Privacy policy

1. Who We Are (Data Controller)

This policy describes how S.C. T.O.M. COMMUNICATIONS & MARKETING S.R.L. (hereinafter referred to as the “Agency”, “we”, “us”) processes the personal data of visitors to the website https://tomcm.ro/ as data controller within the meaning of Regulation (EU) 2016/679 (“GDPR”).

Identification details:

  • Company name: C. T.O.M. COMMUNICATIONS & MARKETING S.R.L.
  • Registered office: Constantin Dobrogeanu Gherea, nr. 99, Sector 1, Bucuresti
  • CUI: RO42532232
  • Trade Register No.: J40/5380/25.05.2020
  • Contact e-mail: ciortan@tomcm.ro
  • Phone: +40 728 280 650

 

2. What Data We Collect

2.1. Through the Contact Form

When you fill out the contact form, we collect:

  • First and last name
  • E-mail address
  • Phone number (if provided)
  • Company name (if provided)
  • Message content — information about your request.

2.2. Automatically Collected Data

When you access the website, we automatically collect:

  • IP address (anonymized where possible)
  • Browser and device type
  • Operating system
  • Pages visited and visit duration
  • Traffic source (referrer)

This data is collected through cookies and similar technologies — see Section 8.

 

3. Purposes of Processing and Legal Basis

Purpose

Data Categories

Legal Basis (Art. 6 GDPR)

Responding to requests submitted through the contact form

Name, e-mail, phone, company, message

Art. 6(1)(b) – pre-contractual steps / Art. 6(1)(f) – legitimate interest

Sending service offers following your request

Name, e-mail, phone, company

Art. 6(1)(b) – pre-contractual steps

Marketing communications (newsletter, offers)

Name, e-mail

Art. 6(1)(a) – explicit consent (separate opt-in)

Website operation and security

IP address, browsing data

Art. 6(1)(f) – legitimate interest

Traffic statistics (analytics)

Pseudonymized browsing data

Art. 6(1)(a) – consent (cookie banner)

Compliance with legal obligations (tax, accounting)

Billing data (for customers)

Art. 6(1)(c) – legal obligation

 

4. How Long We Keep the Data

  • Requests through the contact form without a subsequent contract: a maximum of 12 months from the last interaction, after which they are deleted.
  • Data regarding active customers and contracts: for the duration of the contract + 10 years in accordance with tax and accounting obligations (Accounting Law No. 82/1991).
  • Marketing data (if you have subscribed): until consent is withdrawn or a maximum of 3 years of inactivity.
  • Technical logs and cookies: according to the periods specified in the Cookie Policy (Section 8).

 

5. Who We Disclose Data To (Recipients and Processors)

Your data may be accessed by:

  • Employees and collaborators of the Agency, strictly on a “need-to-know” basis.
  • Service providers (processors under Art. 28 GDPR):
  • Hosting provider: [e.g., Hetzner / Netlify / Vercel]
  • E-mail / CRM service: [e.g., Google Workspace, HubSpot, Brevo]
  • Analytics service: [e.g., Google Analytics 4, Plausible]
  • Accounting: [if applicable]
  • Public authorities, when there is a legal obligation (ANAF, ANSPDCP, courts, etc.).

 

6. Transfers Outside the European Economic Area (EEA)

Certain providers (e.g., Google) may process data outside the EEA, particularly in the USA. These transfers are carried out on the basis of:

  • Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR), and/or
  • EU–U.S. Data Privacy Framework, for certified providers.

 

7. Your Rights (under the GDPR and Law No. 190/2018)

You have the following rights:

  • Right of access (Art. 15) – to know what data we hold about you.
  • Right to rectification (Art. 16) – correction of inaccurate data.
  • Right to erasure / “to be forgotten” (Art. 17).
  • Right to restriction of processing (Art. 18).
  • Right to data portability (Art. 20).
  • Right to object (Art. 21) – particularly with regard to direct marketing.
  • Right not to be subject to automated decision-making (Art. 22).
  • Right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

How to exercise your rights: send a request to  iulia.ciortan@tomcm.ro  or by mail to the registered office. We will respond within a maximum of 30 days (a period that may be extended by 60 days in complex cases, with prior notice).

Right to lodge a complaint: If you believe we have violated your rights, you may file a complaint with:

The National Supervisory Authority for Personal Data Processing (ANSPDCP)

  • Address: B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, București
  • Phone: +40.318.059.211
  • E-mail: anspdcp@dataprotection.ro
  • Website: dataprotection.ro

 

8. Cookies and Similar Technologies

The website uses cookies in accordance with Law No. 506/2004 and the ePrivacy Directive. On your first visit, a banner is displayed allowing you to accept, reject, or customize cookie categories (except for strictly necessary ones).

Categories:

  • Strictly necessary cookies — do not require consent (website operation, session, security).
  • Analytics / performance cookies — require consent [e.g., _ga, _gid — Google Analytics].
  • Marketing cookies — require consent [if you use Meta Pixel, Google Ads, etc.].

 

9. Data Security

We apply appropriate technical and organizational measures (Art. 32 GDPR):

  • TLS/HTTPS encryption for data transmission
  • Restricted access based on accounts and passwords
  • Periodic backups
  • Staff training on data protection
  • DPA contracts with all sub-processors

Incident notification: In the event of a breach posing a risk to your rights, we will notify ANSPDCP within 72 hours and, where applicable, the affected individuals (Art. 33-34 GDPR).

 

10. Minors

This website is not directed at persons under 16 years of age. We do not knowingly collect data from minors. If a parent/guardian becomes aware of this, they may contact us for immediate deletion.

 

11. Changes to This Policy

We reserve the right to update this policy. The current version is always published on this page, with the date of the last update shown at the top. Substantial changes will be communicated by e-mail (to newsletter subscribers) or through a notice on the website.

 

12. Contact

For any questions regarding data processing:

  • E-mail: ciortan@tomcm.ro
  • Mail: Giuseppe Verdi 9, Sector 2, București, România
  • Phone: +40 728 280 650