Last updated: 22.10.2026
This policy explains how N & A TRADE SRL processes the personal data of website visitors and of people who contact us, in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Romanian law (Law no. 190/2018 and Law no. 506/2004).
1. Who is the data controller
The data controller is N & A TRADE SRL, registered office at Str. Eduard Albert Bielz nr. 89, 550031 Sibiu, Romania, tax ID (CUI) 15931694, Trade Register no. J32/1515/2003.
For any question about your data, contact us at office@naforaje.ro or by phone at 0730 502 781.
2. What data we process
- Contact form data: name, email address, phone, town/county (optional), the content of your message and your choice regarding marketing communications.
- Data provided by phone or email: whatever you choose to tell us (e.g. name, phone, address of the drilling site).
- Contract data: identification and billing details, site address, documents needed for permits and approvals.
- Technical data: IP address, browser and device type, pages visited and time of access (server logs), and data collected through cookies as described in our Cookie policy.
We do not intentionally collect special categories of data (e.g. health data).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to enquiries and preparing quotes | Art. 6(1)(b) – steps taken at your request prior to entering into a contract |
| Performing the drilling contract and related services, including permit documentation | Art. 6(1)(b) – performance of a contract |
| Invoicing, accounting, archiving | Art. 6(1)(c) – legal obligation |
| Sending offers and news (direct marketing) | Art. 6(1)(a) – your consent, which you may withdraw at any time |
| Protecting the form against spam (Google reCAPTCHA) and website security | Art. 6(1)(f) – our legitimate interest in preventing abuse |
| Website usage statistics (Google Analytics) | Art. 6(1)(a) – consent, given through the cookie banner |
| Displaying the map (Google Maps) | Art. 6(1)(a) – consent |
| Defending our rights in possible disputes | Art. 6(1)(f) – legitimate interest |
The fields marked as mandatory in the form are required for us to reply. Without them, we cannot process your request.
4. How long we keep data
- Enquiries that do not lead to a contract: no longer than 12 months after the last communication.
- Contract data and accounting documents: for the period required by accounting law (currently, as a rule, 10 years for supporting documents).
- Marketing data: until you withdraw your consent.
- Cookie data: for the durations listed in the Cookie policy.
- Server logs: for the limited period set by the hosting provider, for security purposes.
5. Who we share data with
We do not sell or rent your data. We may share it, strictly as needed, with:
- the website's web and email hosting provider;
- Google Ireland Limited (Google reCAPTCHA and, with your consent, Google Analytics and Google Maps);
- our accountant and advisers, who are bound by confidentiality;
- public authorities, where required by law or to obtain permits (e.g. the National Administration "Romanian Waters") for contracted work;
- partners involved in carrying out the work (e.g. water testing laboratories), only after informing you.
6. Transfers outside the European Economic Area
Google services may involve transfers of data to Google LLC in the United States. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified, and, where applicable, on standard contractual clauses.
7. Your rights
Under the GDPR you have the following rights:
- right of access to your data (Art. 15);
- right to rectification (Art. 16);
- right to erasure ("right to be forgotten", Art. 17);
- right to restriction of processing (Art. 18);
- right to data portability (Art. 20);
- right to object, including to direct marketing (Art. 21);
- right to withdraw consent at any time, without affecting the lawfulness of prior processing;
- right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., Sector 1, Bucharest, www.dataprotection.ro, or with the supervisory authority in your EU country of residence.
To exercise your rights, write to us at office@naforaje.ro. We will reply without undue delay and within one month of receiving your request. For complex requests this may be extended by two further months, in which case we will let you know.
You can change your cookie preferences at any time in .
8. Data security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), access limited to the staff who need the data, and providers offering sufficient data protection guarantees.
9. Automated decisions and children
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you. This website is not directed at persons under 16.
10. Changes to this policy
We may update this policy when the law or the way we process data changes. The current version is published on this page, with the date of the last update shown at the top.