Privacy Policy for RomaniaShelf Solutions
How we handle the personal data from our forms and the data our analytics collect.
Last updated 23 October 2026
Who we are and how to reach us
RomaniaShelf Solutions is the controller of the personal data described here, in the sense of the General Data Protection Regulation (GDPR). Our address is Strada Panduri 89, Bucharest 030175, Romania. You can reach us at info@shelf-company-romania.com or on +40 21 555 1234, Monday to Friday, 09:00 to 18:00, Bucharest time. This policy covers this website and every form on it.
What we collect and why
We collect personal data in four ways: through the enquiry forms, the onboarding and pay forms, analytics and cookies, and the security checks on the forms. Each block below gives the data, the purpose and the legal basis.
Enquiry forms
- Your name
- Your email address
- Your phone number, only if you type one
- The service you are interested in and any catalogue reference you chose
- Your message
- The visitor context listed under "Context sent with every form" below
We use these details to answer your enquiry. The legal basis is our legitimate interest in answering a person who writes to us, or steps you ask for before a contract.
Onboarding and payment forms
The onboarding form asks for the details a company file needs: the contact person, the company details you have and the services you choose. The pay form records the invoice number, your name and email address, the currency and the amount.
We use them to prepare the file and the invoice. The legal basis is steps taken at your request before a contract, and the contract itself. Card details are never entered on this site. A card payment, once offered, is made on the payment provider's own page.
Analytics and cookies
Google Analytics 4 and Microsoft Clarity measure visits and how visitors use the pages. Without your consent they set no cookie on this site: GA4 receives cookieless measurement pings, and Clarity records page use without its site cookies. The legal basis for that is our legitimate interest in knowing how the site is used. If you accept analytics in the consent banner, they also set their cookies. That part rests on your consent, which you can withdraw at any time. The banner remembers your choice on your device.
Security checks
Each form carries a hidden field that stops automated filling and a bot check from Cloudflare Turnstile. Each form also carries a limit on how many submissions one IP address can make in a short window.
If the bot check cannot load in your browser, we check the form another way. The page also records when the form was opened. We do this to stop spam and abuse of the forms. The legal basis is our legitimate interest in keeping the forms working for real visitors.
Context sent with every form
Every form on this site sends the context of your visit with your message. This lets us see where an enquiry came from and answer it in context. The context is listed below.
- IP address
- Approximate location, at city level, worked out from the IP address
- Network: your internet service provider or network operator
- Browser, operating system and device type
- Language set in your browser
- Referring page: the page or search result that led you here
- Pages viewed in this visit, the path through the site
- Visit number: how many visits this browser has made
- Time on page, and the local time of the submission
- Screen and window size (the viewport)
- Cookie-consent state: whether you accepted or refused analytics
- Analytics identifier, sent only if you accepted analytics
The legal basis is our legitimate interest in answering enquiries and in telling spam from real enquiries. We keep the context with the enquiry email, for as long as we keep that enquiry (see "How long we keep the data" below). We never send the contents of cookies. We send only the consent state and, if you accepted analytics, the analytics identifier.
Who receives the data and where it goes
- Cloudflare hosts this site and runs the form handler, the bot check and the submission counters.
- Cloudflare Email Routing forwards email sent to info@ to a mailbox of ours.
- Resend sends us the enquiry notification email.
- Our mailbox provider receives the forwarded emails. We give its name on request.
- Google Analytics 4 measures visits: without cookies by default, with cookies after you accept analytics.
- Microsoft Clarity measures how visitors use the pages: without cookies by default, with cookies after you accept analytics.
- Google Maps loads on the contact page only when you press the button.
Some of these providers are based outside the European Economic Area. The GDPR allows a transfer there only on a recognised basis, such as an adequacy decision or standard contractual clauses. You can ask us which one applies to a provider.
We do not sell personal data. We take no decision about you by automated means.
How long we keep the data
We keep each record only as long as the purpose in this policy needs it. The criteria are below, and you can ask for erasure sooner.
- Enquiries and their context: we keep them while the matter is open, then delete them.
- Onboarding and payment records: we keep them while needed, and longer where a filing or accounting duty requires.
- Analytics data: we keep it for the period set in each analytics tool, and no longer than needed.
- Submission counters and bot-check records: we keep them for a short window, then discard them.
- Your consent choice: we keep it to remember your choice and to show that consent was given.
When you ask for erasure, we delete the record unless a legal duty requires us to keep it.
Your rights and how to complain
Under the GDPR and the Romanian law that implements it, you may ask us for access to your data. You may also ask us to correct, erase or restrict it. You may ask for a copy you can move to another provider (portability). You may object to processing based on our legitimate interest. Where processing rests on your consent, you can withdraw it at any time. What was done before stays lawful.
- Write to info@shelf-company-romania.com and say which right you want to use.
- Name the enquiry or request it concerns: the date and the email address you used.
- Tell us if the request is to withdraw your analytics consent.
- We answer requests without a charge.
- If you are not satisfied with the answer, you may complain to a supervisory authority.
To complain, you may write to the Romanian data protection authority. Its name is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (the National Supervisory Authority for Personal Data Processing). You may also write to the authority of the country where you live. We answer each request on its own facts.