Privacy Policy

Last updated: 21 October 2026

1. Who I am

This website, biancaivanofphd.com, including its Romanian version at ro.biancaivanofphd.com, is run by Ivanof Bianca-Elena – Cabinet Individual de Psihologie ("I", "me"). I am the controller of the personal data described in this policy. I am registered with the College of Psychologists of Romania (COPSI) under personal code: 37809. Tax identification code (CIF): 55023885. Professional title: Psihoterapeut Integrativ Practicant în Supervizare (Integrative Psychotherapist practising under supervision), granted in Romania. Professional body: Colegiul Psihologilor din România (COPSI), www.copsi.ro. My profession is governed by Law no. 213/2004 and the COPSI Code of Ethics, both available at www.copsi.ro.

For any question about your personal data, or to exercise your rights, email me at biancaivanofphd@gmail.com, or call or message me on +40 725 271 182.

2. What this policy covers

This policy explains how I handle personal data when you visit this website or contact me through it. If you become a client, I will give you separate information about how I handle the data related to our work together. This website is not intended for children under 16.

3. What personal data I collect, and why

When you use the contact form. I collect your name, email address, the content of your message and anything else you choose to tell me, so I can reply to your enquiry and arrange a first session. Legal basis: steps taken at your request before entering into an agreement (Article 6(1)(b) GDPR).

When you contact me by WhatsApp, Instagram or phone. I collect your phone number or Instagram username, your name and your messages, for the same purpose and on the same legal basis. WhatsApp and Instagram are run by Meta, which also processes your messages under its own privacy policy.

When you accept analytics cookies. I collect the pages you visit, how you reached the site, your device and browser type, and your approximate location (country or city), to understand how the site is used and improve it. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

When you visit the site or use the contact form. Technical data such as your IP address and browser information is processed to keep the site and contact form secure and protect them from spam. Legal basis: my legitimate interest in keeping the website secure (Article 6(1)(f) GDPR).

Health information. In a first message, please share only what you are comfortable sharing. If you choose to include information about your health or wellbeing, I will use it only to reply to you and to assess whether I can help. As a psychotherapist registered with COPSI, I am bound by professional secrecy under Romanian law and the COPSI Code of Ethics, and I process this information on that basis (Article 9(2)(h) and 9(3) GDPR). This applies however you contact me: through the contact form, email, WhatsApp, Instagram or phone.

Do you have to give me your data? No. To reply to an enquiry, I need your name and a way to contact you. Everything else is optional.

Automated decisions. I do not use your data for automated decision-making or profiling. Where I rely on my legitimate interests, you can ask me how I weighed them against your rights.

4. Who receives your data

Providers who process data on my behalf, under data processing agreements:

  • Squarespace: website hosting, the contact form and Squarespace Analytics

  • Weglot: the Romanian version of the website, delivered through Cloudflare

  • Google: Google Analytics

Independent services you may choose to use. If you email me, your message is handled by Gmail (Google). If you message me on WhatsApp or Instagram, your message is handled by Meta. Messages sent through the contact form are also forwarded to my email (Gmail). Google and Meta process these messages under their own privacy policies, as independent controllers.

I do not sell your personal data, and I do not share it with anyone else unless the law requires me to.

5. Transfers outside the EU

Weglot is based in France and hosts its data in the EU. Squarespace, Google and Cloudflare (which Weglot uses) may process data in the United States. Each is certified under the EU–US Data Privacy Framework, which the European Commission recognised as providing adequate protection on 10 July 2023, and Squarespace's data processing agreement also includes the European Commission's Standard Contractual Clauses. Meta, which runs WhatsApp and Instagram, is responsible for its own transfers as an independent controller. You can check each company's certification at www.dataprivacyframework.gov and read the Standard Contractual Clauses at eur-lex.europa.eu/eli/dec_impl/2021/914/oj. You can ask me for details of these safeguards at biancaivanofphd@gmail.com.

6. How long I keep your data

  • Enquiries that don't lead to working together: deleted within 6 months of our last contact, from the contact form records, my email, WhatsApp and Instagram

  • Analytics data: Google Analytics data is kept for 14 months, then deleted automatically. Squarespace Analytics data is kept for as long as this website runs on Squarespace; after that, Squarespace's own privacy policy governs how long it is kept.

  • Cookies: see section 8

7. Your rights

Your right to object. Where I rely on my legitimate interests (keeping the website secure, see section 3), you can object at any time, on grounds relating to your particular situation, by emailing biancaivanofphd@gmail.com.

Under the GDPR, you also have the right to:

  • access the personal data I hold about you

  • have inaccurate data corrected

  • have your data deleted

  • restrict how I use your data

  • object to my using your data

  • receive your data in a portable format

  • withdraw your consent at any time, without affecting anything done before you withdrew it

  • complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or to the data protection authority in your own EU country

To exercise any of these rights, email me at biancaivanofphd@gmail.com. I will reply within one month.

8. Cookies

Cookies are small files that websites store on your device. This website uses cookies that are strictly necessary for it to work, and, only if you accept them, analytics cookies. You can accept or decline analytics cookies in the banner when you first visit, and change your choice at any time using "Cookie settings" at the bottom of every page.

Strictly necessary (no consent needed)

  • crumb (Squarespace): security; protects forms from forged submissions. Duration: until you close your browser.

  • ss_performancecookiesAllowed (Squarespace): remembers your choice in the cookie banner. Duration: 30 days.

Analytics (only with your consent)

  • ss_cvr, ss_cid, ss_cpvisit (Squarespace): recognise returning visitors and their visits. Duration: up to 2 years (some browsers, such as Chrome, cap this at about 13 months).

  • ss_cvt, ss_cvisit (Squarespace): record when a visit starts. Duration: 30 minutes.

  • _ga, _ga_[property ID] (Google Analytics): distinguish visitors and visits. Duration: up to 2 years (some browsers, such as Chrome, cap this at about 13 months).

Google receives data through the Google Analytics cookies and may process it outside the EU (see section 5).

9. Changes to this policy

I may update this policy, for example if I start using a new service. The date at the top shows when it was last changed.