Legal
Privacy policy
How we collect, use and protect personal data when you contact us or browse this site.
Last updated:
Data controller
- Legal name
- Ecoplast Hart SRL
- VAT / registration number
- 17059959
- Trade register
- J20/1943/2004
- Registered office
- B-dul Dacia nr. 2, Bl. E5, ap. 1, Hunedoara, Hunedoara county
- Operational site
- Șos. Hunedoarei nr. 13, Sat Cristur, Deva, Hunedoara county
- Phone
- +40 746 152 318
Who we are
Ecoplast Hart SRL is the controller of the personal data processed through this site, within the meaning of Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018. Our identification and contact details are set out in the table above.
We have not appointed a data protection officer, as our activity does not fall within the cases listed in Article 37 GDPR. Requests concerning personal data are handled directly by company management, at the email address above.
What data we collect
This site contains no forms and does not ask you to create an account. Data reaches us in two ways:
- Data you send us directly, when you email or call us: your name, email address, phone number, the company you represent and any other information you choose to include in your message.
- Technical data generated automatically when you visit the site: IP address, device and browser type, referring page, pages visited and time of access. This is collected by the infrastructure hosting the site and by the traffic analytics tool.
We do not collect special categories of data (health, beliefs, trade union membership) and we do not knowingly seek personal data from minors.
Why we process the data, and on what basis
We process data solely for the purposes below, each with its legal basis under Article 6(1) GDPR:
- To answer your enquiry and send you a quote — basis: steps taken at your request prior to entering into a contract, point (b).
- To perform the contract and issue waste transport and traceability documents — basis: performance of a contract, point (b).
- To meet the tax, accounting and waste-reporting obligations imposed on us by law — basis: legal obligation, point (c).
- To keep the site working and secure, and to understand in aggregate how it is used — basis: our legitimate interest in operating and improving the site, point (f).
We do not use your data for direct marketing, profiling, or automated decision-making that produces legal effects concerning you.
Who we share data with
We do not sell or rent personal data. We disclose it only to the suppliers who help us operate this site, acting as processors on our instructions, and to public authorities where the law requires it.
The suppliers involved in running this site are:
- Vercel Inc. — website hosting and traffic analytics.
- Clerk, Inc. — user authentication for the site's private administration area.
- Convex, Inc. — storage of the content and documents published on the site.
These suppliers are established in the United States. Transfers outside the European Economic Area are carried out on the basis of the Standard Contractual Clauses adopted by the European Commission and, where applicable, the EU–U.S. Data Privacy Framework.
How long we keep data
We keep commercial correspondence for the duration of the discussions and, where these lead to a working relationship, for the duration of that relationship.
Accounting records and waste-management records are kept for the periods required by the applicable legislation, which generally range between 3 and 10 years depending on the type of document.
Technical traffic data and aggregate statistics are kept for no more than 24 months, after which they are deleted or irreversibly anonymised.
Your rights
As a data subject, the GDPR gives you the following rights in relation to your data:
- The right of access — to find out whether we process data about you and to receive a copy of it.
- The right to rectification — to have inaccurate data corrected and incomplete data completed.
- The right to erasure — to have data deleted where we no longer have a basis for keeping it.
- The right to restriction of processing — to have processing paused while we verify a challenge.
- The right to data portability — to receive your data in a structured, commonly used format.
- The right to object — to object to processing based on our legitimate interest.
- The right not to be subject to a decision based solely on automated processing.
You can exercise any of these rights by sending a request to our email address. We will respond within one month of receiving it. If our response does not satisfy you, you have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP, B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, anspdcp@dataprotection.ro) or to bring the matter before the competent court.
Data security
The site is served exclusively over an encrypted HTTPS connection, and access to the administration area is protected by authentication. We apply reasonable technical and organisational measures to protect data against unauthorised access, loss or accidental disclosure.
No system is entirely invulnerable, however. If a personal data breach occurs that is likely to affect your rights, we will inform you and notify the supervisory authority within the deadlines set by the GDPR.
Changes to this policy
We may update this policy when the services we rely on or the applicable legal requirements change. The version in force is always the one published on this page, and the date it was last updated is shown at the top of the document.
The details of the cookies this site sets — what they are, who sets them and how long they last — are in a separate document.
Read the cookie policy