Last updated: 5 November 2026
This policy explains what personal data we process when you use the website www.mecad.ro, why we process it, how long we keep it and what rights you have. It covers only what actually happens on this website.
1. Who is the controller of your data
MeCAD S.R.L., tax ID (CUI) RO 14551115, Trade Register no. ROONRC2002000956132, registered office: Str. Dumbrăveni no. 68A, Palazu Mare district, 900002 Constanța, Romania.
For any question about personal data: office@mecad.ro or phone +40 720 565 075. We have not appointed a Data Protection Officer (DPO) because the law does not require us to; all requests go to the contact details above.
2. What data we process and why
a) Contact and quote request forms
Data: your name, phone number, e-mail address (optional), company name (optional), the address or locality of the site, the project details you describe, your message, how you heard about us (optional) and, if you choose to attach them, documents or photos (PDF or JPG). We do not ask for, and please do not send us, unnecessary data such as identity card numbers or health data.
Purpose: to answer your request and, if you wish, to prepare a quote. The optional answer to “How did you hear about us?” only helps us see which promotion channels work.
Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and, for general messages, our legitimate interest in answering people who write to us (Art. 6(1)(f)). The consent box in the form confirms that you have read this notice.
How the data reaches us: the form sends an e-mail to our contact address. Attached documents are sent by e-mail only; they are not stored on the website. Providing the data is voluntary, but without the fields marked * we cannot reply.
b) Direct correspondence
If you write to office@mecad.ro or call us, we use the data you give us only to reply and to carry on the business discussion, on the same legal basis.
c) Clients and contracts
If a contract is concluded, we process the data needed to perform it (identification, address, invoicing data) on the basis of contract performance and legal obligations (accounting, tax). These processing operations are not carried out through the website.
d) Technical data and spam protection of the forms
When a form is submitted we automatically check that it is not a robot and limit the number of submissions per hour. For this we keep, for at most 24 hours, an encrypted fingerprint of the IP address (not the address itself), which is then deleted automatically. Legal basis: our legitimate interest in securing the website and preventing abuse (Art. 6(1)(f)).
The hosting server may record the IP address, date and pages accessed in technical logs, for security and operation. These logs are managed by the hosting provider.
e) Visit statistics (Google Analytics)
Only if you accept the “Performance/Statistics” category in the cookie banner do we use Google Analytics 4 to see, in aggregate form, how many visitors we have, which pages are read and where visitors come from. The IP address is anonymised. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4 of Romanian Law 506/2004). If you do not accept, the script does not load and nothing is sent to Google. More about cookies in the Cookie policy.
We do not use your data for automated decisions or profiling, we do not send unsolicited commercial messages and we do not sell data.
3. Who we may disclose data to
Data is accessible to the people in the company who handle requests. In addition, it may reach providers that help us operate, as processors under contract:
- the provider hosting the website and mailboxes (Redhost), on whose servers the website and received messages are stored;
- Google Ireland Limited / Google LLC, for Google Analytics, only if you accepted statistics cookies;
- Objectis UAB (Cookie-Script), the provider of the cookie consent window;
- public authorities, only where the law requires it (for example tax authorities or courts).
4. Transfers outside the European Economic Area
Most data is processed in the EU/EEA. Google may transfer statistical data to the USA; the transfer is based on the European Commission’s adequacy decision on the EU–US Data Privacy Framework and/or standard contractual clauses, under Google’s terms. If you do not accept statistics cookies, no such transfer takes place through the website.
5. How long we keep data
- Requests and quotes that did not lead to a contract: at most 3 years from the last communication (the general limitation period), then deleted; we delete them sooner on request.
- Attached documents: they remain only in the e-mail received, for the same period as the request.
- Clients: for the duration of the contract and then as long as accounting and tax law require for supporting documents.
- IP fingerprint for anti-spam: at most 24 hours.
- Google Analytics data: 2 months, according to our account setting.
- Server logs: according to the hosting provider’s policy.
6. Your rights
Under the GDPR you have the right to: access the data we hold; rectification; erasure; restriction of processing; object to processing based on our legitimate interest; data portability; withdraw your consent at any time (withdrawal does not affect processing carried out before it); and not to be subject to a decision based solely on automated processing.
To exercise them, write to office@mecad.ro. We reply within one month at most and, to avoid disclosing data to another person, we may ask you to confirm your identity. Exercising your rights is free of charge.
You can change your cookie consent at any time (see the Cookie policy).
7. Complaints
If you believe we have infringed your rights, you can write to us first at office@mecad.ro; we will try to solve the matter. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru no. 28–30, sector 1, Bucharest, postal code 010336, e-mail anspdcp@dataprotection.ro, www.dataprotection.ro, and to apply to the competent court.
8. Security
The website uses a secure connection (HTTPS), the forms are protected against automated submissions and access to the administration panel is protected by authentication. Data is accessible only to those who need it.
9. Links to other websites
The website contains links (for example to our Facebook page or a map). They lead to websites we do not control; we recommend reading their privacy policies.
10. Changes
We may update this policy; the version in force is the one published here, with the date of the last update at the top.