Privacy Policy

This website is operated by DEPIBIO SRL, a company registered in Romania. Kelbria is the brand; DEPIBIO SRL is the legal entity, and it is the data controller for the purposes of the GDPR.

No data protection officer has been appointed. For processing of this scale one is not required, and claiming a role that does not exist would help nobody.

This policy covers this website. The Kelbria FitNotes app is a separate product and has its own policy — an app that stores a training log on your phone and a website that serves pages are doing different things, and describing them together would only obscure both. The same company is the controller for both.

This site sets no cookies. It writes nothing to local storage, session storage or IndexedDB, registers no service worker, and stores nothing in the browser's cache API.

That was verified against the production build rather than assumed: the site was loaded with browsing data cleared, then navigated across the home, product and legal pages with the mobile menu opened and the pages scrolled, and the browser's cookie store — including cookies a page cannot see from script — was empty throughout, with no Set-Cookie header returned by any response.

Because the site uses no cookies of any kind, there is nothing to consent to and no consent banner. If that ever changes, anything non-essential will ask first.

There are none. Every request the site makes is to its own domain. Fonts are served from this site rather than from a font provider, there are no embedded videos or maps, no advertising, no analytics, no tag manager and no social widgets — so no other company learns that you visited, and no third-party script runs in your browser.

Serving a web page requires receiving a request, and the hosting infrastructure records those requests in standard server logs. Such a log entry ordinarily contains the IP address the request came from, the time, the address requested, and the browser's user-agent string. An IP address can be personal data.

These logs exist to deliver the site and to keep it secure and available. Kelbria does not use them to build a profile of you, does not combine them with anything else, and does not use them for advertising or analytics.

The site is hosted by Hostinger, which operates the servers and the network that handle these requests on our behalf. Their retention periods and infrastructure details are set by them, and we do not restate figures here that we cannot verify.

The site has no forms — no contact form, no newsletter sign-up, no comments. The only way to reach us from here is e-mail, and an e-mail contains your address and whatever you chose to write. We use it to answer you and keep a reasonable record of the exchange.

Our mail is handled by Google (Gmail), which delivers and stores messages on our behalf under their terms as well as ours.

Where the GDPR applies, serving the site and keeping the security logs described above rests on our legitimate interest in operating a website that works and is not attacked. Answering an e-mail you sent rests on our legitimate interest in responding to you — or on taking steps at your request. We do not rely on consent, because we do nothing here that requires it.

Our mail provider is Google, a company established outside the European Economic Area, so support correspondence can be processed outside the EEA. Google states that it relies on the European Commission's Standard Contractual Clauses, and on the EU–US Data Privacy Framework where applicable, for such transfers.

Nothing else leaves the EEA on our account. Hosting is provided by Hostinger, and the website itself sends nothing to any other company.

Where data protection law applies to you, you can ask what personal data we hold about you (access), ask for it to be corrected (rectification) or deleted (erasure), ask us to restrict how it is used, object to that use, and ask for a copy in a portable form. Write to us and we will act on it.

We do not rely on consent for anything described here, so there is no consent for you to withdraw.

You also have the right to complain to a supervisory authority — either the one for your own country, or the authority for the controller's establishment, which for DEPIBIO SRL is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

The site is served over HTTPS and sends a set of security headers that restrict what a browser will load and execute on these pages. It holds no accounts, no passwords and no database of visitors, so there is no store of personal data here to breach. No website is perfectly secure, and this policy does not claim otherwise.

If this policy changes, the revised version is published at this address and the effective date above is updated.