Privacy Policy

1. Who we are (the controller)

S.C. ATU Advertising S.R.L., CUI RO14011026, registered with the Trade Register under No. J35/772/2001, with its registered office at Bd. Mihai Viteazu nr. 28, ap. 1-2, 300222 Timișoara, Timiș County, Romania, is the controller of the personal data processed through the atu.ro website.

Data protection contact: office@atu.ro | Tel: +40 720 444 150 | by post to our registered office address.

We have not appointed a data protection officer (DPO). All requests concerning personal data are handled by the company's management.

2. What data we process, for what purposes and on what legal basis

You do not need to create an account to use the website. We process data only in the situations described below:

• The contact form: name, company, email address, telephone number (optional), subject and message. We use this data to reply to you and, if you ask us to, to send you a quote. Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in replying to the messages we receive (Art. 6(1)(f) GDPR).
• The quote request forms on our campaign pages: name, company, email address or telephone number, and the number of people and estimated budget (both optional). Purpose and legal basis: as for the contact form.
• The order form for diaries and calendars: company name, tax identification number (CUI), contact person, telephone number, email address, town or city, delivery address, comments, the products selected and, if you send it, your logo file. We use this data for the quote, the order, delivery and invoicing. Legal basis: the conclusion and performance of the contract (Art. 6(1)(b) GDPR) and our legal accounting and tax obligations (Art. 6(1)(c) GDPR). When you submit the form, we automatically send you a confirmation email.
• Newsletter subscription (Guides page): your email address and the time you gave consent, used to send you new guides, news and offers from ATU Advertising. Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the consent box. You can unsubscribe at any time via the link in every email or by writing to office@atu.ro.
• Messages sent to us directly (email, telephone, WhatsApp): the data you choose to provide to us, which we use to reply to you. Legal basis: Art. 6(1)(b) or (f) GDPR. For WhatsApp, the policy of Meta, the provider of the app, also applies.
• Protecting the forms against spam: when you submit a form, the Cloudflare Turnstile service checks technical signals from your browser (for example your IP address and device characteristics) in order to distinguish humans from bots. Legal basis: our legitimate interest in protecting the website and our email inboxes against abuse (Art. 6(1)(f) GDPR).
• Operation and security of the website: our hosting provider, Cloudflare, automatically processes your IP address, the date and time of access, the page requested and your browser type, in order to deliver the pages and block attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Visitor statistics (Google Analytics 4): only if you choose ‘Accept’ in the cookie banner. Pseudonymous identifiers, the pages visited, the length of the visit, the device type and your approximate location (city, country) are collected so that we can understand how the website is used and improve it. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Law No. 506/2004). Without your consent, the Google Analytics script is not loaded.

We do not use the data for automated decision-making or profiling that produces legal effects concerning you, and we do not sell it to anyone.

Providing data in the forms is voluntary. Without the data marked as mandatory, we cannot reply to you or process your order.

3. Cookies and local storage

On your first visit, we ask for your consent to analytics cookies. You can change your choice at any time via the ‘Cookies’ link in the footer of every page.

• Strictly necessary (no consent required): atu_consent (local storage in your browser), which remembers your choice regarding cookies, and the order basket in the diaries section (local storage, only if you add products). Cloudflare may use strictly necessary technical elements for security purposes and for the Turnstile check.
• Analytics (only with your consent): the Google Analytics cookies _ga and _ga_*, with a lifetime of up to 2 years. We do not use advertising or remarketing cookies.

You can delete cookies and locally stored data at any time in your browser settings.

4. Content loaded from third parties

Some pages display content hosted by other companies. When you open these pages, your browser connects directly to their servers, which receive at least your IP address and information about your browser:

• Google Maps (the map on the contact page), provided by Google Ireland Limited. The map loads only after you click the ‘Show map’ button.
• YouTube (the video in our anniversary article), in privacy-enhanced mode (youtube-nocookie.com), provided by Google Ireland Limited.
• Images hosted by Unsplash (in some articles) and product images hosted by the platform of our online shop.

The privacy policies of the respective providers apply to these services, for example the Google Privacy Policy.

5. Who we share data with

The data is accessed by those ATU Advertising employees who need it in order to reply to you or to fulfil your order.

Processors (providers that process data on our behalf, under a contract and only on our instructions):

• Cloudflare, Inc. - website hosting, content delivery network, security and Turnstile;
• Google Ireland Limited - Google Analytics (only with your consent);
• Resend - delivering form messages to us and sending confirmation emails to you;
• our email provider - hosting the mailboxes in which we receive messages.

Recipients acting as independent controllers (they process the data in their own name, under their own rules):

• Google Ireland Limited - for Google Maps and YouTube, when you open the pages that display them (see section 4);
• courier, accounting and legal advisory firms - only the data needed for delivery, accounting records or defending a legal right;
• public authorities - only where we are required to do so by law.

Transfers outside the European Economic Area: some providers (for example Cloudflare, Google, Resend) may process data in the United States. These transfers take place on the basis of the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, in the case of certified companies, or on the basis of standard contractual clauses adopted by the European Commission.

6. How long we keep the data

• Messages and quote requests that did not lead to a contract: up to 3 years from the last communication, after which we delete them.
• Orders, contracts, invoices and related correspondence: for the duration of the contract and thereafter for as long as accounting and tax legislation requires (as a rule, 10 years for supporting documents, under Accounting Law No. 82/1991).
• Newsletter subscription: until you unsubscribe; after that we keep only the record of your consent, for no more than 3 years.
• Google Analytics data: no more than 14 months; the cookies expire after no more than 2 years or when you delete them from your browser.
• Technical logs held by the hosting provider: only for as long as is necessary for the operation and security of the website, in accordance with the provider's retention rules.

7. Your rights

Subject to the conditions laid down in the GDPR, you have the following rights:

• Right of access - to find out whether we process your data and to receive a copy of it;
• Right to rectification - to request that inaccurate data be corrected or that your data be completed;
• Right to erasure (‘right to be forgotten’) - in the cases provided for in Art. 17 GDPR;
• Right to restriction of processing - in the cases provided for in Art. 18 GDPR;
• Right not to be subject to a decision based solely on automated processing - we do not take any such decisions through the website;
• Right to data portability - for data you have provided to us that is processed on the basis of consent or a contract;
• Right to object - on grounds relating to your particular situation, to processing based on our legitimate interest;
• Right to withdraw your consent - at any time: for cookies, via the ‘Cookies’ link in the page footer; for the newsletter, via the unsubscribe link or by email, without affecting the lawfulness of processing carried out before the withdrawal;
• Right to lodge a complaint with the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (the Romanian data protection authority), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, București, www.dataprotection.ro.

To exercise your rights, write to us at office@atu.ro or by post to our registered office address. We will reply without undue delay and in any event within one month of receiving your request. This period may be extended by a further two months for complex or numerous requests, in which case we will inform you. Exercising your rights is free of charge. We may ask for additional information to confirm your identity.

8. Data security

We use encrypted connections (HTTPS), restrict access to data to the people who need it, protect our forms against spam and use providers that apply appropriate security measures. No system can guarantee absolute security, but we take reasonable measures to prevent unauthorised access to, or loss or disclosure of, data.

9. Minors

The website is aimed at businesses and adults. We do not knowingly collect data from persons under the age of 16.

10. Other websites

The online shop promo.atu.ro, which is also operated by ATU Advertising, has its own information on data processing, displayed on that website. Social networks and the other external websites to which we link have their own privacy policies.

11. Changes to this policy

We may update this policy when the services we use or the legislation change. The version in force is always the one published on this page, with the date of the last update shown above.

12. Contact

For any questions about your personal data:

• Email: office@atu.ro
• Phone: +40 720 444 150
• Address: Bd. Mihai Viteazu nr. 28, ap. 1-2, 300222 Timișoara, Timiș County, Romania
• Online form: contact page