Privacy notice

Notice version: 2026-10-15.1

Draft for review. STIROM must complete retention rules and provider details before publishing this version.

1. Who is responsible

STIROM SRL
J1994001353133 · CIF RO5459714
STR. CRISULUI NR.4, 900309 CONSTANTA, Jud. CONSTANTA, România
office@stiromltd.ro

2. Contact and quote requests

We process your name, email and message; quote requests also include company, phone and the requested product. These details are needed to assess and respond. Do not submit sensitive data or unnecessary documents. New messages are sent by SMTP to office@stiromltd.ro in Google Workspace without recording their content in the website database. An SMTP rejection displays an error; SMTP acceptance does not guarantee inbox delivery.

3. Purposes and legal bases

For pre-contractual steps requested by a person who will be a party to the contract, Article 6(1)(b) GDPR may apply. General correspondence, business contacts and security rely on the legitimate interest in responding and protecting the service under Article 6(1)(f), with an assessment of individuals’ interests and rights. Newsletter and optional tracking rely on consent. Legal obligations apply only where processing is required by law.

4. Newsletter

When enabled, subscription requires a separate choice and email confirmation. We store email, language, the consent text and version, request time and confirmation time. Quote and contact forms do not subscribe you. Each newsletter includes an unsubscribe link. Unsubscribing removes the subscription and associated evidence from the active database; backups follow their rotation policy.

5. Technical data and statistics

The website uses sessions for security and forms. Abuse prevention uses identifiers derived from IP addresses; these are not treated as anonymous data. Application security logs have a 90-day cleanup rule and temporary rate limits a 48-hour rule, provided the maintenance cron runs. Internal statistics store page views by day and page, without individual identifiers in the visits table. ROMARG and Google may have separate technical logs.

6. Recipients and providers

Operational access is limited to authorised STIROM staff. Providers include ROMARG hosting and Google Workspace email, under the applicable contracts. Authorities may receive data pursuant to lawful requests. Workspace does not exclude GDPR obligations or lawful access by authorities.

7. Transfers and contractual terms

TO COMPLETE before publication: services and processing locations, subprocessors and safeguards for any transfers outside the EEA. Provider names alone do not establish that all data stays in Romania.

8. Retention

TO COMPLETE before publication: criteria or periods for Workspace correspondence, historical messages, unconfirmed subscriptions, subscribers and backups. New contact/quote messages are not saved in the dashboard. Automatic deletion of historical data has not been enabled.

9. Your rights

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and, where applicable, portability, and object to legitimate-interest processing. You may withdraw consent without affecting prior lawful processing. Write to office@stiromltd.ro or our registered address. We respond without undue delay, normally within one month; a further two-month extension is possible under GDPR conditions, with notice in the first month. Where there are reasonable identity doubts, we request only necessary additional information.

10. Complaints and other information

You may complain to ANSPDCP at www.dataprotection.ro without losing your right to judicial remedies. The described website forms do not use solely automated decisions producing legal or similarly significant effects. Refusing newsletters or tracking does not prevent a quote request. Missing necessary request details may prevent us from responding. This notice is updated when processing changes; updates are not automatic consent to new purposes.