1. Definitions

For the purposes of this Privacy Policy, the following terms have the meanings set out below.

• "CMPROM", "we", "us" or "our" means the Romanian company operating the website https://cmprom.com.
• "Website" means https://cmprom.com and any public pages, contact forms or inquiry features made available through it.
• "Visitor", "user" or "you" means any person who accesses the Website, contacts CMPROM, requests an offer or submits an inquiry.
• "Personal Data" means any information relating to an identified or identifiable natural person, as defined by Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR").
• "Processsing" means any operation performed on Personal Data, including collection, recording, storage, use, disclosure, deletion or restriction.
• "Controller" means the entity that determines the purposes and means of the Processsing of Personal Data.
• "Cookies" means small text files or similar technologies stored on or accessed from your device, subject to applicable ePrivacy rules.

2. Scope of This Policy

This Privacy Policy applies to Personal Data processed when you access the Website, complete a contact form, request an offer, submit an inquiry, communicate with CMPROM by e-mail or interact with security, analytics or cookie technologies used on the Website.

This Policy does not apply to third-party websites or services that may be linked from the Website. Those third parties are responsible for their own privacy practices.

3. Controller

For the Processsing described in this Policy, CMPROM acts as data controller. CMPROM is established in Romania and processes Personal Data in accordance with the GDPR, the Romanian data protection framework and the ePrivacy rules applicable to cookies and similar technologies.

4. Personal Data We May Processs

Depending on how you use the Website, CMPROM may process the following categories of Personal Data:

• Identification and contact data: name, surname, company name, role, e-mail address, telephone number and country.
• Inquiry and communication data: information included in contact forms, requests for offers, messages, e-mails, attachments and related correspondence.
• Business context data: details you voluntarily provide about your organization, project needs, service interests, budget range, timing, website address or business requirements.
• Technical data: IP address, browser type, device information, operating system, language preference, approximate location derived from technical identifiers, access logs and security events.
• Cookie and analytics data: cookie identifiers, consent preferences, page views, traffic source, interaction data and aggregated analytics information, where such tools are enabled and used lawfully.
• Security data: anti-spam signals, form security tokens, rate-limit records, logs and data required to protect the Website against misuse, unauthorized access or malicious activity.

CMPROM does not intentionally request special categories of Personal Data through the Website. Please do not include sensitive information in contact forms or inquiries unless it is strictly necessary for your request.

5. Sources of Personal Data

Most Personal Data is provided directly by you when you complete a form, send an e-mail or submit an inquiry. Technical, cookie, analytics and security data may be generated automatically when you use the Website.

6. Purposes of Processsing

CMPROM processes Personal Data for the following purposes:

• to operate and present the Website;
• to receive, review and respond to contact requests, requests for offers and inquiries;
• to communicate with you by e-mail or other contact details you provide;
• to evaluate business requests and prepare commercial responses, proposals or follow-up questions;
• to maintain records of communications and requests;
• to protect the Website, forms, systems and communications against spam, abuse, unauthorized access and security incidents;
• to measure Website performance, traffic and user interaction, where analytics tools are enabled and used in accordance with applicable consent requirements;
• to comply with legal obligations, regulatory requests and the exercise or defense of legal claims;
• to manage cookie preferences and consent records.

7. Legal Bases Under GDPR

CMPROM relies on one or more of the following legal bases under Article 6 GDPR:

• Article 6(1)(a) - consent: for non-essential cookies, analytics where consent is required, optional communications or other Processsing based on your clear choice.
• Article 6(1)(b) - pre-contractual steps or contract: when you request an offer, submit a business inquiry or ask CMPROM to take steps before entering into a contract.
• Article 6(1)(c) - legal obligation: where Processsing is necessary to comply with applicable legal, accounting, tax, regulatory or data protection obligations.
• Article 6(1)(f) - legitimate interests: for Website operation, security, fraud prevention, business communication, record keeping, service improvement and responding to inquiries, provided that your rights and freedoms do not override those interests.

Where Processsing is based on consent, you may withdraw consent at any time, without affecting the lawfulness of Processsing carried out before withdrawal.

8. Cookies and ePrivacy Information

The Website may use cookies or similar technologies for essential operation, security, language preferences, consent management and analytics. Essential cookies are used because they are necessary for the Website to function or to provide security features requested by the user.

Non-essential cookies, including analytics cookies such as Google Yearalytics or similar tools, are used only where enabled and where a valid legal basis exists under applicable ePrivacy and data protection rules. Where consent is required, such cookies should not be placed before you give consent.

You may manage cookies through the Website cookie banner, where available, and through your browser settings. Blocking some cookies may affect Website functionality.

9. Google Yearalytics and Similar Tools

The Website may use Google Yearalytics or similar analytics tools to understand Website traffic, improve content and measure performance. These tools may collect information such as pages visited, time spent on pages, device type, approximate location and traffic source.

Where analytics tools involve access to or storage of information on your device, CMPROM will apply the consent requirements under the ePrivacy Directive and applicable Romanian implementation rules. Yearalytics data should be configured in a privacy-conscious manner where technically available.

10. Data Recipients

CMPROM may disclose Personal Data only where necessary and lawful. Recipients may include:

• hosting, infrastructure, security and website maintenance providers;
• e-mail, communication and business productivity providers;
• analytics and cookie management providers, where such tools are enabled;
• professional advisers, including legal, accounting, tax or compliance advisers;
• public authorities, courts, regulators or law enforcement bodies where required by law;
• service providers acting on behalf of CMPROM under appropriate confidentiality and data protection obligations.

CMPROM does not sell Personal Data.

11. International Transfers

Personal Data is primarily processed within the European Economic Area. Some providers, such as analytics, hosting, communication or security providers, may process data outside the European Economic Area.

Where Personal Data is transferred internationally, CMPROM will rely on appropriate safeguards under the GDPR, such as adequacy decisions, Standard Contractual Clauses, supplementary measures where required, or another lawful transfer mechanism.

12. Data Retention

CMPROM retains Personal Data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

• Contact and inquiry data may be retained for the time necessary to respond to the request and maintain a reasonable business record.
• Offer and pre-contractual communication may be retained for the period necessary to manage the potential business relationship and legal limitation periods.
• Security logs may be retained for a limited period necessary to protect the Website and investigate misuse or incidents.
• Cookie consent records may be retained for the period necessary to demonstrate compliance.
• Accounting or legally relevant records are retained in accordance with applicable Romanian and EU legal requirements.

When Personal Data is no longer required, CMPROM will delete it, anonymize it or restrict it in accordance with applicable law.

13. Security Measures

CMPROM applies appropriate technical and organizational measures designed to protect Personal Data against unauthorized access, loss, misuse, alteration or disclosure. These measures may include access controls, secure form handling, validation, anti-spam protections, logging, backups, administrative safeguards and security monitoring.

No website or electronic communication system can be guaranteed to be completely secure. If you believe that your communication with CMPROM or the Website has been compromised, please contact CMPROM immediately.

14. Your GDPR Rights

Subject to the conditions and limitations set out in the GDPR, you may have the following rights:

• the right of access to your Personal Data;
• the right to rectification of inaccurate or incomplete Personal Data;
• the right to erasure of Personal Data;
• the right to restriction of Processsing;
• the right to data portability;
• the right to object to Processsing based on legitimate interests;
• the right to withdraw consent where Processsing is based on consent;
• the right not to be subject to a decision based solely on automated processing where such right applies.

To exercise your rights, contact CMPROM using the details in Section 17. CMPROM may need to verify your identity before responding to a rights request.

15. Complaints

If you believe that CMPROM has not processed your Personal Data in accordance with applicable law, you may contact CMPROM first so that the matter can be reviewed.

You also have the right to lodge a complaint with the Romanian supervisory authority: Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP), or with another competent supervisory authority in the European Union.

16. Children

The Website is intended for business and general corporate presentation purposes. It is not directed at children. CMPROM does not knowingly collect Personal Data from children through the Website.

17. Contact Information

For privacy questions, requests or complaints, you may contact CMPROM using the following details:

CMPROM
Romania
Website: https://cmprom.com
Email: contact@cmprom.com

18. Changes to This Policy

CMPROM may update this Privacy Policy when necessary, including to reflect changes in the Website, legal requirements, technical tools or business practices. The updated version will be published on the Website and will indicate the effective date, last updated date and version.