Privacy Notice

This Privacy Notice explains how we collect, use and protect your Personal Data, and describes the rights available to you under the General Data Protection Regulation (EU) 2016/679 (“GDPR”). We review and update this Notice periodically to reflect changes in our practices and in applicable law.

1. Definitions

For the purposes of this Privacy Notice, the following terms have the meaning set out below:

Controllermeans THE ARCHITECTURE WITHIN S.R.L., a Romanian company, with its registered office at Bucharest, 122 Mihai Bravu Road, Building D27, 1st Entrance, 2nd Floor, Apartment 6, 2nd District, Romania, registered with the Trade Registry under no. J2026052769003, having tax identification number 55529344 (“Controller”, “we”, “our” or “us”), operating THE ARCHITECTURE WITHIN (“TAW”) at thearchitecturewithin.com(the “Platform”).

Supervisory Authoritymeans the independent public authority responsible for monitoring the application of the GDPR in the Controller’s home Member State, established pursuant to Article 51 GDPR.

Personal Datameans any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Data Subject means the identified or identifiable natural person to whom Personal Data relates.

Processing means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission or otherwise making available, alignment or combination, restriction, erasure or destruction.

Restriction of Processing means the marking of stored Personal Data with the aim of limiting its Processing in the future.

Processor means a natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.

Representative means a natural or legal person established in the European Union who is designated by the Controller in writing, pursuant to Article 27 GDPR, to represent the Controller in relation to its GDPR obligations, where the Controller itself is not established in the European Union.

Recipient means a natural or legal person, public authority, agency or another body to which Personal Data is disclosed, whether a Third Party or not. Public authorities which may receive Personal Data in the framework of a particular inquiry are not regarded as Recipients.

Third Party means a natural or legal person, public authority, agency or body other than the Data Subject, Controller, Processor, and persons who, under the direct authority of the Controller or Processor, are authorized to Process Personal Data.

Consent means any freely given, specific, informed and unambiguous indication of your wishes by which you, by a statement or by a clear affirmative action, signify agreement to the Processing of your Personal Data.

Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

2. Who We Are

For the purposes of the GDPR, in relation to the Personal Data Processed through the Platform, we act as the Controller, and our visitors and users are Data Subjects.

We are committed to protecting your Personal Data and to Processing it only for specific, explicit and legitimate purposes, in line with the principles of the GDPR.

Data Protection Officer

At this time, The Architecture Within has not appointed a Data Protection Officer, as it is not currently required to do so under the GDPR.

3. How to Contact Us

If you have any question about this Privacy Notice or about how we Process your Personal Data, please contact us at admin@thearchitecturewithin.com.

4. What Personal Data We Process, the Purposes, the Legal Basis and the Retention Period

We place a high priority on protecting your Personal Data. Wherever possible, we collect Personal Data directly from you, giving you greater control over the information you share with us, and we Process it only for the specific purposes described below.

Personal Data includes any information that could, directly or indirectly, identify you. Some information — for example, your professional skills or education — is not, on its own, Personal Data, because it could not directly lead to your identification; however, combined with other information such as your name, display name or e-mail address, it could eventually identify you.

Category 1 – Account and Profile Data

Data Collected: e-mail address, display name, authentication credentials, account identification information and any other profile information you choose to provide. Where you create or access your account using Google or Apple, we may receive your name, e-mail address and other account identification information made available by the relevant provider. We do not receive or store the password used for your Google or Apple account.

Purpose of Processing: Creating, authenticating and managing your account.

Legal Basis:Art. 6(1)(b) GDPR – Processing is necessary for the performance of the contract entered into with you under our Terms of Use.

Collection Method: Directly from you through the registration, profile and account-management functionalities of the Platform, or from Google or Apple where you choose to use a third-party sign-in service.

Retention Period: For the duration of your account. Following deletion of your account, the relevant Personal Data will be deleted or anonymised, unless continued retention is necessary to comply with a legal obligation, establish, exercise or defend legal claims, prevent fraud or protect the security and integrity of the Platform.

Category 2 – Assessment and Architecture Data

Data Collected: Your responses to the 96-question TAW Assessment, including responses concerning your baseline patterns and responses under stress, together with information generated on the basis of those responses, including axis scores, Architecture type or structural identity, narrative interpretations, stress signature, structural drift classifications, drivers, continuity data, compatibility results and other architecture-based outputs.

Purpose of Processing:Administering the Assessment; generating, displaying and maintaining your structural profile or “Architecture”; generating related reports and structural outputs; enabling continuity between Assessments; and providing Platform Features based on your Architecture.

Legal Basis:Art. 6(1)(b) GDPR – Processing is necessary for the performance of the contract and the provision of the Platform Features requested by you under our Terms of Use.

Collection Method: Directly from you through the Assessment and generated by the Platform on the basis of your Assessment responses and other relevant information available through your account.

Retention Period: For the duration of your account, unless you delete the relevant information earlier where such functionality is available. Upon account deletion, the data will be deleted or anonymised, subject to any retention required or permitted by Applicable Law.

Category 3 – Connection, Matching and Romance Preference Data

Data Collected: Where you use the Romance, Friendship or Business connection functionalities, we may Process the preferences and self-declared attributes that you choose to provide, including age, gender, country, preferred age range, relationship or connection goals, interests, languages, education, whether you want children, countries in which you are open to connections and other Match Preferences.

For Business connections, this may also include information regarding domains, skills, what you are seeking, business or project stage, commitment, work style, experience level and a self-declared capital role, such as whether you are seeking investment or may be able to invest. TAW does not request the amount of capital available and does not Process, hold or facilitate investment funds or financial transactions through this functionality.

Where you choose to use gender-based filtering within Romance matching, we also Process the gender or genders with which you indicate that you are interested in connecting. TAW does not ask you to declare your sexual orientation. However, your gender preferences, particularly when considered together with information concerning your own gender, may allow information concerning sexual orientation to be inferred and may therefore constitute Special Categories of Personal Data within the meaning of Article 9 GDPR.

Purpose of Processing: Enabling the connection and matching functionalities selected by you; filtering and ranking potential connections; determining which Users are displayed to you and to whom your profile may be displayed; and applying the Match Preferences selected by you.

Legal Basis:Art. 6(1)(b) GDPR – Processing is necessary to provide the matching and connection functionalities requested by you under our Terms of Use.

For gender preferences used in Romance matching, the Legal Basis is Art. 6(1)(a) GDPR and Art. 9(2)(a) GDPR – your explicit consent. Such consent is obtained separately when you choose to provide a gender preference and is not included in your acceptance of the Terms of Use.

Collection Method: Directly from you through your profile and Match Preferences.

Retention Period: For as long as the relevant preference or information remains associated with your account. You may edit or clear Match Preferences through the Platform. Gender preferences are retained until you withdraw your consent or delete the relevant preference. Remaining data will be deleted or anonymised following account deletion, subject to any retention required or permitted by Applicable Law.

Providing gender preference information is optional. You may continue using Romance matching without providing a gender preference, in which case gender-based filtering will not be applied.

Category 4 – Coaching, Reflections and AI Companion Data

Data Collected: Reflections, journal entries, selected states or mood selections, streak information and other information that you choose to submit through the Coaching functionality, as well as prompts, messages, conversation history and other information that you choose to submit through the AI Companion, together with relevant information from your Architecture, Assessment or other Platform data made available to the AI Companion in order to provide the functionality.

Purpose of Processing: Providing the Coaching and AI Companion functionalities; maintaining reflections and conversation history; generating or organising reflective prompts and AI-assisted insights; and generating context-aware responses based on your inputs and relevant information available through the Platform.

Legal Basis:Art. 6(1)(b) GDPR – Processing is necessary to provide the Platform Features requested by you.

Collection Method: Directly from you through the Coaching and AI Companion functionalities and, where relevant, from information already available within your account and generated through other Platform Features.

Retention Period: For as long as necessary to provide the relevant functionality and, in any event, no longer than the duration of your account, unless a shorter retention period applies or continued retention is required or permitted by Applicable Law.

Certain Personal Data used in connection with the AI Companion may be Processed through third-party Artificial Intelligence infrastructure used by TAW. Further information concerning relevant Recipients and international transfers is provided in Section 5 of this Privacy Notice.

Category 5 – Messages, Wall and Other User Content

Data Collected:Messages, images and other information exchanged between Users through the Platform’s messaging functionality, together with information necessary to identify the relevant conversation, sender, recipient and time of communication; posts and other content published through the Wall, including reflections, report insights, milestones and any report elements attached by you; visibility settings selected for posts; reactions given to or received from other Users; and any other User Content created, uploaded, published, transmitted or otherwise made available through the Platform.

Purpose of Processing: Enabling communications and interactions between Users; displaying and maintaining conversation history and Wall content; applying visibility settings; displaying reactions; operating content reporting and moderation functionalities; and maintaining the relevant Platform Features.

Legal Basis:Art. 6(1)(b) GDPR – Processing is necessary to provide the relevant Platform Features requested by you. Where Processing is necessary for Platform security, content moderation, abuse prevention, investigation or enforcement, Art. 6(1)(f) GDPR – our legitimate interests in protecting Users, enforcing our Terms and maintaining the security and integrity of the Platform.

Collection Method: Directly from you and other Users through the Messages, Wall and other content-sharing functionalities of the Platform.

Retention Period: For as long as necessary to provide the relevant functionality and, where applicable, until you delete the relevant content or your account. Certain information may be retained for a longer period where necessary to investigate reported conduct, comply with Applicable Law or establish, exercise or defend legal claims.

Category 6 – Technical, Usage and Analytics Data

Data Collected: IP address, device type, operating system, browser type and version, date and time of access, pages or Platform Features accessed, technical identifiers, server logs, error and diagnostic information and other technical information generated through your interaction with the Platform. Where analytics technologies or cookies are used, the information Processed through those technologies is described separately in our Cookie Policy.

Purpose of Processing: Operating, maintaining and securing the Platform; detecting and preventing fraud, abuse, unauthorised access and technical incidents; troubleshooting and improving Platform performance; and, where applicable and subject to the relevant consent requirements, analysing the use of the Platform.

Legal Basis:Art. 6(1)(f) GDPR – our legitimate interests in operating, securing, maintaining and protecting the Platform. Where non-essential cookies or analytics technologies require consent, Art. 6(1)(a) GDPR – your consent, together with the applicable rules governing the storage of or access to information on your device.

Collection Method: Automatically when you access or interact with the Platform, including through server logs, technical infrastructure and, where applicable, cookies and analytics technologies.

Retention Period: Technical and security data is retained only for as long as reasonably necessary for the relevant operational or security purpose. Data collected through cookies or similar technologies is retained for the periods specified in our Cookie Policy.

Category 7 – Support, E-mail and Social Media Communications

Data Collected: Your name, e-mail address, social media account or profile details, display name, account information where relevant, the content of any communication, enquiry, support request, comment, private message or other correspondence, and any Personal Data, documents, images or other information that you choose to provide to us by e-mail, through our social media accounts or through any other communication channel made available by TAW.

Purpose of Processing: Receiving and responding to enquiries and support requests; communicating with you; addressing complaints and other requests; managing interactions through our social media accounts; and maintaining appropriate records of correspondence where necessary.

Legal Basis:Depending on the nature of your communication, Art. 6(1)(b) GDPR – where the communication relates to the performance of our Terms of Use; or Art. 6(1)(f) GDPR – our legitimate interest in responding to enquiries, providing support, managing communications and maintaining appropriate records.

Collection Method: Directly from you when you contact us, including by e-mail, through our social media accounts, or through any other communication channel made available by TAW.

Retention Period: 1 year from the last interaction, unless a longer period is required by applicable law.

Category 8 – Reports, Moderation and Platform Safety Data

Data Collected: Information contained in reports submitted by or concerning a User; information identifying the reporting and reported User where applicable; the relevant User Content, Messages or conduct; information concerning moderation decisions, account restrictions, warnings, suspensions or other enforcement measures; and related correspondence.

Purpose of Processing: Receiving and assessing reports; detecting, investigating and preventing unlawful, abusive, fraudulent or otherwise prohibited conduct; moderating User Content; protecting Users and the security and integrity of the Platform; enforcing our Terms of Use; and complying with applicable legal obligations.

Legal Basis:Art. 6(1)(f) GDPR – our legitimate interests in protecting Users, preventing misuse, enforcing our Terms and maintaining a safe and secure Platform; and Art. 6(1)(c) GDPR where Processing is necessary to comply with a legal obligation applicable to TAW.

Collection Method:From you, other Users, the relevant Platform Features and, where appropriate, information generated in connection with TAW’s review or moderation process.

Retention Period: For as long as reasonably necessary to investigate and resolve the relevant report or safety matter and thereafter for the period necessary to demonstrate compliance, prevent repeated abuse or establish, exercise or defend legal claims, subject to Applicable Law.

Personal Data is retained only for as long as necessary for the purpose for which it was collected, after which it is deleted or irreversibly anonymized. We take appropriate steps to ensure the timely deletion of Personal Data once retention is no longer necessary.

Where a category above relies on Art. 6(1)(b) or Art. 6(1)(c) GDPR, providing the corresponding Personal Data is a contractual or statutory requirement. If you do not provide it, we may be unable to enter into or perform the relevant contract, or to comply with the relevant legal obligation.

5. Disclosure of Your Personal Data, including International Transfers

In the ordinary course of our business, we do not disclose or transfer your Personal Data to Third Parties for their own direct marketing purposes, regardless of their location.

Our Employees

Employees who have access to Personal Data are trained to observe its security and confidentiality, and their access is limited to what is required to perform their specific tasks.

Processors and Suppliers

We work with service providers to carry out certain technical or administrative tasks on our behalf, such as e-mail hosting, data storage, server hosting, and legal services. Where a Processor is not established in the European Economic Area (“EEA”), engaging them may involve the disclosure of your Personal Data outside the EEA. We only engage Processors that provide sufficient guarantees to implement appropriate technical and organizational measures in compliance with the GDPR, and we enter into a data processing agreement with each Processor as required by Article 28 GDPR.

International Transfers

Where Personal Data is transferred outside the EEA, we ensure that such transfers are carried out in accordance with applicable Data Protection Laws and are subject to an appropriate transfer mechanism, including, where applicable, an adequacy decision adopted by the European Commission pursuant to Article 45 GDPR, including the EU-U.S. Data Privacy Framework, or the Standard Contractual Clauses approved by the European Commission pursuant to Article 46 GDPR.

Legal Requirements

Your Personal Data may be disclosed to governmental authorities or law enforcement agencies where required by applicable law.

6. Your Rights and How to Exercise Them

We implement appropriate technical and organizational measures to ensure that your rights as a Data Subject are observed, as follows.

Right of Access

You have the right to obtain confirmation as to whether Personal Data concerning you is being Processed by us and, where that is the case, access to your Personal Data and information on how it is Processed.

Right to Data Portability

You have the right to receive the Personal Data you have provided to us in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance from us, where technically feasible.

Right to Object

You have the right to object to the Processing of your Personal Data where Processing is necessary for the performance of a task carried out in the public interest, or for the purposes of legitimate interests pursued by us. You have the right to object at any time where your Personal Data is Processed for direct marketing purposes.

Right to Rectification

You have the right to obtain from us, without undue delay, the rectification of inaccurate Personal Data concerning you. The rectification will be communicated to each Recipient to whom the data was sent, unless this proves impossible or involves disproportionate effort.

Right to Erasure (“Right to Be Forgotten”)

You have the right to obtain from us the erasure of Personal Data concerning you and we have the obligation to erase it without undue delay, where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other legal ground for the Processing; you object to the Processing and there are no overriding legitimate grounds; it has been unlawfully Processed; erasure is required for compliance with a legal obligation; or it was collected in relation to the offer of information society services.

Right to Restriction of Processing

You have the right to obtain from us Restriction of Processing where: you contest the accuracy of your Personal Data, for a period enabling us to verify its accuracy; the Processing is unlawful and you oppose erasure, requesting restriction instead; we no longer need your Personal Data, but you require it for the establishment, exercise or defence of legal claims; or you have objected to Processing pending verification of whether our legitimate grounds override yours.

Right to Withdraw Consent

Where the Processing of your Personal Data is based on your consent, you have the right to withdraw it at any time, without affecting the lawfulness of Processing carried out before the withdrawal. You can withdraw your consent by contacting us at admin@thearchitecturewithin.com.

Right Not to Be Subject to a Decision Based Solely on Automated Processing

You have the right not to be subject to a decision based solely on automated Processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not use applications, algorithms, artificial intelligence or automated processes to make decisions, without human intervention, that produce legal effects concerning you.

You can exercise any of these rights at any time by writing to us using the contact details in Section 3. To protect your Personal Data, we may ask you to verify your identity before responding. We will respond within one month of receipt, or notify you if we need to extend this by up to two further months due to the complexity or number of requests. Exercising your rights is generally free of charge; however, we may charge a reasonable fee, or decline to act, where a request is manifestly unfounded or excessive.

7. Children’s Personal Data

We do not knowingly collect Personal Data from children under the age of 18. If you are under this age, please do not submit any Personal Data to us.

8. Security Measures

We have implemented appropriate technical and organizational measures to protect the privacy and security of your Personal Data, and to protect it from damage, loss, misuse, unauthorized access, alteration, destruction or disclosure, including the following.

• Access to our filing system is limited to individuals nominated by us, who use individual accounts and passwords that are changed periodically.
• All employees, collaborators and service providers who have access to Personal Data must act in accordance with our data protection principles and policies. They have been informed of, and have undertaken to comply with, the GDPR, whether by signing a data processing agreement or as an effect of law.
• Employees and collaborators access Personal Data only to perform their professional duties and only in accordance with the stated purpose of collection.
• Computers used to access the filing system are password-protected and equipped with up-to-date antivirus, antispam and firewall protection.
• Personal Data is printed only by authorized users, and only where necessary to perform our activity or to fulfil a legal obligation.

We also encourage you to think carefully about what Personal Data you share with us. No method of transmission over the internet or by e-mail can be guaranteed to be completely secure.

9. Links to Other Websites

Our Platform may contain links to other organizations’ websites. This Privacy Notice does not cover the Personal Data Processed by them.

If you access another organization’s website, we encourage you to read its privacy notice, generally available at the bottom of that website.

Where we integrate a third-party purchase on the Platform, that third party acts as the Controller for that specific feature/operation, with no direct involvement from us. Please read the applicable privacy notice of that third party before proceeding.

10. Updates to This Privacy Notice

As our services evolve, we will update this Privacy Notice accordingly, and we always publish the latest version on our website. We encourage you to check back from time to time. If you have any questions, please contact us using the details in Section 3.

11. Right to Lodge a Complaint

If you believe that our Processing of your Personal Data infringes the GDPR, you have the right to lodge a complaint with a Supervisory Authority — in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement — without prejudice to any other administrative or judicial remedy.

National Supervisory Authority for Personal Data Processing (ANSPDCP)
28-30 G-ral Gheorghe Magheru Boulevard, District 1, 010336 Bucharest, Romania
E-mail: anspdcp@dataprotection.ro
Phone: +40 31 805 9211 / +40 31 805 9212
Website: www.dataprotection.ro