Last updated:
This policy explains what personal data BMS Automation processes through and in connection with the bms-automation.rowebsite, why, for how long, and what rights you have under Regulation (EU) 2016/679 (the “GDPR”) and Romanian Law no. 190/2018 implementing it.
1. Who we are
The data controller is BMS AUTOMATION SRL, registered office Strada Nucilor, Nr. 60, Moșnița Nouă, Timiș, Romania, Trade Register no. J35/3812/2008, VAT ID RO24665028.
For any question about your data, contact us at office@bms-automation.ro, on (+40) 721 931 577 or by post at our registered office. We have not appointed a data protection officer (DPO), as our activity does not require one; your requests are handled directly by the company's management.
2. In short
- The website has no forms, user accounts or login area. You can contact us by email or phone.
- The website does not use cookies. The only thing stored in your browser is the date you closed the privacy notice, so we do not show it on every visit (see our Cookie policy).
- We do not use traffic analytics, marketing pixels, advertising or external services loaded into the page. Fonts are hosted on our own server.
- We do not sell data, do not profile visitors and do not send marketing messages.
3. What data we process and where it comes from
- Data you give us by email or by phone: your name, email address, phone number, company and job title and any project information you choose to share. Please do not send us sensitive data (for example about health) that your request does not need. If you give us a colleague's details (for example as the project contact), please let them know and point them to this policy.
- Data received from your employer, when a colleague gives us your contact details as the contact person for a project.
- Technical data when you visit the website: the hosting server automatically records, in its logs, your IP address, date and time, the page requested, browser type and operating system. We do not use this data to identify you.
4. Why we process data and on what legal basis
- To answer requests and prepare quotes: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or, when you contact us on behalf of a company, our legitimate interest in communicating with clients and partners (Art. 6(1)(f) GDPR).
- To enter into and perform contracts with our clients: performance of the contract (Art. 6(1)(b)) and, for our clients' contact persons, our legitimate interest in running the project (Art. 6(1)(f)).
- To comply with legal obligations, especially accounting and tax rules (Art. 6(1)(c) GDPR).
- To operate and secure the website (server logs): our legitimate interest in protecting the website against abuse and cyber attacks (Art. 6(1)(f) GDPR).
- To establish, exercise or defend legal claims, where applicable: legitimate interest (Art. 6(1)(f) GDPR).
5. Do you have to give us your data?
No. Providing data is voluntary. Without contact details, however, we cannot answer your request or prepare a quote. Entering into a contract requires the identification data required by law.
6. Who we share data with
We do not sell or rent your data. It may only be received by:
- the providers of our web hosting and email services, acting as processors under contracts that require them to keep the data confidential and secure (Art. 28 GDPR);
- our accountant, legal advisers or auditors, for contracted projects, under a duty of confidentiality;
- public authorities, only when required by law.
As a rule, data is processed within the European Economic Area (EEA). If a provider processes it outside the EEA, the transfer only takes place to countries recognised by the European Commission as providing adequate protection or on the basis of the Commission's standard contractual clauses (Arts. 44–49 GDPR).
7. How long we keep data
- Requests that do not lead to a contract, including messages received by email: at most 2 years from the last communication, after which we delete them.
- Contract-related data: for the duration of the contract and then for the periods required by accounting and tax law or by the statutory limitation periods.
- Server logs: deleted automatically by the hosting provider, usually after a few weeks.
8. Our Facebook and LinkedIn pages
The website only contains plain links to our pages on these networks; it does not load their buttons, plugins or any other elements. When you visit those pages, your data is processed by each network's operator, under its own privacy policy:
For the aggregated statistics of our Facebook page, we are joint controllers with Meta (Art. 26 GDPR), under the agreement published by Meta. You can exercise your rights regarding this data directly with Meta.
9. How we protect data
The website is served exclusively over an encrypted connection (HTTPS). Access to emails and documents containing personal data is limited to the people in our company who need them to answer you or run the project.
10. Automated decisions and minors
We do not make decisions based solely on automated processing and we do not create profiles. The website is aimed at companies and institutions and is not intended for people under 16.
11. Your rights
Under the GDPR (Arts. 15–22), you have the right:
- to know whether we process data about you and to receive a copy (right of access);
- to have inaccurate data corrected or incomplete data completed (rectification);
- to have your data deleted when there is no longer a legal reason to keep it (right to be forgotten);
- to restrict processing;
- to receive the data you provided in a structured format and pass it to another controller (portability);
- to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest.
To exercise your rights, write to us at office@bms-automation.ro. Exercising your rights is free of charge. We reply within one month; in complex cases this may be extended by two further months, in which case we will let you know. We may ask for additional information to confirm your identity.
If you believe we are infringing your rights, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, 010336 București, email anspdcp@dataprotection.ro, www.dataprotection.ro, or with the supervisory authority in your EU country of residence.
12. Changes
We may update this policy, for example if we add a contact form or a traffic analytics tool to the website. The version in force is the one published on this page, with the last updated date shown above.