Data protection policy

Last updated: 7 October 2026

1. The data controller

The controller of the personal data processed through this website is PROFAL INDUSTRY SRL, which operates through its divisions Profal Floor Systems (industrial floors) and Profal Window Systems (windows and façades).

Company name

PROFAL INDUSTRY SRL

VAT number (CUI)

RO15848603

Trade Register no.

J35/2494/2003

Registered office

Str. Ciprian Porumbescu nr. 94 (Corp B), Timișoara 300489, Timiș County, Romania

Data protection e-mail

office@profalgroup.ro

2. What data we process and where it comes from

Contact and quote forms

When you fill in the "Request a tailored quote" form or another contact form, we process the data you send us:

• your first and last name;
• your company name (optional);
• your phone number and e-mail address;
• the county and town of the project;
• your message and, optionally, project details (for example the area or the desired deadline).

Your message is sent by e-mail to the inbox of the division that handles the request (office@profalgroup.ro or ferestre@profalgroup.ro), and you automatically receive a copy at the address you gave. The website does not save this data in a database of its own; it is kept in our e-mail correspondence.

Phone and WhatsApp

The phone and WhatsApp links on the website open your own app and connect you directly with the division's contact person. In that case we process your phone number, display name and the content of the conversation, for the same purposes as the forms. For the WhatsApp app, WhatsApp Ireland Limited (Meta group) is an independent controller under its own privacy policy.

Quote list

The items you add to the quote list are kept only in your browser (localStorage), on the device you use. We receive them only if you choose to send them through the form. You can delete them at any time from your browser settings.

Technical and usage data

As with any website, the hosting provider's servers receive the technical data needed to display the pages (IP address, browser type, requested page, date and time).

The website loads Google Tag Manager, which runs Google Analytics 4 and Google Ads. Before any Google tag runs, the website sets Google Consent Mode v2 to "denied" for analytics storage, ad storage, ad user data and ad personalisation. Until you accept in the cookie banner, the Google tools set no analytics or advertising cookies and send only cookieless signals (for example, that a page was viewed or that a form was sent), without ad click identifiers. Google uses these signals for aggregated estimates. After you accept analytics or marketing cookies, those tools can use cookies, as described in the Cookie Policy. Meta Pixel (Meta Platforms) loads only after you accept marketing cookies. You can change your choice at any time with the "Cookie settings" link in the page footer.

3. Purposes and legal bases

• Answering your request and preparing a quote (assessing the work, a site visit, a price offer): steps taken at your request before entering into a contract, Article 6(1)(b) GDPR.
• Entering into and performing the contract, if the work is contracted: Article 6(1)(b) GDPR.
• Following up on the quote sent and communicating about the same request: our legitimate interest in handling the requests we receive, Article 6(1)(f) GDPR.
• Complying with legal obligations (accounting, archiving, tax): Article 6(1)(c) GDPR.
• Running and securing the website (technical data, remembering your cookie choice): legitimate interest, Article 6(1)(f) GDPR.
• Traffic statistics and advertising (Google Analytics 4 and Google Ads through Google Tag Manager, Meta Pixel): analytics and advertising cookies and Meta Pixel are used only on the basis of your consent, Article 6(1)(a) GDPR, which you can withdraw at any time. Without consent, Google receives only the cookieless signals described in section 2.

We do not use your data for automated decisions or profiling with legal effects, and we do not send you newsletters without your express consent.

4. Recipients of the data

The data is accessed only by the Profal employees who handle your request. We use the following providers, which process data on our behalf (processors), under contract and only on our instructions:

• the transactional e-mail provider Resend, through which the forms are sent to us and the copy to you;
• the website hosting provider (cloud services);
• the e-mail and IT service providers the company uses for its correspondence;
• Google (Tag Manager, Analytics 4, Ads): the cookieless signals before your choice, and measurement with cookies only after your consent; Meta Platforms (Pixel): only after your consent to marketing cookies, as described in the Cookie Policy.

We may disclose data to public authorities only when the law requires it. We do not sell or rent personal data.

5. Transfers outside the European Economic Area

Some of the providers above may process data in the United States or other countries outside the EEA. In those cases the transfer relies on the Standard Contractual Clauses approved by the European Commission or, where applicable, on the adequacy decision for providers certified under the EU-U.S. Data Privacy Framework.

6. How long we keep the data

• Quote requests and the related correspondence: as long as needed to answer the request and for any contract that follows.
• If a contract is signed: documents are kept for the duration of the contract and afterwards for the legal periods that apply to each category.
• Requests that do not lead to a contract: we delete them once they are no longer needed for the purpose for which they were sent.
• Data in your browser (quote list, cookie choice): until you delete it from your browser.
• Data collected with your consent by the measurement tools: for the period set by each provider, described in the Cookie Policy.

7. Your rights

Under the GDPR you have the following rights:

• right of access: to find out whether we process data about you and to receive a copy of it;
• right to rectification: to have inaccurate data corrected or incomplete data completed;
• right to erasure: to have your data deleted when there is no longer a legal basis for keeping it;
• right to restriction of processing, in the cases set out in Article 18 GDPR;
• right to data portability: to receive the data you provided in a structured, commonly used format;
• right to object to processing based on legitimate interest;
• right to withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal;
• right to lodge a complaint with the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), www.dataprotection.ro, or with the supervisory authority of your EU country of residence.

How to exercise your rights

Send your request to office@profalgroup.ro or by post to the registered office above. We reply within one month of receiving the request; for complex requests this period may be extended by two further months, in which case we will tell you within the first month. We may ask for additional information to confirm your identity. Exercising your rights is free of charge.

8. Data security

The website uses an encrypted connection (HTTPS). Access to the e-mail inboxes and to the providers' accounts is limited to the people who need it to answer requests. No system is completely secure, but we take appropriate technical and organisational measures to protect data against unauthorised access, loss or alteration.

9. Children

The website is intended for adults and companies interested in construction work. We do not knowingly collect data about children.

10. Changes to this policy

We may update this policy when the way the website works or the law changes. The version in force is the one published on this page, with the last-updated date shown above. See also the Cookie Policy and the Terms and Conditions.