Privacy notice

Last updated: 21 July 2026

This notice explains how Lukas Erich-Adrian PFA, trading as Dimensional X Studios ("we", "us"), handles personal data when you use this website, contact us, or request a project booking. It describes the website as it is currently operated; it does not claim legal certification.

1. Who is responsible

The controller is Lukas Erich-Adrian PFA, Strada Tineretului 19, Bl. 18, Sc. A, Ap. 2, Gura Humorului, Suceava, Romania. For privacy requests, email contact@dimensionalxstudios.com.

2. Information you choose to provide

When you use our contact or booking forms, we process the details you submit, such as your name, contact details, company, project requirements, budget range, timing, and message. We use these details to answer your request, prepare or perform a contract, prevent abuse, and keep appropriate business records. The lawful basis depends on the request: steps taken before a contract, performance of a contract, our legitimate interests in operating the business and securing the service, or a legal obligation.

Do not submit confidential information that we have not asked for. Form contents are not included in website analytics.

3. Optional website analytics

Optional analytics starts only after you choose Allow analytics. The equally available Essential only choice keeps analytics off. We also keep analytics off when your browser sends Global Privacy Control or Do Not Track, or when this browser is marked for internal exclusion.

If you consent, we collect the page path (without arbitrary query strings), referring website host, bounded utm_source, utm_medium, and utm_campaign values, page views, active engagement time, selected site interactions and conversions, coarse scroll depth, and LCP, INP, and CLS performance measurements. Interaction events include calls-to-action, project views and video plays, work filters, and starts or completions of booking and contact flows. They contain no form field values.

For each request, our EU-hosted ingestion service briefly uses the network address and user-agent supplied by your browser to reject abusive traffic, derive the country, classify a coarse device/browser/operating-system family, and calculate a keyed daily identifier. The raw network address and full user-agent are not stored. The key changes every reporting day and is designed not to link a browser across days. We do not collect city, coordinates, ISP data, advertising identifiers, or a persistent analytics visitor ID.

Country lookup uses a locally stored GeoLite Country database. Visitor network addresses are not sent to MaxMind. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

We use analytics to understand aggregate use, improve content and usability, measure enquiries, and monitor site performance. The lawful basis is your consent. Detailed event and session data is retained for up to 90 days. Dimension-specific daily aggregate statistics are retained for up to 25 months. Routine operational backups may expire on a separate, limited cycle.

4. Your device settings

The website does not use analytics cookies. It stores a versioned analytics choice in your browser's local storage under dxs_privacy_v1. An optional internal-browser exclusion uses dxs_analytics_internal. The booking experience may use dx_onboarding_data to preserve the draft you enter on your own device; it is not analytics data.

You can withdraw or change analytics consent at any time by selecting Privacy settings in the website footer. Withdrawal stops future collection. Clearing site storage removes the saved choice, so the website may ask again. Privacy signals always override a saved opt-in.

5. Service providers and international transfers

Supabase hosts the website analytics database and server functions in Frankfurt, Germany. MaxMind supplies the downloadable country database but does not receive visitor network addresses from us. Website hosting, email, anti-abuse, and the services used to deliver contact or booking submissions may also process the information needed to provide their function.

Where a provider processes data outside the European Economic Area, we rely on an applicable adequacy decision, approved contractual safeguards, or another lawful transfer mechanism. We share data only as needed to operate the service, comply with law, protect rights and security, or complete a business reorganisation subject to appropriate safeguards. We do not sell personal data or use this analytics system for behavioural advertising.

6. Security and retention

We use access controls, encrypted transport, restricted service credentials, aggregate-only staff reporting, rate limiting, data minimisation, scheduled deletion, monitoring, and a server-side analytics kill switch. No online service can guarantee absolute security. Business correspondence and transaction records are retained only as long as needed for the purposes described above and applicable legal requirements.

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to certain processing. You may withdraw consent without affecting processing carried out before withdrawal. Contact us at the address above. We may need to verify your identity before acting on a request.

You may also complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or the supervisory authority where you live or work. Information is available at dataprotection.ro.

8. Children

This business website is not directed to children, and we do not knowingly collect children's data through website analytics. If you believe a child has provided personal data, contact us so we can review and delete it where appropriate.

9. Changes

We may update this notice when the website or legal requirements change. The current version and its effective date are published on this page. Analytics coverage begins only after the production analytics service is enabled; the CMS health panel records that coverage start date.