Privacy and Data Protection Policy
Last updated: 12.10.2026
1. Who we are
The website metalicform.eu is operated by Graphtec Design SRL, registered office at Bd. Aurel Vlaicu 125, Constanța, Romania, registered with the Trade Register under no. J13/1209/1998, tax ID (CUI) 10440165 (hereinafter “MetalicForm”, “we”). We are the controller of your personal data, which means we decide why and how it is processed.
MetalicForm manufactures custom metal parts, subassemblies and products: laser cutting, bending, welding, grinding and electrostatic powder coating.
How to contact us about your data:
- email: office@metalicform.eu
- post: Graphtec Design SRL, Bd. Aurel Vlaicu 125, Constanța, Romania
This policy explains what data we collect through the site and our contact channels, why, on what legal basis, who we share it with, how long we keep it and what rights you have. Cookies and similar technologies are covered on a separate page: Cookie Policy.
2. What data we process and why
We only collect the data we need for each purpose. We do not request or process sensitive data (for example about health, religion or political opinions) and we do not request national identification numbers.
| Situation | What data | Why | Legal basis (GDPR, Art. 6(1)) |
|---|---|---|---|
| You send us a quote request through the site form | name, company, email, phone, material, quantity, requested processes, project details and the attached technical drawing | to assess the project, reply to you and prepare a quote | steps taken at your request before entering into a contract (b) |
| You call or email us | phone number or email address, name, message content and any attached files | to reply to you | pre-contractual steps (b) or our legitimate interest in answering requests (f) |
| You become a customer | contact persons’ data, order, contract, invoice, delivery and correspondence data | performing the order and contract, delivery, invoicing, warranty | performance of a contract (b) and legal tax and accounting obligations (c) |
| You visit the site | technical data: IP address, browser and device type, pages accessed, date and time | operating and securing the site, preventing abuse | our legitimate interest in a secure, working site (f) |
| You accept analytics and marketing cookies in the banner | online identifiers (cookies), pages visited, interactions with the site, the ad you came from | visit statistics, measuring advertising results | your consent (a) — you can withdraw it at any time |
| We defend our rights before a court or authority | only the data needed for the case | establishing, exercising or defending a legal claim | our legitimate interest (f) |
Technical drawings and project files. The files you send us (drawings, specifications) are used only to assess the project, prepare a quote and, if you become a customer, to manufacture the order. They are accessible only to the members of our team working on your project, are not published and are not shared with other companies, except in the situations listed in section 3. If you need a non-disclosure agreement (NDA) before sending your documentation, please write to us.
Data from the quote form. If you have accepted marketing cookies and send us the form, your email address and phone number are sent to Google only in irreversible cryptographic form (hash), so that we can measure whether our ads brought your request. Google does not receive the data in clear text through this mechanism. If you chose only strictly necessary cookies, this data is not sent.
No automated decisions. We do not take decisions about you based solely on automated processing, without human involvement.
3. Who we share data with
We do not sell or rent your data. We share it only where needed for the purposes above, and each recipient receives only the data it needs:
- our service providers, who work on our behalf, under contract and only on our instructions (processors): website and email hosting (Romarg SRL, in Romania), the marketing agency that manages the site;
- Google Ireland Limited — Google Analytics and Google Ads (only if you accepted the respective cookies) and the map on the contact page · Privacy Policy;
- transport companies, when we deliver an order: only the data needed for delivery (contact person, phone, delivery address);
- public authorities and courts, only when the law requires it or when we defend a right.
4. Transfers outside the European Economic Area
Data from the quote form and your correspondence with us is stored in Romania. Google may also process data in the United States. Such transfers take place only under the conditions of the GDPR (Chapter V): on the basis of the EU–US Data Privacy Framework and the standard contractual clauses adopted by the European Commission.
You can request a copy of the safeguards used by writing to the address in section 1.
5. How long we keep data
| Data | Retention |
|---|---|
| Quote requests, drawings and messages that did not become an order | 3 years from our last contact with you |
| Customer data: orders, contracts, invoices, delivery documents, correspondence | for the duration of the business relationship, then as long as Romanian tax and accounting law requires |
| Technical security data (server logs) | up to 12 months |
| Cookies | the durations in the Cookie Policy |
| Data needed in a dispute | until the case is finally resolved |
After these periods, the data is deleted or anonymised so that you can no longer be identified.
6. How we protect data
We use technical and organisational measures appropriate to the risk: encrypted connection (HTTPS) across the site, access to data and project files only for people who need them for their work, password-protected accounts, and providers offering contractual security guarantees. If a personal data breach occurs that may affect your rights, we notify the Romanian National Supervisory Authority for Personal Data Processing within 72 hours and, where required, you.
7. Your rights
Under the GDPR (Art. 15–22), you have the right:
- of access — to find out whether we process data about you and to receive a copy;
- to rectification — to have inaccurate data corrected or incomplete data completed;
- to erasure — to have your data deleted, for example when it is no longer needed or when you withdraw consent (subject to legal exceptions, such as the obligation to keep invoices);
- to restriction of processing — for example while we check the accuracy of contested data;
- to data portability — to receive the data you provided to us in a structured, machine-readable format, or to have it sent directly to another controller;
- to object — to processing based on our legitimate interest;
- to withdraw your consent at any time, as easily as you gave it. For cookies, use the “Cookie settings” link in the site footer. Withdrawal does not affect processing carried out before it.
How to exercise your rights. Write to us at office@metalicform.eu or by post to the address in section 1. We reply free of charge within one month of receiving your request. If the request is complex or we receive many requests, this period may be extended by two further months; we will tell you within the first month, with the reason. So that we do not disclose data to someone who is not you, we may ask for additional information to confirm your identity.
8. Complaints
If you believe we process your data in breach of the law, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or with the data protection authority in your country of residence, and the right to go to court. Please write to us first: in most cases we can resolve the issue directly and quickly.
9. Minors
Our site and services are intended for companies. We do not knowingly collect data about children under 16. If you become aware that a child has sent us data, write to us and we will delete it.
10. Changes to this policy
We update this policy when the way we process data changes, for example when we add a new tool to the site. The version in force is always the one published on this page, and the date of the last update is shown at the top.