Updated 19 October 2026 · Version 3
This notice explains the processing of data relating to edmarom.ro, commercial enquiries and applications sent using the contact details published here. Browsing does not imply acceptance of a policy and does not require you to accept optional services.
1. Who is responsible for your data
Controller: EDMAROM PROD - 2007 SRL, tax ID RO22238268, registered with the Trade Register under number J2007015098400.
Registered office: Str. Novaci nr. 7, bl. P52, sc. 1, et. 8, ap. 26, sector 5, municipiul București, România.
Operating site: Șoseaua Ștefănești nr. 15, Ștefăneștii de Jos, județul Ilfov.
For questions or to exercise your rights: office@edmarom.ro, telephone 0745 041 992, or write to the registered office, marked “Data protection”.
2. Data, purposes and legal bases
- Website operation and security: the hosting server may record your IP address, access time, requested page, technical browser data and errors. The legitimate interest is to provide a secure website and prevent abuse (Article 6(1)(f) GDPR).
- Enquiries and quotations: when you contact us, we receive your name, contact details, the company you represent and the information or documents you provide. We use them to respond and prepare a quotation: pre-contractual steps requested by you (Article 6(1)(b)) or our legitimate interest in communicating with business partners’ representatives (point (f)).
- Contracts and supporting documents: data needed to perform a contract and comply with legal obligations is processed under Article 6(1)(b) and (c). Disputes may require relevant data to be retained to defend legal rights (point (f)).
- Job applications: if you send a CV, we use your contact details, experience and qualifications to assess your application and communicate with you as pre-contractual steps (point (b)). Do not send personal identification numbers, identity document copies or medical data unless justifiably requested at a later stage. Retention for other recruitment requires separate information and a legal basis.
- Google Maps: your consent (Article 6(1)(a) GDPR and the applicable provisions of Romanian Law No. 506/2004) allows the map to load. Videos are not embedded: preview images are hosted locally, and pressing play opens YouTube in a new tab. See details and options.
Contact details and relevant information are needed to respond to or assess a request; without them, handling it may be impossible. Consent to optional cookies is not required to contact us. The website does not include user accounts, online payments or newsletter signup forms.
3. Who may receive data
Depending on the request, data may be accessed by the people in our company who handle it and by necessary hosting, email, IT maintenance, accounting or advisory providers. Website hosting is provided through Zooku Solutions SRL. Data may be disclosed to authorities where required by law. Do not include data in your messages that is unnecessary for your request.
When maps are enabled, Google Ireland Limited receives technical and interaction data and processes it according to Google’s policy. If you are signed into Google, its services may associate activity with that account. External links opened voluntarily are subject to the destination website’s rules.
4. International transfers
Google services you enable may involve processing outside the European Economic Area, including in the USA. Google describes the use of adequacy decisions and standard contractual clauses, as applicable, in its transfer information. Consent to load content does not replace the safeguards required by GDPR for transfers. You can ask us about the providers and safeguards applicable to data sent directly to our company.
5. How long we retain data
Retention depends on the purpose and applicable obligations. Enquiries are retained as long as necessary to respond and conduct related discussions; documents that become part of a contractual relationship follow the relevant statutory periods. Recruitment data is needed during selection and, where justified, to handle challenges or defend a right. Further retention must not exceed the period justified by its purpose.
Technical logs are subject to the hosting provider’s rotation and security rules; incident-related data may be needed until investigation is complete. You can request the specific period applicable to your situation. The cookie preference expires in this browser after 180 days. External service durations are explained in the cookie policy.
6. Your rights
Under the conditions of GDPR, you can request access, rectification, erasure, restriction and portability. Depending on your situation, you may object to processing based on legitimate interests, and to direct marketing at any time. Rights are not absolute; for example, a legal obligation may prevent certain documents from being erased.
You can withdraw consent for optional services through “Cookie settings”. Withdrawal does not affect the lawfulness of earlier processing. For other requests, write to office@edmarom.ro. The usual response period is one month; extensions permitted by law must be justified and communicated. Proportionate information may be needed to verify identity. This website does not make solely automated decisions with legal or similarly significant effects on you.
You have the right to lodge a complaint with ANSPDCP, www.dataprotection.ro, or to seek a remedy before the competent courts.
7. Changes
We update this notice when website functions or relevant processing change. For new optional purposes, we ask for a new choice before activation.
Form security and submission records
On the public site, quotation requests, configurator requests and job applications use Cloudflare Turnstile verification before sending. The check loads at the submission step, separately from the Google Maps preference.
Cloudflare receives technical data, including IP address and browser information, for abuse prevention. Resend processes configurator message content and attachments for delivery. Quotation and careers forms use the hosting email service. Requests go to office@edmarom.ro; the configurator also sends a copy to the address supplied by the requester. Private tests send synthetic messages only to office@edmarom.ro.
Cloudflare and Resend services may involve processing outside the European Economic Area. Provider information and applicable safeguards are linked below; you can ask us for details at office@edmarom.ro.
First-party cookies __Host-edmarom-quote, __Host-edmarom-career and __Host-edmarom-configurator contain signed session identifiers to protect submissions. They use Secure, HttpOnly and SameSite=Strict and last at most 24 hours from issue. Their expiry does not delete server-side submission records.
The language preference is kept in sessionStorage under edmarom_language for the browser session. Before sending, the configurator stores a localStorage key edmarom-configurator-pending-v1:… containing an opaque identifier and package hash, not contact details or files. The marker is removed after confirmation or a safe rejection before dispatch; an uncertain outcome leaves it without automatic expiry to prevent resending. Contact us for reconciliation; clearing browser storage does not resolve the server-side outcome.
The server retains technical anti-abuse and duplicate-prevention records: cryptographic hashes of session, IP, request and, where applicable, destination, plus times, statuses and delivery references. These records are not copies of the message or CV and are not automatically deleted after 24 hours. They are managed through manual review and reconciliation and currently have no automatic expiry. Retention of requests, CVs and attachments in email follows the purposes and retention rules described in the privacy notice, separately from these technical records.
Provider information: Cloudflare Turnstile · Resend
