Legal information

Privacy and Data Protection Policy

Who is the operator, what data do we collect via the contact form, on what legal basis do we process it, how long do we store it, to whom do we transmit it, and how do you exercise your GDPR rights.

Request a quote 0730 900 200

1. Data controller

The personal data controller is Sulfatim SRL Timisoara, CUI 9120540, Nr. Reg. Com. J1997000035356, with registered office in Str. Nicolae Iliesu nr. 8, Timisoara 300730, Romania.

Sulfatim SRL has not designated a data protection officer (DPO). Requests regarding personal data should be sent by email to office@sulfatim.ro or in writing to the company's registered office. For quick questions, you can also contact us by telephone at 0730 900 200.

We are committed to processing personal data in accordance with Regulation (EU) 2016/679 (GDPR), Legea nr. 190/2018, and Legea nr. 506/2004, applying the principles of lawfulness, data minimization, accuracy, storage limitation, integrity, and confidentiality.

2. What data we collect and from where

We collect only the data necessary to respond to inquiries and perform contracted works. Most data is received directly from you via the contact form, by email, or by telephone.

Identification and contact details: full name, company name, job title, email address, telephone number.
Inquiry details: job description, type of crane or equipment, estimated timeframe, location, and site access conditions.
Contractual and financial data, for clients: billing details, purchase orders, acceptance reports, technical correspondence.
Technical browsing data, collected through cookies only with your consent: page accessed, traffic source, device type, visit duration.

We do not request and do not require special categories of data (data concerning health, beliefs, biometric data) and do not intentionally collect data of minors. Please do not include sensitive or confidential information in the form that is not necessary for assessing the job.

3. Purposes, legal bases and storage duration

Purpose of processing	Processed data	Legal basis	Retention period
Response to inquiries submitted via the contact form and offer preparation	Name, company, email, phone, work description, requested equipment and period, work location	Art. 6 para. (1) lit. b) GDPR - pre-contractual steps at the request of the data subject	24 months from the last communication, if no contract is concluded
Execution and management of works, rental or transport contracts	Identification and contact details of representatives, data from orders, minutes, technical correspondence	Art. 6 para. (1) lit. b) GDPR - contract execution	For the duration of the contract and subsequently according to legal archiving terms
Fulfillment of tax, accounting, and document archiving obligations	Data from invoices, transport documents, and payment documents	Art. 6 para. (1) lit. c) GDPR - legal obligation	5 years, calculated from 1 July of the year following the end of the financial year (art. 25 of Legea contabilitatii nr. 82/1991, amended by Legea nr. 36/2023), including for payroll records; documents may be retained longer only if required by a special law or for the duration of an audit, dispute, or pending proceedings
Compliance with occupational safety requirements and authorization for crane and equipment operations	Data regarding designated persons, authorizations, training, and work permits	Art. 6 para. (1) lit. c) GDPR - legal obligation in the field of OHS and ISCIR authorizations	According to deadlines stipulated by applicable regulations
Website usage statistics and improvement of published information	Accessed page, access source, device type, visit duration, session ID, anonymized IP address	Art. 6 para. (1) lit. a) GDPR - consent, expressed via cookie banner	Maximum 14 months
Defense of rights in case of dispute, complaint, or authority inspection	Relevant correspondence and project documents	Art. 6 para. (1) lit. f) GDPR - legitimate interest	For the duration of the applicable statute of limitations

Providing data in the contact form is voluntary, but necessary for us to respond: without a name, email or telephone number, and the job description, we cannot provide a quote.

4. To whom we transmit data and international transfers

We do not sell personal data and do not use it for commercial profiling. We may transmit it only to the following categories of recipients, strictly within the limits of what is necessary:

Lovable Cloud, the hosting platform for the website and database, where requests submitted via the contact form are stored; acts as a data processor pursuant to Art. 28 GDPR;
MXHost, which separately hosts email correspondence for company addresses (for example office@sulfatim.ro), when you write to us directly by email;
Google Ireland Limited, through the Google Analytics 4 service, used for website traffic analysis only after you give consent for analytics cookies;
subcontractors and partners directly involved in performing the requested work, when necessary;
accounting, auditing, legal advisory services, insurance companies;
public authorities, courts, or supervisory bodies, upon their lawful request.

The contact form does not send automatic email notifications: inquiries remain in the website database and are accessed by Sulfatim personnel via the administration area. We do not use Google Ads, remarketing, or conversion tracking.

The website database is hosted in a data center within the European Union (Ireland). If a service provider processes data outside the European Economic Area, the transfer is carried out solely on the basis of an adequacy decision of the European Commission, standard contractual clauses, or other safeguards provided for in Chapter V of the GDPR.

5. Data Security and Incidents

We implement appropriate technical and organizational measures: encrypted data transmission via HTTPS, access to received inquiries restricted to authorized users with individual accounts created by invitation, and record-level security rules in the database.

In the event of a security incident that poses a risk to the rights and freedoms of data subjects, we notify ANSPDCP within 72 hours of becoming aware of the incident and inform the affected individuals when the risk is high.

6. Your rights

As a data subject, you have the following rights, which you can exercise free of charge:

Right of access

You can find out what data we process about you and receive a copy of it.

Right to rectification

You can request the correction of inaccurate data or the completion of incomplete data.

Right to erasure

You can request the erasure of data when it is no longer necessary for the purpose for which it was collected and there is no legal obligation to retain it.

Right to restriction of processing

You can request restriction of processing, for example, during the verification of data accuracy.

Right to data portability

You can receive the data you provided in a structured, commonly used, and machine-readable format.

Right to object

You can object to processing based on legitimate interest by presenting reasons for your particular situation.

Withdrawal of consent

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right not to be subject to automated decision-making

We do not make exclusively automated decisions and do not perform profiling based on data collected through the site.

7. How to submit a request regarding your data

Requests regarding the exercise of rights must be sent by email to office@sulfatim.ro with the subject "GDPR Request", or in writing to the company's registered office: Str. Nicolae Iliesu nr. 8, Timisoara 300730.

In order to provide an accurate response, the request should include:

the applicant's first and last name;
the contact details where you wish to receive the reply (email or postal address);
the invoked right and, briefly, what you are requesting (for example, deletion of the request submitted via the form);
any details that help us identify the data: approximate date of the inquiry, quotation number, email address used in the form.

We respond within at most 30 days of receiving the request. The deadline may be extended by up to two months for complex requests, in which case we will inform you about the extension and the reasons for it. If there are reasonable doubts regarding the identity of the applicant, we may request additional information for verification, strictly for this purpose.

Requests are free of charge. For manifestly unfounded or excessive requests, particularly repetitive ones, we may charge a reasonable fee or refuse to act on the request, stating reasons, pursuant to Art. 12 para. (5) GDPR.

8. Complaints and supervisory authority

If you are not satisfied with the response received, you may lodge a complaint with Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucuresti, and you may contact the competent courts of law at any time.

9. Policy updates

This policy may be updated when processing activities, providers, or legal requirements change. The version published on this page is the applicable one. Information about cookies can be found in Cookie Policy, and the website terms of use in Terms of Use.