Privacy policy

Who is responsible for your data

The controller is Rofactory Prod SRL, the manufacturer of Ristone products, Romanian company number J4/142/2021, tax code (CUI) 43607350, with its registered office and factory in Bacău county, Romania (Digul Nou 16, Bacău). Phone +40 742 336 633, email [email protected].

For any question about your data, or to exercise your rights, write to [email protected].

What we collect and why

When you ask for a quotation

Through the enquiry form you send us your name, phone number, email address (optional), town and country, company name and tax or VAT number (optional), the products and quantities or your calculator result, and your message.

We use them to reply, to check products and quantities and to send you a quotation. The legal basis is taking steps at your request before entering into a contract: Article 6(1)(b) of Regulation (EU) 2016/679 (GDPR) and, for visitors in the United Kingdom, the UK GDPR. If your enquiry becomes an order, invoicing data is kept as accounting law requires.

We do not use these details for advertising and we do not sell them.

When you call us or message us on WhatsApp

We use your number and messages only to reply. WhatsApp is a Meta service with its own privacy rules.

When you visit the site

• Without your consent: only cookieless statistics (Cloudflare Web Analytics and Ahrefs Web Analytics), which count visits without identifying you. The legal basis is our legitimate interest in knowing how the site is used (Article 6(1)(f) GDPR).
• Only if you accept: Google Analytics 4 and Microsoft Clarity, which use cookies to show us which pages are useful and where visitors get stuck. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time from “Cookie settings” in the site footer. Details in the cookie policy.

When you submit, we store your IP address, approximate Cloudflare network location (country, region and city where available), time zone, network, browser information, page and available referral context, including campaign parameters present in the URL, with your enquiry. This helps us check and understand the enquiry and protect against abuse. We do not request GPS access; IP location may be inaccurate. This context is accessible only in the protected enquiry panel and is deleted with the enquiry within the same 24-month period. Submission rate limiting separately uses the IP temporarily in memory. For checking enquiries and preventing abuse, the proposed basis is legitimate interests (GDPR Article 6(1)(f)); you may object on grounds relating to your particular situation under Article 21 GDPR.

Who can access your data

• Ristone, through its password-protected enquiry panel;
• Alkeme Design, which built and maintains the site and the panel, as a processor, for technical maintenance only;
• Cloudflare, which hosts the site, the form and the enquiry database;
• Google (Google Analytics) and Microsoft (Clarity), only if you accept statistics cookies;
• the email provider that delivers enquiry notifications to us, once connected.

Some of these providers may process data outside the European Economic Area, for example in the United States. Such transfers rely on the safeguards provided by the GDPR, such as the European Commission’s adequacy decision for the EU-US Data Privacy Framework or standard contractual clauses.

We do not pass your data to anyone else, unless the law requires it.

How long we keep it

• enquiries: 24 months from submission, then deleted automatically;
• invoicing data, if you become a customer: as long as accounting law requires;
• Google Analytics and Clarity data: according to those services’ settings, described in the cookie policy.

Your rights

Under the GDPR (and the UK GDPR), you have the right:

• to know what data we hold about you and to get a copy (Art. 15);
• to have it corrected (Art. 16);
• to have it erased (Art. 17);
• to restrict processing (Art. 18);
• to receive your data in a structured format (Art. 20);
• to object to processing based on legitimate interest (Art. 21);
• to withdraw your consent at any time, without affecting what was done before.

Write to [email protected]. We reply within one month of receiving your request.

If you think your data is not handled correctly, you can complain to the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro), to the supervisory authority in your own EU country, or, in the United Kingdom, to the Information Commissioner’s Office (ico.org.uk).

Changes

When the way we process data changes, we update this page and the date above.