Privacy policy

The data controller is CITRAFORGE S.R.L., with registered office at Sat Răcăuți, Comuna Buciumi, Bacău County, Str. Învățător Ion Mihalache no. 44, Romania. Tax ID (CUI) 55810411, trade register no. J2026061201004.

Privacy contact: email citraforge@yahoo.com, phone +40 747 637 612.

We have not appointed a Data Protection Officer (DPO), as it is not mandatory for our activity.

This is an informational website: it has no private areas, no data collection forms and no registration. We process personal data only in the two cases below.

When you visit the site, the servers of the infrastructure that hosts it (Cloudflare) automatically receive technical data: IP address, date and time of the request, requested page, browser and device type, language and country of origin.

• Purpose: delivering the pages, keeping the site secure and preventing abuse and cyber attacks.
• Legal basis: the controller’s legitimate interest in the security and proper operation of the site (Art. 6(1)(f) GDPR).
• Retention: for the time strictly necessary, set by the infrastructure provider. Citraforge does not run its own access logs and does not use them to profile visitors.
• Provision of data: technical data is needed to display the site. Without it the pages cannot be delivered.

If you write to us by email or call us, we process the data you give us: name, email address or phone number, the content of your message and any other information you choose to share.

• Purpose: replying to your request, giving you the information you ask for and, if you ask, following up on a proposal or quote.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for general enquiries, our legitimate interest in replying (Art. 6(1)(f) GDPR).
• Retention: for the time needed to handle your request and then up to 24 months after the last contact, to protect possible legal claims. If a contract is entered into, data is kept for the duration of the contract and for the legal periods (including tax).
• Provision of data: optional. If you do not give us the data, we cannot reply.

This site does not use profiling cookies, analytics cookies or advertising cookies, and does not load content from third-party services (the fonts are served directly from our own domain). There are no social network buttons, embedded maps or embedded videos.

If the technical infrastructure were to set cookies that are strictly necessary for security, these do not require your consent, in line with Directive 2002/58/EC (ePrivacy) and the national implementing law. If we add analytics tools or other non-essential cookies in future, we will update this policy and ask for your consent before enabling them.

Data is not sold or passed to third parties for marketing. It may be processed by service providers, as processors or as independent controllers:

• Cloudflare, Inc. and group companies: hosting, content delivery network and site security.
• The email service provider we use for communications.
• Advisers and professionals (for example an accountant or legal adviser), only where necessary and bound by confidentiality.
• Public authorities, where required by law.

Some providers (such as Cloudflare and the email provider) may also process data in countries outside the EEA, in particular the United States. In that case the transfer relies on a European Commission adequacy decision (for example the EU-US Data Privacy Framework, for providers that participate in it) or on appropriate safeguards such as standard contractual clauses (Art. 46 GDPR). You can ask us for a copy of the safeguards using the contacts above.

At any time you can exercise the rights set out in Articles 15-22 GDPR:

• access to your personal data and a copy of it;
• rectification of inaccurate data or completion of incomplete data;
• erasure of data (“right to be forgotten”), in the cases provided for;
• restriction of processing;
• data portability, where applicable;
• objection to processing based on legitimate interest, on grounds relating to your particular situation.

To exercise them, write to citraforge@yahoo.com. We reply within one month of the request (extendable in complex cases, Art. 12 GDPR). To protect your privacy we may ask you to verify your identity.

If you believe the processing breaches the GDPR, you have the right to lodge a complaint with a supervisory authority. The authority competent for the controller is the ANSPDCP, the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro). You may also contact the authority of your country of residence: for Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).

No automated decision-making or profiling: we do not use your data for automated decisions that produce effects on you.

The site is not aimed at children under 16 and we do not knowingly collect children’s data.

The site links to the SuperPOS service (superpos-citra.it), which has its own privacy policy. This policy does not apply to the SuperPOS platform or to other external sites reached through links.

We may update this policy, for example for new services or changes in law. The update date is shown at the top: please check it from time to time.