We use cookies to enable the proper functioning and security of our websites, and help us offer you the best possible user experience. By clicking Accept, you consent to the use of these cookies for advertising and analytics. You can change your cookie settings at any time. For more information, please read our Cookie Policy.

Romanian Supplier Logo
Romanian SupplierDoing business
Back to Home

Privacy Policy

Last updated: December 2, 2025

Introduction

Welcome to Romanian Supplier (operating at romanian-supplier.com, hereinafter "we", "us", "our", or the "Platform"). We are a B2B marketplace platform connecting international buyers with quality Romanian manufacturers, suppliers, and service providers.

Operator Information:
This platform is operated by SC FABRICATINRO SRL, a Romanian-registered company based in Iași, Romania (CUI: 42471925, Registration: J2020000965222). While we serve a worldwide audience of international buyers and Romanian suppliers, our operations are governed by Romanian law and European Union regulations, specifically the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Romanian Law 190/2018 on data protection.

We are committed to protecting your privacy and ensuring transparent data processing practices. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our services, and informs you of your rights under GDPR and Romanian data protection legislation.

By using our Platform, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree with our policies and practices, please do not use our Platform.

1. Data Controller & Contact Information

For the purposes of the GDPR and Romanian data protection law, the data controller is:

SC FABRICATINRO SRL

Trading as: Romanian Supplier

CUI: 42471925

Registration Number: J2020000965222

Registered Office: Iași, Romania

Website: romanian-supplier.com

Email: contact@romanian-supplier.com

You have the right to contact us at any time regarding your personal data or to exercise your rights as described in this Privacy Policy.

Data Protection Authority: If you have concerns about how we process your personal data, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal - ANSPDCP) at www.dataprotection.ro.

2. Personal Data We Collect

We collect and process the following categories of personal data in accordance with GDPR Article 6 (lawfulness of processing):

A. Information You Provide Directly:

  • Identity Data: First name, last name, job title, professional credentials
  • Contact Data: Email address, telephone number, company name, business address
  • Account Data: Username, password (encrypted), account preferences, subscription plan details
  • Business Data: Company information, VAT number (for Romanian suppliers), product catalogs, service descriptions, certifications, export markets
  • Inquiry Data: Messages, requests for information, buyer requirements, supplier responses, contact form submissions
  • Transaction Data: Subscription payment details (processed securely through Stripe), billing information, payment history
  • Marketing Preferences: Communication preferences, consent records, newsletter subscriptions

B. Information We Collect Automatically:

  • Technical Data: IP address, browser type and version, device type, operating system, screen resolution
  • Usage Data: Pages viewed, search queries, time spent on pages, click patterns, navigation paths, referral sources
  • Location Data: Approximate geographic location based on IP address (country/city level)
  • Cookie Data: Cookie identifiers, session data, authentication tokens (see Section 9 for details)

C. Information From Third Parties:

  • Authentication Services: If you use single sign-on features, we receive basic profile information
  • Payment Processors: Stripe provides payment confirmation and transaction data (we do not store full credit card details)
  • Public Sources: Publicly available company information for verification purposes

Special Categories of Data: We do not intentionally collect or process special categories of personal data (e.g., racial origin, political opinions, religious beliefs, health data, biometric data) as defined in GDPR Article 9.

3. Legal Basis and Purposes for Processing

We process your personal data only where we have a legal basis under GDPR Article 6. Below are the purposes and corresponding legal bases:

Contract Performance (Article 6(1)(b)):

  • Creating and managing your user account
  • Providing access to our B2B marketplace platform
  • Processing subscription payments and managing billing
  • Facilitating connections between buyers and suppliers
  • Delivering customer support services
  • Sending transactional emails (account confirmations, password resets, important updates)

Legitimate Interests (Article 6(1)(f)):

  • Improving and optimizing our platform based on user behavior analysis
  • Detecting, preventing, and investigating fraud, security breaches, and prohibited activities
  • Conducting internal analytics to understand user needs and preferences
  • Enforcing our Terms of Service and protecting our legal rights
  • Verifying the accuracy and quality of supplier information
  • Matching buyers with relevant suppliers based on their requirements

Legal Obligation (Article 6(1)(c)):

  • Complying with Romanian tax and accounting requirements
  • Responding to lawful requests from authorities
  • Maintaining records as required by Romanian commercial law
  • Fulfilling anti-money laundering obligations

Consent (Article 6(1)(a)):

  • Sending marketing communications and newsletters (you can withdraw consent at any time)
  • Using non-essential cookies for analytics and marketing (see Section 9)
  • Sharing your contact information with matched suppliers/buyers (for registered users)
  • Processing additional data for specific purposes you explicitly agree to

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You have the right to object to processing based on legitimate interests (see Section 7).

4. Data Sharing and Disclosure

We share your personal data only as described below. We do not sell your personal data to third parties for their marketing purposes.

A. Within Our Platform (Core Service):

  • Buyers → Suppliers: When you express interest in a supplier, your contact details (name, email, phone, company) are shared with that supplier
  • Suppliers → Buyers: Your company profile, products, and contact information are visible to registered buyers searching our platform
  • Public Listings: Company profiles and product catalogs are publicly accessible to facilitate B2B discovery

B. Service Providers (Data Processors):

We engage carefully selected third-party service providers who process data on our behalf under strict contractual obligations:

  • Supabase: Database hosting and authentication services (EU/US servers with GDPR compliance)
  • Stripe: Payment processing for subscription services (PCI DSS compliant, GDPR compliant)
  • Email Services: Transactional and marketing email delivery
  • Analytics Providers: Website analytics and performance monitoring (anonymized where possible)
  • Cloud Infrastructure: Secure data storage and hosting services

C. Legal and Regulatory Requirements:

  • Romanian tax authorities (ANAF) for fiscal compliance
  • Law enforcement agencies when required by Romanian or EU law
  • Regulatory authorities in response to lawful requests
  • Courts and tribunals in legal proceedings

D. Business Transfers:

In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change and ensure the acquiring entity complies with this Privacy Policy.

International Data Transfers: Where we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or adequacy decisions under GDPR Article 45.

5. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this Privacy Policy, or as required by Romanian and EU law:

  • Active Accounts: Data is retained while your account remains active and for legitimate business purposes
  • Closed Accounts: Account data is retained for 30 days after closure to allow for account recovery, then permanently deleted unless legal obligations require longer retention
  • Transaction Records: Financial records are retained for 10 years as required by Romanian accounting law (Law 82/1991)
  • Communications: Customer support inquiries and business communications are retained for 3 years
  • Marketing Consent: Consent records are kept for 3 years after withdrawal to demonstrate compliance
  • Usage Data: Analytics and logs are retained for 24 months, then anonymized or deleted
  • Legal Claims: Data related to legal claims is retained until the claim is resolved and any appeal period expires

After the retention period expires, personal data is securely deleted or anonymized so that it can no longer identify you.

6. Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with GDPR Article 32:

Technical Measures

  • End-to-end encryption (TLS/SSL) for data in transit
  • Encryption at rest for sensitive data
  • Secure password hashing (bcrypt)
  • Regular security audits and penetration testing
  • Firewall protection and intrusion detection
  • Automated backup systems
  • Multi-factor authentication for admin access

Organizational Measures

  • Access controls based on need-to-know principle
  • Employee training on data protection
  • Confidentiality agreements with staff
  • Data processing agreements with third parties
  • Incident response procedures
  • Regular security policy reviews
  • Privacy by design and by default principles

Important Notice: While we implement industry-standard security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we continuously work to improve our security practices. In the event of a data breach affecting your rights and freedoms, we will notify you and the Romanian data protection authority (ANSPDCP) within 72 hours as required by GDPR Article 33.

7. Your Rights Under GDPR

Under the GDPR and Romanian Law 190/2018, you have the following rights regarding your personal data. These rights are not absolute and may be subject to certain conditions or exceptions:

1. Right of Access (Article 15)

You have the right to obtain confirmation of whether we process your personal data, access to that data, and information about how we process it. You can request a copy of your data free of charge.

2. Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data. You can update most information directly in your account settings.

3. Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your personal data when: (a) data is no longer necessary, (b) you withdraw consent, (c) you object to processing, (d) data was unlawfully processed, or (e) legal obligation requires deletion. This right is not absolute and may be limited by legal requirements.

4. Right to Restriction of Processing (Article 18)

You can request we limit processing of your data while we verify its accuracy, assess the lawfulness of processing, or while you exercise your right to object.

5. Right to Data Portability (Article 20)

You can request to receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV, JSON) and transmit it to another controller.

6. Right to Object (Article 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests.

7. Right to Withdraw Consent (Article 7(3))

Where processing is based on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. You can manage consent preferences in your account settings or by contacting us.

8. Right to Lodge a Complaint (Article 77)

You have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP) if you believe your data protection rights have been violated.

9. Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or significantly affects you. We do not currently use fully automated decision-making.

How to Exercise Your Rights:

To exercise any of these rights, please contact us at contact@romanian-supplier.com

We will respond to your request within 30 days (or 60 days for complex requests, with explanation). We may require verification of your identity before processing requests. We do not charge a fee unless your request is manifestly unfounded or excessive.

8. Cookies and Tracking Technologies

Our Platform uses cookies and similar tracking technologies in accordance with GDPR Article 5(3) of the ePrivacy Directive and Romanian legislation. Cookies are small text files stored on your device that help us provide and improve our services.

A. Strictly Necessary Cookies (No Consent Required):

Essential for the Platform to function. These cannot be disabled:

  • Authentication: Keeps you logged in as you navigate
  • Security: Protects against CSRF attacks and ensures secure connections
  • Session Management: Maintains your session state and preferences
  • Load Balancing: Ensures optimal platform performance

B. Functional Cookies (Consent Based):

Enhance functionality and personalization:

  • Preferences: Remember your language, region, and display settings
  • Favorites: Store your saved companies, products, and searches
  • Form Data: Remember information you've entered in forms

C. Analytics Cookies (Consent Based):

Help us understand how users interact with our Platform:

  • Usage Analytics: Track page views, session duration, bounce rates
  • Performance Monitoring: Identify technical issues and slow-loading pages
  • Feature Testing: Measure effectiveness of new features (A/B testing)

D. Marketing Cookies (Consent Based):

Used to deliver relevant advertising (if applicable):

  • Retargeting: Show relevant ads based on your interests
  • Campaign Tracking: Measure effectiveness of marketing campaigns
  • Social Media: Enable sharing and social media features

Managing Your Cookie Preferences:

  • You can manage cookie preferences in your browser settings
  • Most browsers allow you to refuse or accept cookies
  • You can delete cookies already stored on your device
  • Disabling cookies may affect Platform functionality
  • For more information, visit aboutcookies.org

Cookie Retention: Session cookies are deleted when you close your browser. Persistent cookies remain for periods ranging from 30 days to 2 years, depending on their purpose.

9. International Data Transfers

As a Romanian-based platform serving a worldwide audience, we may transfer your personal data outside the European Economic Area (EEA) to trusted service providers. All international transfers comply with GDPR Chapter V requirements:

Safeguards We Implement:

  • Standard Contractual Clauses (SCCs): We use EU Commission-approved SCCs with service providers in countries without adequacy decisions
  • Adequacy Decisions: Where possible, we use service providers in countries recognized by the EU Commission as providing adequate data protection
  • Additional Security Measures: Encryption, access controls, and contractual commitments to GDPR compliance
  • Data Localization: Primary data storage is within the EU (via Supabase EU servers)

Your Rights: You have the right to obtain information about the safeguards we have in place for international transfers. Contact us at contact@romanian-supplier.com for details.

10. Children's Privacy

Our Platform is a B2B service intended for business professionals and companies. We do not knowingly collect or process personal data from individuals under the age of 16 years (the age of consent for data processing under GDPR in Romania).

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at contact@romanian-supplier.com. We will take prompt action to delete such data from our systems.

11. Third-Party Links and Services

Our Platform may contain links to third-party websites, services, or resources (e.g., supplier websites, social media platforms, payment processors). We are not responsible for the privacy practices or content of these third parties.

When you leave our Platform or interact with third-party services, their own privacy policies apply. We encourage you to read the privacy policy of every website or service you interact with.

Supplier Profiles: When you contact suppliers through our Platform, you enter into a direct relationship with them. Their collection and use of your data is governed by their own privacy policies, not ours.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any changes will be posted on this page with an updated "Last updated" date.

Notification of Material Changes: If we make material changes that significantly affect your rights, we will notify you by:

  • Email notification to your registered email address (at least 30 days before changes take effect)
  • Prominent notice on our Platform homepage
  • In-app notification when you next log in

Your continued use of the Platform after changes become effective constitutes acceptance of the updated Privacy Policy. If you do not agree with changes, you should discontinue use and may request deletion of your account.

13. Applicable Law and Jurisdiction

This Privacy Policy and all matters relating to your privacy and data protection are governed by:

  • General Data Protection Regulation (GDPR) - EU Regulation 2016/679
  • Romanian Law 190/2018 regarding measures to implement GDPR
  • Romanian Civil Code and other applicable Romanian legislation

Any disputes arising from this Privacy Policy or our data processing practices shall be subject to the exclusive jurisdiction of the Romanian courts, with the courts of Iași having primary jurisdiction. However, this does not affect your right to lodge a complaint with your local data protection authority.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Company Name:

SC FABRICATINRO SRL (trading as Romanian Supplier)

Contact Email:

Email: contact@romanian-supplier.com

Company Details:

CUI: 42471925
Registration: J2020000965222
Iași, Romania

Romanian Data Protection Authority:

ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)
Website: www.dataprotection.ro
Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, România

We are committed to resolving privacy concerns promptly and transparently. We will acknowledge receipt of your inquiry within 3 business days and provide a substantive response within 30 days.

Compliance Statement: This Privacy Policy has been prepared to comply with the General Data Protection Regulation (EU) 2016/679, Romanian Law 190/2018, and applicable Romanian and European Union data protection legislation. We are committed to transparency, accountability, and respect for your privacy rights. Last reviewed and updated: December 2, 2025.