Privacy policy

Who the controller is

The controller is BAKO ENTERPRISES SRL, a limited liability company under Romanian law, tax number 51592330, registered with the trade register under no. J2025025096005.

Registered office: Str. Școlii nr. 123, Sat Irina, com. Andrid, jud. Satu Mare, 447012, România.

Authorised representative: Bako David.

Write to bakoenterprisessrl@gmail.com or call +40 746 578 041. We are not required to appoint a data protection officer; requests about data are handled at the addresses above.

What we process

What you send us: name, company name, email address, phone number, the service you are asking about and the text of your message, when you fill in the contact form.

Technical data saved alongside the message: the IP address and browser type it was sent from. We keep those strictly to stop automated submissions, and only for thirty days.

Traffic data: which page was opened, roughly how long it was actually read, which country the request came from, what kind of device, and which site sent you. None of this is tied to your name — see the section on how we measure traffic.

For what purpose, on what basis

To answer your enquiry, prepare a quote and, if it becomes a project, perform the contract — art. 6(1)(b) GDPR, pre-contractual steps and performance of a contract.

To stop automated submissions and abuse of the form — art. 6(1)(f), our legitimate interest in keeping the site working.

To know which pages are read and where traffic comes from — art. 6(1)(a), your consent. Until you give it on the banner, the measurement does not start at all.

To load advertising tools, should there ever be any — art. 6(1)(a), your consent, given on the privacy banner.

To keep contractual and financial records — art. 6(1)(c), a legal obligation.

How we measure traffic

We use no Google Analytics and no third-party analytics tool of any kind, and nothing is written to your device for this. Visits are grouped by a value derived from the IP address and the browser, combined with a secret key that is replaced every day and never leaves our database. The IP address itself is not stored. Once the key rotates, yesterday’s rows can no longer be linked to today’s visitor — not even by us.

This measurement starts only once you switch it on. Until then nothing leaves the page — not a view, not a duration, not a country. You can withdraw the consent at any time under "Cookie settings" in the footer of every page, exactly as easily as you gave it.

Who we share it with

We do not sell or rent data, in any circumstance.

The site and the database are hosted by Cloudflare, Inc., which acts as a processor and handles requests across its server network.

Our email provider and our accountant may access the data strictly needed for their role, under processing agreements.

We disclose data to public authorities only where the law requires it.

Transfers outside the European Union

Cloudflare may process requests on servers located outside the European Economic Area. Those transfers rely on the standard contractual clauses approved by the European Commission. No advertising tool is active at present, so no transfer to Meta or any comparable provider takes place.

How long we keep it

Messages received through the form: two years.

The IP address and browser saved with a message: thirty days, after which they are cleared from the row and the message remains.

Traffic data: fourteen months.

Contractual and financial records: for the period required by tax and accounting law.

Deletion happens automatically, on schedule, not on request. A retention period nobody enforces is not a period, it is a sentence.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interest.

Where processing rests on consent, you can withdraw it at any time, exactly as easily as you gave it, from "Cookie settings" in the footer of every page. Withdrawal does not affect the lawfulness of processing before it.

Exercise these rights by writing to bakoenterprisessrl@gmail.com. We answer within one month.

You also have the right to lodge a complaint with the supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, www.dataprotection.ro.

Automated decisions and profiling

We make no automated decisions with legal effect on you and build no individual profiles. The traffic measurement is aggregate and answers "which pages are read", not "who reads them".

Do you have to give us this data

No. Filling in the form is voluntary, and you are under no contractual or legal obligation to write to us. Without a name and either an email address or a phone number we cannot reply, and that is the only reason we ask for them.

Security

The site is served over HTTPS only. The admin area is password-protected, uses server-side sessions that can be revoked at any time, and is not indexed by search engines. Only the company’s administrator can read incoming messages.

Changes to this policy

If we change this policy we update the date shown at the top of the page. If the change concerns the purpose or the basis of processing that rests on consent, the banner will ask you again rather than assume the old answer still stands.