Privacy policy

When you visit www.novoconcept.ro, contact us for a quote or use our services, you share your information with us. The purpose of this Privacy Policy is to explain what data we process, why we process it and how we use it. Your personal information belongs to you, and we make every effort to keep it safe. We do not provide information to third parties without informing you first. By browsing www.novoconcept.ro, contacting us, you confirm that you have been properly informed about how your data is processed by reading this document, the "Privacy Policy".

Definitions and terms

www.novoconcept.ro (the "Website") is the presentation website of SC INNOVO DESIGN CONCEPT SRL. The Website is owned and operated by SC INNOVO DESIGN CONCEPT SRL, registered office in Alexandria, Teleorman County, 9 Carpați Street, tax ID 40545902, Trade Register no. J/34/170/01.02.2019, hereinafter "NOVO CONCEPT".

Under Regulation (EU) 2016/679 (the “GDPR”) and Romanian Law no. 190/2018, SC INNOVO DESIGN CONCEPT SRL is a personal data controller.

"GDPR" means Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.

"Personal data" means any information relating to an identified or identifiable natural person ("data subject").

An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

SC INNOVO DESIGN CONCEPT may change this Privacy Policy at any time. All updates and changes take effect immediately after notice, given by posting on the Website and/or by email.

Questions and requests

If you have questions or concerns about how your data is processed, wish to exercise your legal rights regarding the data we hold, or have concerns about how we handle any privacy matter, you can contact us at [email protected].

What information do we collect?

Information you give us voluntarily

When you use the quote request forms on the Website, contact us by phone or email, or communicate with us in any other way, you voluntarily give us the information we process. This includes your first and last name, email address and phone number.

We keep this information secure and confidential in our database. We do not disclose or transfer it to third parties.

Information we collect automatically

When you browse our website, we measure visits with Cloudflare Web Analytics, a statistics service without cookies. We only see aggregated data: the number of visits, the pages visited, the country, the type of device and browser, the website you came from and how long the pages take to load. The service does not store anything on your device and does not keep your IP address, so this data does not tell us who you are. You can find more details in our Cookie policy.

What is the legal basis for processing?

For the data you give us voluntarily by completing and submitting forms or contacting us in any way, the legal basis is taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

Under the GDPR, your consent is not required where processing is necessary to take steps towards entering into a contract, to comply with a legal obligation or for a legitimate interest.

For the anonymous visit statistics, the legal basis for processing is our legitimate interest in understanding how the website is used and improving it. Because the statistics do not use cookies and do not identify you, we do not ask for your consent.

To protect the forms from automated messages (spam), we use Cloudflare Turnstile. When you start filling in a form, the service checks, based on technical signals about your browser and your IP address, that the submission comes from a person. The check does not use cookies and is not used for advertising or profiling. The legal basis is our legitimate interest in protecting our website and our mailbox. You can find more details in the Cloudflare Turnstile Privacy Addendum.

Why do we collect data?

  • to take the steps needed to enter into a contract;
  • to answer your questions and requests;
  • to protect ourselves against cyber attacks;
  • for marketing activities, but only if you have given your prior consent;
  • to send invitations to events we organise;
  • to provide and improve our services.

To stop receiving promotional messages, follow the unsubscribe instructions included in every email.

How long do we keep data?

We store personal data only for as long as necessary to fulfil these purposes, and no longer than 10 years from your last visit to the Website or your last interaction with us.

Who do we share your information with?

We will not disclose your information to third parties for their own marketing or commercial purposes. However, we may disclose your information to the following:

  • Service providers. We may disclose your information to other companies that provide services to us and act as processors, such as companies that help us with invoicing or send emails on our behalf. These are selected with particular care to make sure they meet specific personal data protection requirements, and they have a limited ability to use your information for purposes other than providing services to us;

The providers that process data on our behalf (processors) are:

  • Cloudflare, Inc. — website hosting, protection against attacks, the anti-robot check on the forms (Turnstile) and the anonymous visit statistics;
  • Resend — delivering the messages sent through the forms to us, from servers in the European Union (Ireland); it keeps a technical log of each delivery for a short period;
  • Google (Google Workspace) — the mailbox in which we receive and keep your messages.
  • Courts, prosecutors or other public authorities, to comply with the law or in response to a binding legal procedure (such as a search warrant or a court order);
  • Other parties with your consent or at your instruction. Apart from the disclosures described in this Privacy Policy, we may share information with third parties to whom you consent or ask us to make such a disclosure.

Do we transfer data to third countries?

Messages from the forms are sent through servers in the European Union. Cloudflare and Google may process some data outside the European Union, including in the United States. These transfers are based on the EU–US Data Privacy Framework, under which both companies are certified, and on the standard contractual clauses approved by the European Commission.

What are your rights?

  • The right to withdraw consent;

Where processing is based on consent, you can withdraw it at any time, free of charge, by emailing [email protected] with the subject "withdrawal of consent".

  • The right to lodge a complaint with a supervisory authority — in Romania, the National Supervisory Authority for Personal Data Processing (www.dataprotection.ro);
  • The right to go to court;
  • The right of access;

You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed and, if so, the right to access that data.

  • The right to rectification;

You have the right to obtain from us, without undue delay, the correction of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by providing a supplementary statement.

  • The right to erasure ("right to be forgotten");

Where the data is no longer needed for its purposes, consent has been withdrawn and there is no other legal basis for processing, you object to the processing and there are no overriding legitimate grounds, or the personal data has been processed unlawfully, you have the right to have the data concerning you erased without undue delay.

  • The right to restriction of processing;

You have the right to obtain from us a restriction of processing in any of the following cases:

(a) you contest the accuracy of the data, for a period enabling us to verify its accuracy;

(b) the processing is unlawful and you oppose the erasure of the personal data, requesting the restriction of its use instead;

(c) we no longer need the personal data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims;

(d) you have objected to processing under Article 21(1) of the GDPR, pending verification of whether our legitimate grounds override yours.

  • The right to data portability;

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from us, where:

(a) the processing is based on consent under Article 6(1)(a) or Article 9(2)(a) of the GDPR, or on a contract under Article 6(1)(b) of the GDPR; and

(b) the processing is carried out by automated means.

  • The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

This right does not apply if the decision:

(a) is necessary for entering into or performing a contract between you and a data controller;

(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights, freedoms and legitimate interests; or

(c) is based on your explicit consent.

How to exercise your rights

To exercise your legal rights, please contact us at [email protected].

Please note the following

  • Timeframe: we will try to respond to your request within 30 days. However, this period may be extended for specific reasons relating to the particular legal right or the complexity of your request.
  • Restricted access: in some situations we may not be able to give you access to all or some of your personal data because of legal provisions. If we refuse your access request, we will tell you why.
  • Inability to identify you.

In some cases we may not be able to look up your personal data because of the identifiers you provide in your request. An example is the visit statistics, which are anonymous and cannot be linked to your name or email address.

In such cases, if we cannot identify you as the data subject, we are unable to comply with your request unless you provide additional information that allows us to identify you.