Last updated: 10 July 2026
This English text is a translation provided for convenience. In case of any discrepancy, the Romanian version prevails.
1. Introduction
This Privacy Policy explains how CONSVITRALIU RO SRL (“the Controller”, “we” or “Consvitraliu”) collects, uses, stores and protects the personal data of people who access the website consvitraliu.ro (the “Website”) or who contact us via the contact form, e-mail or telephone.
Data is processed in accordance with Regulation (EU) 2016/679 (“GDPR”), Romanian Law no. 190/2018, Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, and other applicable Romanian and EU legislation.
Who it applies to: visitors of the Website, people who submit a quote request or an enquiry through the contact form, and representatives of clients, partners and suppliers who interact with us through the Website.
What it covers: the categories of data processed, purposes and legal bases, retention periods, recipients, any international transfers, security measures and data subject rights.
The Website is a presentation website. We do not sell products online, we do not process online payments and we do not offer user accounts.
2. Controller details
| Item | Value |
|---|---|
| Company name (controller) | CONSVITRALIU RO SRL |
| Legal form | S.R.L. |
| VAT / Tax ID (CUI) | 53052167 |
| Trade Register no. | J2025094608000 |
| Registered office | Șos. Ștefan cel Mare și Sfânt, Iași, Iași County, Romania |
| Contact e-mail | office@consvitraliu.ro · office@consvitraliu.com |
| Phone | 0721 161 161 · 0723 005 000 |
| Website | https://consvitraliu.ro |
| Field of activity | Design, manufacturing, delivery and installation of glass systems, PVC joinery and aluminium systems (windows, doors, curtain walls, ventilated facades, insulating glass, structures, roller shutters, sectional gates) |
| Data Protection Officer (DPO) | No DPO has been appointed, as there is no legal obligation to do so. Data protection requests are addressed directly to the company. |
| E-mail for GDPR requests | office@consvitraliu.ro |
Production site (affiliated entity)
Manufacturing is carried out by the affiliated entity in the Republic of Moldova. Data necessary for delivering projects may be shared with this entity, under the conditions described in the section on international transfers.
| Item | Value |
|---|---|
| Name | Consvitraliu — S.R.L. |
| Tax code (IDNO) | 1003600035657 |
| Address | str. Transnistria 5/9, MD-2037, Chișinău, Republic of Moldova |
| Phone | +373 22 407332 · +373 60 669797 |
| Manager | Tcaci Victor, General Director |
| Activity | Manufacturing: insulating glass units, PVC and aluminium windows and doors, facades |
| Certifications | ISO 9001:2015 · ISO 14001:2015 · ISO 45001:2018 (initial certification) |
For any question regarding the processing of personal data or to exercise your GDPR rights, you can contact us at office@consvitraliu.ro, by phone at 0721 161 161, or in writing at the address above.
3. What personal data we collect
We only collect the data necessary for the purposes described below.
3.1. Data you provide directly
- Identification data: first and last name; company name (optional).
- Contact data: e-mail address, phone number, city.
- Contact form / quote request data: project type (residential, commercial, office, industrial, hospitality) and the content of your message, including any information you choose to include.
- Communication data: correspondence with us (e-mail, phone), requests, questions, complaints and replies.
- Contractual and invoicing data (only if a contract is concluded). This data is not collected through the Website, but in the direct contractual relationship.
3.2. Data collected automatically
- Technical and usage data: IP address, browser type and version, operating system, device type, date and time of access, pages visited, referrer.
- Identifiers stored on your terminal equipment: cookies and similar technologies (localStorage), as described in the Cookie Policy.
- Language and preference data: the language you selected manually and your cookie choices.
- Server logs: technical records automatically generated by the hosting provider (IP address, HTTP requests, response codes), for security and diagnostics.
Language detection based on IP address: on your first visit, the Website may determine your country from your IP address in order to automatically display the Romanian version (for visitors from Romania and the Republic of Moldova) or the English version (for the rest of the world). This processing is based on our legitimate interest in displaying relevant content, does not create profiles and is not stored permanently. You can change the language at any time from the Website menu. In the current configuration no third-party service is used. Country detection is performed solely on our own server, by comparing the IP address against a local database containing the address ranges allocated to Romania and the Republic of Moldova (public RIPE NCC data). Your IP address never leaves our infrastructure, is not stored and is not sent to any third party. The result (the appropriate language) is kept only for the duration of the session, on your device. If an external service is enabled in the future, the provider will be identified here before use.
3.3. Data we do NOT collect through this Website
- Bank card or other payment data (there are no online payments).
- Delivery data (no products are delivered based on online orders).
- User account data (there are no accounts).
- Newsletter subscription data — NO. The Website does not offer a newsletter service.
- Special categories of data (health, ethnic origin, political opinions, etc.). Please do not include such data in messages sent through the form.
4. Sources of data
- Directly from you: via the contact form, e-mail, phone or during commercial discussions.
- Automatically, through your use of the Website: technical data, cookies and server logs.
- From third parties: we currently do not receive personal data from third parties through the Website. If this changes, we will update this policy.
5. Purposes of processing and legal bases
| Purpose | Data categories | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Responding to quote requests and enquiries sent via the form, e-mail or phone | Identification, contact, message content | Art. 6(1)(b) — steps taken at the request of the data subject prior to entering into a contract; and/or Art. 6(1)(a) — consent (form checkbox) |
| Communicating with you during the project (consulting, measurements, quoting) | Identification, contact, project data | Art. 6(1)(b) — performance of a contract or pre-contractual steps |
| Performance of the contract, invoicing and accounting | Contractual and invoicing data | Art. 6(1)(b); Art. 6(1)(c) — legal obligation (tax and accounting law) |
| After-sales support, warranty and complaint handling | Identification, contact, work data | Art. 6(1)(b) and (c); legitimate interest — Art. 6(1)(f) |
| Website security, prevention of abuse, spam and fraud | IP address, technical logs, traffic data | Art. 6(1)(f) — legitimate interest |
| Displaying the Website in the appropriate language and remembering preferences | IP address (temporarily), language preference, cookie choices | Art. 6(1)(f) — legitimate interest; for storing the preference: Art. 6(1)(a) / express user request |
| Statistics and analysis of Website usage (analytics) | Cookie identifiers, usage data | Art. 6(1)(a) — consent. Not activated without your consent. |
| Marketing, advertising, remarketing, tracking pixels | Cookie identifiers, usage data | Art. 6(1)(a) — consent. Not activated without your consent. |
| Commercial communications / newsletter (not applicable at present) | Name, e-mail | Art. 6(1)(a) — consent, with the ability to unsubscribe at any time |
| Establishment, exercise or defence of legal claims | Any data relevant to the dispute | Art. 6(1)(f) — legitimate interest; Art. 9(2)(f) GDPR where applicable |
| Compliance with legal obligations (tax, accounting, archiving, requests from authorities) | Data required by law | Art. 6(1)(c) — legal obligation |
Where processing is based on consent, you may withdraw it at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before withdrawal. Where processing is based on legitimate interest, you have the right to object, as described in section 10.
6. Retention periods
| Data category | Retention period |
|---|---|
| Contact form messages / quote requests that do not result in a contract | Maximum 24 months from the last interaction, then deleted or anonymised |
| Commercial correspondence related to a contracted project | For the duration of the contract and 3 years after its termination |
| Contracts, invoices and accounting documents | 10 years from the end of the financial year, under Romanian accounting and tax law |
| Data needed for warranty | For the warranty period + the applicable limitation period |
| Technical / security server logs | 30–90 days, per the hosting provider’s policy |
| Cookies and similar technologies | According to each cookie’s individual duration, see the Cookie Policy |
| Proof of cookie consent | 6 months, after which consent is requested again |
| Newsletter (not applicable at present) | Until unsubscription or withdrawal of consent |
| Data involved in a dispute | Until the dispute is finally resolved and legal deadlines expire |
7. Who we may share data with
We do not sell your data. We may disclose it only to the following categories of recipients, strictly limited to the purpose pursued and under adequate contractual safeguards (Art. 28 GDPR processing agreements, where applicable):
- The web hosting and e-mail provider — the company providing the infrastructure on which the Website is hosted and the mailboxes of the consvitraliu.ro domain. Acting as a processor, it handles server logs (including the IP address) and the messages sent through the contact form.
- The affiliated production entity in the Republic of Moldova (Consvitraliu, IDNO 1003600035657, str. Transnistria 5/9, Chișinău), for the actual execution of the contracted work — see section 8.
- Accounting service providers and, where applicable, tax advisers, where relevant, for issuing and recording tax documents.
- Lawyers, consultants, auditors, where necessary to defend our rights.
- Analytics and marketing providers — currently none. If added, they will receive data only if you have given your consent through the cookie banner.
- Public authorities (tax authority, data protection authority, courts, criminal investigation bodies), where there is a legal obligation to disclose.
- Partners / subcontractors involved in carrying out the work, where applicable and strictly as necessary to complete the contracted project.
There are no payment processors or couriers, as the Website does not sell products online.
8. Transfers outside the European Economic Area (EEA)
As a rule, data is processed in Romania and within the European Union.
8.1. Transfer to the production site in the Republic of Moldova
Manufacturing of the contracted systems is carried out by the affiliated entity in the Republic of Moldova (str. Transnistria 5/9, MD-2037, Chișinău). To deliver the project we may share strictly necessary data with it: the name and contact details of the client or contact person, the installation address and the technical specifications of the work.
- Legal basis: performance of the contract to which you are a party (Art. 6(1)(b) GDPR).
- Legal status: the Republic of Moldova does not, at the time of drafting, benefit from an adequacy decision issued by the European Commission under Art. 45 GDPR, as verified at the date of the last update of this policy.
- Safeguards applied: the transfer is carried out on the basis of the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR), supplemented where necessary by additional technical and organisational measures (data minimisation, encryption in transit, restricted access).
- Alternatively, for occasional transfers strictly necessary for the conclusion or performance of a contract in your interest, the derogation under Art. 49(1)(b) and (c) GDPR may apply.
You may request a copy of the safeguards applied by writing to office@consvitraliu.ro.
8.2. Other providers outside the EEA
If tools such as Google Analytics, Google Tag Manager, Google Fonts, Google Maps, reCAPTCHA, Meta (Facebook) Pixel, TikTok Pixel, Cloudflare, Mailchimp or other services whose providers are established outside the EEA are used, data (including IP address and cookie identifiers) may be transferred to third countries, in particular to the United States of America.
In such cases, transfers are carried out based on one of the mechanisms under Chapter V GDPR:
- an adequacy decision of the European Commission (e.g. the EU–US Data Privacy Framework, for certified providers);
- standard contractual clauses adopted by the European Commission, supplemented where necessary by additional technical and organisational measures;
- other appropriate safeguards provided by law.
At present, the only recipients outside the EEA are the production site in the Republic of Moldova (section 8.1) and Google Fonts (below). If other tools are added, the list and the transfer mechanism applicable to each will be completed here before use. You may obtain a copy of the applicable safeguards by writing to office@consvitraliu.ro.
Important note: the Website currently loads fonts from Google Fonts. When these are loaded, the visitor’s IP address is transmitted to Google. To avoid this transfer, fonts can be self-hosted — a measure we are considering.
9. Data security
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure, including:
- HTTPS/TLS encrypted connection for data transmitted through the Website;
- strict validation and filtering of data submitted through the contact form, protection against content injection and automated submissions (anti-spam mechanisms and rate limiting);
- limited, need-to-know access to data, and strong passwords;
- regular updates of software components and the server;
- backups and infrastructure monitoring;
- confidentiality clauses with persons and entities processing data on our behalf.
Nevertheless, no IT system and no method of transmitting data over the internet can be guaranteed to be 100% secure. We cannot guarantee absolute data security, but we make reasonable efforts to maintain a level of security appropriate to the risk. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you under Art. 34 GDPR and notify the supervisory authority under Art. 33 GDPR.
10. Your rights
- Right to be informed (Art. 13–14 GDPR) — fulfilled through this policy.
- Right of access (Art. 15).
- Right to rectification (Art. 16).
- Right to erasure (“right to be forgotten”), under Art. 17.
- Right to restriction of processing (Art. 18).
- Right to data portability (Art. 20).
- Right to object to processing based on legitimate interest, including an unconditional right to object to direct marketing (Art. 21).
- Right to withdraw consent at any time, as easily as it was given (Art. 7(3)).
- Right not to be subject to a decision based solely on automated processing, including profiling (Art. 22). We do not take such automated decisions based on data collected through the Website.
- Right to lodge a complaint with the supervisory authority.
10.1. How to exercise your rights
You may send a written request to office@consvitraliu.ro or by post to the registered office indicated in section 2. We will respond within one month of receiving the request. This period may be extended by up to two further months depending on the complexity and number of requests, in which case we will inform you within the first month.
To protect your data, we may ask for additional information necessary to confirm your identity. Under Art. 12(5) GDPR, where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act on the request, giving reasons.
10.2. Complaint to the supervisory authority
You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP):
- Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336, Bucharest, Romania
- E-mail: anspdcp@dataprotection.ro · Website: www.dataprotection.ro
You may also bring the matter before the competent courts.
11. Cookies and similar technologies
The Website uses strictly necessary cookies to function and, only with your consent, preference, statistics, marketing and social media cookies. Non-essential cookies are not activated before consent is obtained. You can express, change or withdraw your choices at any time via the cookie banner or the “Cookie settings” link in the footer of every page. See the Cookie Policy.
12. Children’s data
The Website is not directed at children and we do not knowingly collect personal data of persons under 16. If you are under 16, please do not send us personal data through the contact form without the consent of your parent or legal guardian. If we learn that we have collected a minor’s data without a valid basis, we will delete it without undue delay. Parents or legal guardians can contact us at office@consvitraliu.ro.
13. Marketing and commercial communications
The Website currently does not provide a newsletter subscription form and does not send newsletter-type commercial communications.
If such a service is enabled, the following rules apply:
- subscription is based exclusively on explicit consent, through a clear affirmative action (unticked box); double opt-in confirmation is recommended;
- we keep proof of consent (date, time, IP address, accepted text);
- you may unsubscribe at any time, free of charge, via the link in each message; withdrawing consent is as easy as giving it;
- we do not send unsolicited commercial communications and do not sell e-mail addresses to third parties.
For existing clients, we may send information about services similar to those contracted, based on legitimate interest and under Art. 12 of Law no. 506/2004, with the right to object at any time.
14. Contact form / quote request
Through the form available on the Contact page we collect: name, company (optional), phone, e-mail, city, project type and your message. Mandatory fields are marked as such.
- Purpose: registering and handling your request, sending a quote and related communication.
- Legal basis: pre-contractual steps at your request (Art. 6(1)(b)) and/or consent given by ticking the box (Art. 6(1)(a)).
- Retention: as described in section 6.
- Recipients: designated internal staff and the e-mail/hosting provider.
The form includes technical anti-spam mechanisms (a hidden “honeypot” field, a completion-time check and rate limiting per IP address). The IP address is processed temporarily for this purpose, based on our legitimate interest in preventing abuse.
Please do not submit sensitive data through the form, nor personal data of other people without informing them and obtaining their consent.
15. Links to third-party websites
The Website may contain links to third-party websites. We do not control their content or privacy practices and accept no liability for them. We recommend reviewing the privacy policies of the websites you visit.
16. Changes to this policy
We may update this policy whenever legal, technical or organisational changes occur. The version in force is the one published on this page, together with the date of the last update. If the changes are substantial, we will inform you by appropriate means.
17. Contact
- Controller: CONSVITRALIU RO SRL
- E-mail: office@consvitraliu.ro · office@consvitraliu.com
- Phone: 0721 161 161 · 0723 005 000
- Production site: str. Transnistria 5/9, MD-2037, Chișinău, Republic of Moldova
- Working hours: Monday – Friday, 09:00 – 18:00
- Data Protection Officer: no DPO has been appointed; requests are addressed directly to the company, at office@consvitraliu.ro