Privacy notice

Who processes your data

The controller of your data is EXPOZITIEI 4A SRL, tax identification number (CUI) 54686200, Trade Register number J2026031734002, EUID ROONRC.J2026031734002 (“we”).

Registered office: Șos. Pipera 46D-46E-48, Bl. A, Et. 5, Ap. BIR. E5.07, 020112 București (Oregon Park).

For any question about your data, write to us at sales@baseexpozitiei.ro.

You can also contact us by post at our registered office, or using the details on the site’s Contact page.

What data we process

We process only the data below.

• The details you enter in the forms: your name, phone number, email address, your message, the homes you are interested in (their codes) or the type of home you are looking for, and your preferred date and time of day for a visit or a call.
• Details about the request, added automatically: the form type, the page you sent it from, the site language, the campaign parameters in the page address (for example utm_source), and the date and time it was sent.
• The tick boxes in the form: the date and time you confirmed that you agree to be contacted, the version of the text shown and, separately, whether you agreed to receive news by email.
• A fingerprint (hash) of your IP address, calculated on the server with a secret key (HMAC-SHA-256) and kept to limit repeated or abusive submissions. Your IP address itself is used only briefly, in the server’s memory for at most 10 minutes, for the same limit, and is not stored.
• Your IP address and technical data about your browser and device, which Cloudflare receives through the Cloudflare Turnstile anti-spam check when you start filling in or send a form. When our server checks the result, it also sends your IP address to Cloudflare.
• Technical data about visits to the site (for example the IP address, the page requested, the date and time, and the response code), which the hosting provider records automatically in its logs to run and secure the service.
• Your cookie choice and, only if you accept analytics, statistics about how the site is used (see the cookie policy).

We do not store your IP address itself, nor the type of your browser or device (user agent). We do not ask for sensitive data, such as health data; please do not include it in your message.

Why we process your data and on what legal basis

• To answer your request (offer, visit, call), arrange the visit or call and send you the information you asked for. Legal basis: steps taken at your request before entering into a possible contract (Article 6(1)(b) GDPR).
• To email you, through Resend, the links to the fact sheets of the homes you requested an offer for (PDF, valid for 14 days). Legal basis: the same steps taken at your request (Article 6(1)(b) GDPR).
• To record requests in our internal sales application, assign them to the team, keep in touch with you about your request and keep a record of our conversations. Legal basis: our legitimate interest in organising our sales work and answering interested people consistently (Article 6(1)(f) GDPR).
• To keep an audit log in the internal application, showing what was changed in a record and when. Legal basis: our legitimate interest in keeping the data secure and accurate (Article 6(1)(f) GDPR).
• To send you news about BASE Expoziției by email, only if you ticked this option separately. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
• To protect the site and the forms against spam and abuse: the anti-spam check, the limit on submissions, the IP address fingerprint and the technical logs. Legal basis: our legitimate interest in keeping the site secure (Article 6(1)(f) GDPR).
• To avoid losing a request that could not be recorded because of a technical error: we keep an encrypted copy for a short time, only so that we can record it later. Legal basis: the steps taken at your request and our legitimate interest in not losing requests (Article 6(1)(b) and (f) GDPR).
• To understand, from aggregate statistics, how the site is used, only if you accept analytics. Legal basis: your consent (Article 6(1)(a) GDPR).
• To comply with the legal obligations that apply to us, for example tax and accounting obligations if we sign a contract, or obligations towards the authorities. Legal basis: Article 6(1)(c) GDPR.
• To establish, exercise or defend our rights in a dispute. Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

The required tick box in the form confirms that you are asking us to contact you and that you have read this notice; we keep it, with the version of the text, as a record. Answering your request is based on the steps taken at your request, not on consent. Consent to email news is separate and optional.

Where we rely on our legitimate interest, we have checked that it is not overridden by your interests, rights and freedoms. You can object to this processing at any time (see “Your rights”).

Who has access to your data and who receives it

• Our sales team and authorised people within the company, through the internal application in which requests are recorded, each with a user account.
• The company’s shareholders and our partners in the project, to whom we have given access to the internal application. They see all the request details and may use them only for the purposes in this notice, under a duty of confidentiality.
• People with an administration or audit role in the internal application: every request is also copied into the application’s audit log.
• Providers that process data on our behalf under a contract (processors): Vercel (site hosting; the server functions run in the Frankfurt region, Germany), Supabase (the internal application’s database, hosted in the Frankfurt region, Germany) and Cloudflare (the Turnstile anti-spam check).
• Resend, the email provider through which we send the request notification to the sales team, the fact sheets to you and, if a request cannot be recorded because of a technical error, its encrypted copy to our internal operations mailbox.
• The provider of the company’s email service, in whose mailboxes we receive the notifications and our correspondence with you.
• Plausible Analytics, the provider of the analytics tool, only after you consent.
• OpenFreeMap, only if you open the interactive map on the Location page: your browser then loads the map tiles from the servers of this independent service, which see your IP address. We send it no other data.
• Our professional advisers (for example lawyers, accountants or financial auditors), only when needed and under a duty of confidentiality.
• Authorities, public bodies and courts, where the law requires us to.

We do not sell or rent your data, and we do not use it for advertising.

Transfers outside the European Economic Area

Where our providers let us choose, we keep data in the European Economic Area (EEA): the site’s server functions run in Frankfurt, and the internal application’s database is hosted in Frankfurt. The site’s pages are delivered through the hosting provider’s global network, from the server closest to you.

Vercel, Supabase, Cloudflare and our transactional email provider are based in the United States or belong to groups with companies there, so some data may be accessed or processed outside the EEA, for example for technical support, security or email delivery. In those cases the transfer takes place only with the safeguards set out in Chapter V of the GDPR: the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, for certified providers, or the standard contractual clauses approved by the European Commission, with additional measures where needed.

On request, we will tell you which safeguards apply to each provider.

How long we keep your data

• Request details, including those in the internal application and the copies in the audit log: 24 months after our last interaction with you; if we sign a contract, the data needed for it is kept for the term of the contract and then for as long as the law requires.
• Data used for email news: until you withdraw your consent; after that we keep only the record of your consent and its withdrawal.
• The record of the tick boxes (date, time and text version): for as long as we keep the request details, plus the limitation period during which it may be needed as evidence (generally 3 years).
• The IP address fingerprint and technical security data: 6 months.
• The encrypted copy of a request that could not be recorded because of a technical error (sent to our internal operations mailbox and written, also encrypted, to the hosting provider’s technical logs): until the request is recorded in the internal application, after which we delete it; never more than 30 days.
• The technical logs of the hosting provider and the email provider: for the period those providers set for their logs, after which they are deleted automatically.
• The links to the home fact sheets expire after 14 days.

At the end of these periods we delete the data or anonymise it so that it can no longer be linked to you.

Your rights

You have the right to ask for access to your data, for its rectification or erasure, for restriction of processing and for portability of the data you gave us.

You can object at any time, on grounds relating to your situation, to processing based on our legitimate interest, and you can object at any time, without giving a reason, to the use of your data for email news. You can withdraw your consent to email news or to analytics at any time; this does not affect processing carried out before the withdrawal.

To exercise any of these rights, write to us at sales@baseexpozitiei.ro.

You can also send your request by post to our registered office, or use the details on the Contact page. We will answer within one month of receiving it; if the request is complex, this may be extended by two further months, and we will tell you if so. We may ask you for more information to confirm your identity.

You also have the right to lodge a complaint with the Romanian data protection authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), Bulevardul General Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro, and the right to go to court.

Which data is required

The fields marked as required (your name, phone number and email address) and the tick box asking us to contact you are needed for us to answer; without them the request cannot be sent. The other fields and consent to email news are optional.

Automated decisions

We do not use your data for automated decisions or for profiling.

How we protect your data

We use encrypted connections (HTTPS), account-based access to the internal application, secret keys kept separately from the site’s code, keyed fingerprints instead of IP addresses, and encryption for the copies of requests that could not be recorded. Our providers apply their own security measures, set out in our contracts with them.

Children

The site is intended for people aged 18 or over. We do not knowingly collect data about children.

Changes

We update this notice when the way we process data changes. The date of the last update and the text version are shown at the top of the page.