken at your request before entering into a contract; or Article 6(1)(f), our legitimate interest in responding to people who contact us about our services.

Careers form

Name, email address, a link you choose to share (CV, repository, personal site), the role, and what you write about your work. Used to assess your application and correspond with you about it.

Lawful basis: Article 6(1)(b) — pre-contractual steps at your request. Please do not send special category data (health, religion, political views, trade union membership) or a national identification number; we do not need any of it to assess an application, and we will delete it if you send it.

Technical data

Our host and CDN, Cloudflare, processes your IP address, user agent and request details to serve the site and protect it from abuse. Aggregate visit statistics are collected through Cloudflare Web Analytics, which sets no cookies and stores nothing on your device. IP addresses are used for country-level geolocation and are not retained by us.

Lawful basis: Article 6(1)(f), our legitimate interest in operating a secure website and understanding at a basic level whether it is being read.

This site sets no cookies, and shows no cookie banner, because it does not need one.

That is a deliberate design choice rather than an oversight:

• No analytics cookies. Cloudflare Web Analytics is cookieless. It uses no client-side state at all — no cookies, no local storage — and does not fingerprint or track you across sites.
• No advertising or third-party tracking. There is none on this site.
• Self-hosted fonts. Typefaces are served from this domain, so loading a page does not disclose your visit to a font CDN.
• Bot protection. The contact and careers forms use Cloudflare Turnstile, which processes transient browser signals to distinguish people from automated submissions. It sets no persistent cookies and builds no visitor profile. Under the ePrivacy Directive this is strictly necessary for a service you have explicitly requested — submitting the form — and is exempt from prior consent.
• Theme preference. If you use the light/dark toggle, your choice is saved in your browser's local storage under forcent-theme. Nothing is written unless you click it, it never leaves your browser, and it contains only the word light or dark. This is a preference you asked us to remember, which is also consent-exempt.

You can verify all of this yourself in your browser's developer tools, under Application → Storage. We would rather you checked than took our word for it.

We use a small number of processors. Each is bound by a data processing agreement and may only act on our instructions.

We do not sell personal data, and we do not share it with anyone for their own purposes.

Cloudflare and Resend are established in the United States, so submitting a form involves a transfer outside the EEA. These transfers rely on the European Commission's Standard Contractual Clauses, and where the processor is certified, on the EU–US Data Privacy Framework.

We will not pretend this question is entirely settled. The adequacy of US transfer mechanisms has been litigated before and may be again. We keep the volume of personal data crossing that boundary as small as we can: a form submission and nothing else. If you would prefer your enquiry not to transit US infrastructure, email us directly at contact@forcent.io, which is hosted in the EU. That is a genuine alternative, not a formality.

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on legitimate interest, you can object and we will stop unless we have compelling grounds not to — for an enquiry, we will simply delete it.

Write to contact@forcent.io. We respond within 30 days and do not charge. We will ask enough to be confident you are who you say you are, and no more.

If you are unhappy with how we have handled it, you can complain to the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or to the authority where you live or work.

We are a security consultancy, so it would be poor form to be vague here. This site is static, with no database, no CMS and no admin panel — most of what gets breached on a small business site does not exist here. Traffic is HTTPS-only with HSTS. A strict Content-Security-Policy restricts what may execute. Form submissions are validated server-side, rate-limited by the edge, and pass through bot verification before an email is sent. Credentials are held as encrypted platform secrets, never in the repository.

None of that makes a breach impossible. If a breach affects your rights and freedoms, we will notify the supervisory authority within 72 hours and tell you directly where the regulation requires it.

If you find a vulnerability in this site, we would genuinely like to hear about it: contact@forcent.io.

If we change how we process personal data, we update this page and the date at the top. Material changes affecting people who have already contacted us will be communicated directly.