Privacy policy

1. Who we are

The data controller is S.C. EST GAZ S.R.L., tax ID RO 6648460, Trade Register no. J02/1798/1994, registered office at Str. Tudor Vladimirescu 4, 310010 Arad, Romania, with an office at Str. Martir Cristina Lungu 6, 300585 Timișoara, Romania.

For any question or request about your personal data, email info@estgaz.ro, call +40 770 280 605 or write to our Arad address. The company is not required to appoint a data protection officer (DPO); requests are handled directly by the company's management.

2. What data we process

We only process the data we need to reply to you and to work together:

• Data sent through the contact form: name, email address, phone (optional), type of work and your message.
• Data from messages sent directly by email, phone or WhatsApp: your name, contact details and any project information you choose to share.
• For clients: the data needed to sign and perform the design contract (for example contact person, billing details, information about the property and the investment).
• Technical data generated automatically when you visit the site: IP address, browser type, page visited, date and time. These appear in the server and Cloudflare logs and are used only to run and secure the site.

Please do not send sensitive data (for example health data) through the form. We do not need it for our services.

3. Why we process data and on what legal basis

• To reply to enquiries and prepare quotes: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• To sign and perform design, review, expertise or consulting contracts: performance of a contract (Art. 6(1)(b) GDPR).
• For invoicing, accounting and archiving: compliance with the company's legal obligations (Art. 6(1)(c) GDPR).
• For website security and abuse prevention (technical logs, spam filter, message rate limit): our legitimate interest in keeping the site secure and working (Art. 6(1)(f) GDPR).

We do not use your data for marketing, and we do not sell or rent it. We make no automated decisions and do no profiling.

4. Cookies and external services

The site uses no analytics, advertising or tracking cookies and includes no tools such as Google Analytics or social media pixels. That is why we do not ask for cookie consent.

Cloudflare, which protects the site, may set a strictly necessary cookie to tell real visitors from bots. Fonts and images are hosted on our own server, so visiting the site does not send data to Google or other font services.

The site contains plain links to the company's Facebook page. They load nothing from Facebook and send no data to Meta unless you open them. If you visit our Facebook page, your data is processed by Meta Platforms Ireland Ltd. under its own privacy policy.

If you choose to contact us on WhatsApp, your data is also processed by WhatsApp (Meta) under its own privacy policy.

5. Who receives the data

Only EST GAZ staff who need the data can access it. We share it only with the following recipients, as far as necessary:

• Our web and email hosting provider (inarad.ro), which stores the website and the info@estgaz.ro mailbox.
• Cloudflare, Inc., which delivers and protects the website. Cloudflare may process technical data outside the European Union, including in the United States. Such transfers rely on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified, and on the European Commission's standard contractual clauses.
• Our accountant, legal advisers or other contractors working for us, only when needed and bound by confidentiality.
• Public authorities, only when the law requires it.

6. How long we keep data

• Messages and quotes that did not lead to a contract: up to 2 years after our last exchange, then deleted.
• Contract, invoicing and accounting data: for the length of the contract and then for the period required by Romanian accounting and archiving law.
• Technical log data: for a limited period set by our hosting provider and Cloudflare for security purposes.
• Data used by the message rate limit (an encoded form of the IP address): 60 seconds.

7. Your rights

Under the GDPR you have the right to:

• access the data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased (“right to be forgotten”);
• restrict processing;
• data portability;
• object to processing based on our legitimate interest.

To exercise your rights, email info@estgaz.ro. We reply free of charge within one month of receiving your request. For complex requests this may be extended by two further months, and we will tell you if so.

If you believe your data has been processed unlawfully, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, email anspdcp@dataprotection.ro, phone +40 31 805 9211, www.dataprotection.ro. You may also contact the data protection authority in your own EU country.

8. How we protect data

The site works only over an encrypted connection (HTTPS). Access to the mailbox and the hosting server is password-protected and limited to the people who need it. The contact form does not store messages on the website; they go straight to the info@estgaz.ro mailbox.

9. Changes to this policy

We may update this policy when the way we work or the law changes. The version in force is always the one published on this page, with the last-updated date shown above.