Privacy policy

Who controls the data

COSAL SRL, tax ID RO1366159, Trade Register number J1992002890295, with its registered office at Str. Calea Unirii nr. 43, sat Păuleștii Noi, comuna Păulești, județul Prahova, RO, is the controller of the data described in this policy.

For questions about personal data, email office@cosal.ro.

Data we may receive

COSAL may receive data you provide by phone, WhatsApp, email or the contact form. Form enquiries are delivered to office@cosal.ro.

• Contact person's name.
• Company represented.
• Phone number.
• Email address.
• Message content and information later provided about the enquiry.
• The IP address and technical HTTP request metadata processed by the endpoint for security, origin validation and abuse prevention.

Why we use the data

• To receive and assess the enquiry.
• To contact you and request the information needed about the service.
• To prepare and discuss an offer or steps preceding a partnership.
• To keep records of commercial communications and comply with applicable legal obligations.
• To validate the request origin, protect the form and limit abusive submissions.

Legal basis

Depending on the context, data is processed to take steps before entering into a contract, perform a contractual relationship, comply with legal obligations or pursue the legitimate interest of managing commercial enquiries and related communications.

Where processing requires consent, it is requested separately and can be withdrawn for the future.

Who may access the data

Data is accessed by people within COSAL who need it to manage the enquiry and partnership.

Hosting and email providers may process data only in connection with their services. The form is processed on the website hosting infrastructure and sends the enquiry to office@cosal.ro.

If you choose WhatsApp, the communication is also processed by WhatsApp Ireland Limited under its own policy. After the relevant consent, Google provides Google Analytics 4 and Meta provides Meta Pixel.

Data may be disclosed to authorities where legally required.

How long we keep data

Data is kept only as long as necessary to manage the enquiry, the commercial relationship and applicable legal obligations. The specific period depends on the outcome of the enquiry and the nature of the documents containing the data.

When no longer required, data is deleted or anonymised unless the law requires its retention.

For abuse prevention, the endpoint uses an HMAC hash of the IP address as the rate-limiting file identifier; the raw IP address is not written to that file. The code does not configure automatic deletion of rate-limiting files, and their retention depends on the continuing security need and hosting administration.

Your rights

Subject to data protection law, you may request access, rectification, erasure, restriction, objection or data portability and information about how your data is used.

You may lodge a complaint with Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP), including through the information and form at dataprotection.ro.

Data security

COSAL seeks to restrict access and apply measures appropriate to the nature of the information. No internet transmission can be guaranteed completely risk-free.

The endpoint validates the request origin and limits abuse without saving form messages or the personal data entered in application logs. The hosting provider may separately process technical metadata to operate and secure its infrastructure.

Website and campaign measurement

Google Analytics 4 measurement ID G-NELCFTPYG1 loads only after consent to Analytics. It may process technical browser, device and page-use information with pseudonymous identifiers. Form data is not sent to it.

Meta Pixel 2301316174013729 loads only after consent to Marketing. It may process technical browser, device, page and measurement-event information. Advanced Matching is not used.

After a successful form submission, the technical events generate_lead and Lead may be recorded without name, company, phone, email or message content.

International transfers

Google, Meta and WhatsApp operate global services, and their use may involve processing outside the European Economic Area, including in the United States. Their policies describe applicable safeguards, which may include adequacy decisions, the EU–US Data Privacy Framework and European Commission standard contractual clauses.

You can avoid Google Analytics 4 and Meta Pixel transfers by refusing Analytics and Marketing. WhatsApp is optional; you can contact COSAL by phone, email or the form.

Automated decisions

COSAL does not use form data for decisions based solely on automated processing that produce legal or similarly significant effects.

Policy updates

This policy was last updated on 26 August 2026. Any new version and its update date will be published on this page.