Privacy Policy
Last updated: 10 September 2026
1. Data controller
SCALUX S.R.L.
VAT No.: RO51299986
Trade Register No.: J2025011185009
Registered office: Șoseaua Iașului no. 11, Botoșani, Romania
E-mail: ionut@scalux.ro
Phone: +40 756 080 853
We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law. For any request concerning your data, write to the e-mail address above.
Given the nature, scope and purposes of our processing, we are not legally required to appoint a Data Protection Officer (DPO) and we have not appointed one. All requests concerning your data are handled directly at ionut@scalux.ro.
2. What data we collect and where it comes from
2.1. Data you give us
- Through the contact and quote forms: name, phone number, e-mail address, county, the subject of your request and the content of your message.
- Through the SCALL-e chat assistant: the text of the messages you write, including any contact details you choose to share there.
- During contracting and delivery: the delivery address and, for companies, the name, VAT ID and registered address needed for invoicing.
2.2. Data collected automatically
- From the hosting server logs: IP address, browser and device type, date and time of access. These are generated automatically by any web server and serve the operation and security of the site.
- Through analytics and marketing cookies: pages visited, time spent, the source you arrived from. This data is collected only if you have given your consent through the cookie banner. Full details in our Cookie Policy.
We do not collect special categories of data (health data, political opinions, religious beliefs and the like) and we never ask for such information. Please do not enter it in our forms or in the chat window.
3. Why we process your data and on what basis
| Purpose | Data used | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Answering your requests for quotes, advice or information | Name, phone, e-mail, message | Pre-contractual steps at your request — Art. 6(1)(b) | 2 years from the last interaction, if no contract follows |
| Performing the order: preparing the shipment, delivery, status updates | Name, contact details, delivery address | Performance of a contract — Art. 6(1)(b) | For the duration of the contract, then per the tax retention period below |
| Issuing invoices and keeping accounting records | Identification and billing data | Legal obligation — Art. 6(1)(c) | 5 years, counted from 1 July of the year following the end of the financial year, under accounting law |
| The SCALL-e chat assistant | Conversation text | Pre-contractual steps, at your request — Art. 6(1)(b), for conversations in which you ask us for a quotation or product information. Legitimate interest — Art. 6(1)(f) — for conversations with no contractual purpose, our interest being to respond promptly to visitors. You may ask us at any time to stop this processing, under Art. 21 GDPR. |
The conversation stays in your browser until you delete it. The transcript emailed to the SCALUX team is kept for a maximum of 90 days from the date of the conversation, then automatically deleted |
| Commercial communications | E-mail address | Consent — Art. 6(1)(a), read together with Art. 12 of Romanian Law no. 506/2004 | Until you withdraw your consent or, if you have not opened any of our messages for 24 months, until that period expires, when we remove you from the list automatically |
| Proof of consent for commercial offers | Name, e-mail, phone, IP address, date and time of the tick, the text you ticked | Legal obligation — Art. 6(1)(c), read together with Art. 7(1) GDPR (the obligation to be able to demonstrate consent) | 3 years from the withdrawal of consent or from the last interaction, after which it is deleted automatically |
| Website traffic analysis | Pseudonymised browsing data | Consent — Art. 6(1)(a) | 2 months for event data, 14 months for user data (as configured in Google Analytics) |
| Advertising and campaign measurement | Browser identifiers, conversion events | Consent — Art. 6(1)(a) | As per the durations in the Cookie Policy |
| Website security and abuse prevention | IP address, access logs | Legitimate interest — Art. 6(1)(f) | Maximum 12 months |
4. Who else has access to your data
We do not sell or rent your data. We disclose it only to the providers we need in order to operate, each acting as a processor or independent controller, strictly within the purpose we engaged them for:
| Provider | Role | What it receives | Location |
|---|---|---|---|
| ROMARG S.R.L. (Romania) | Hosting the website and the e-mail mailbox, processing the contact forms | All data submitted through the site and forms | Romania / European Union |
| Groq, Inc. | Generating the chat assistant's answers | The text written in the chat | United States of America |
| Google Ireland Ltd. / Google LLC | Traffic analysis, campaign measurement | Browsing data — only with your consent | Ireland / United States |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Ad measurement and remarketing | Browsing events — only with your consent | Ireland / United States |
| WhatsApp (Meta Platforms Ireland Ltd.) | Communication channel, if you choose to message us on WhatsApp or use the quick form on the home page | Your phone number, your name and the content of the messages you send us | Ireland / United States |
| Courier and transport companies | Delivering the products | Name, phone, delivery address | Romania |
| Accounting services | Accounting and tax records | Billing data | Romania |
| Public authorities | Where the law requires it | The data lawfully requested | Romania |
The chat assistant is an artificial intelligence system. When you write in the chat window you are communicating with a program based on a generative language model, not with a SCALUX employee. The text of your messages is sent for processing to Groq, Inc. (United States), which generates the reply. Automatically generated answers are indicative and may contain inaccuracies: they do not constitute a binding offer and do not contractually bind SCALUX. A binding quotation is communicated to you only by a SCALUX representative, in writing. We do not take any decision producing legal effects concerning you on the basis of this conversation.
To be able to reply, the written transcript of the conversation is emailed to the SCALUX team and kept in our records for at most 90 days. We do not keep audio recordings. Please do not enter sensitive data in the chat.
Are you required to provide this data? The data in the contact and quote forms (name, phone, e-mail) is needed so we can contact you and prepare your quote — without it we cannot answer your request. The marketing checkbox is optional: you provide it only if you wish, and refusal has no consequence on the service or on the reply to your request.
5. Transfers outside the European Union
Some of the providers listed above — Groq, Google and Meta — are companies established in the United States of America. As a result, part of your data is transferred outside the European Economic Area. The data filled into the contact forms does not leave the European Union: it is processed on the site’s own server, and the mailbox in which we receive it is hosted with the same Romanian hosting provider.
These transfers rely on the safeguards set out in Chapter V of the GDPR, which differ from one provider to another:
- Google and Meta — certified participants in the EU-U.S. Data Privacy Framework, a mechanism recognised by the European Commission's adequacy decision of 10 July 2023, supplemented by the Standard Contractual Clauses.
- Groq — the Standard Contractual Clauses, incorporated in the data processing addendum applicable to GroqCloud services.
The Standard Contractual Clauses referred to are those adopted by the European Commission through Implementing Decision (EU) 2021/914.
You can obtain a copy of the safeguards on which these transfers rely by writing to us at ionut@scalux.ro. The text of the Standard Contractual Clauses is also published in the Official Journal of the European Union, and the list of companies certified under the EU-U.S. Data Privacy Framework is publicly available on the site operated by the U.S. Department of Commerce.
Transfers to Google and Meta take place only if you have given your consent to analytics and marketing cookies respectively. If you refuse, these services are not loaded at all.
If you would rather not use channels hosted outside the EU, you can contact us directly by phone or e-mail, without filling in the forms and without using the chat assistant.
6. How long we keep your data
The specific periods are in the table in section 3. As a principle, we keep data only for as long as we need it for the purpose it was collected for, or for as long as the law requires, and then we delete or anonymise it.
7. Your rights
Under the GDPR you have the following rights:
- Access (Art. 15) — to find out what data we hold about you and receive a copy.
- Rectification (Art. 16) — to correct inaccurate or incomplete data.
- Erasure (Art. 17) — to request deletion where there is no longer a basis for keeping the data.
- Restriction of processing (Art. 18) — to request that processing be suspended while a challenge is verified.
- Data portability (Art. 20) — to receive your data in a structured, machine-readable format.
- Objection (Art. 21) — to object to processing based on legitimate interest. Objection to direct marketing is unconditional: if you exercise it, we stop immediately.
- Withdrawal of consent (Art. 7(3)) — at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out beforehand.
- Not to be subject to automated decision-making (Art. 22) — we do not take decisions producing legal effects about you by purely automated means, and we do not profile you for that purpose.
You can exercise any right by simply writing to ionut@scalux.ro. We reply within one month of receiving your request; this may be extended by two months for complex requests, in which case we tell you and explain why. Exercising your rights is free of charge.
You can change your cookie preferences directly, from the "Cookie settings" link in the footer of every page.
8. Data security
We apply technical and organisational measures appropriate to the risk: encrypted HTTPS across the whole site, access to data restricted on a need-to-know basis, separate passwords for the services we use, and regular backups.
If a personal data breach occurs that is likely to result in a high risk to you, we inform you without undue delay and notify the ANSPDCP within 72 hours, in accordance with Articles 33 and 34 GDPR.
9. Children
This website is intended for people over 16 years of age. We do not knowingly collect data from children below that age. If you become aware that a minor has sent us personal data, write to us and we will delete it.
10. Right to lodge a complaint
If you believe we are infringing your rights, please write to us first — most of the time we can resolve the matter directly. You always retain the right to contact the supervisory authority:
National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral Gheorghe Magheru no. 28-30, Sector 1, Bucharest, Romania
www.dataprotection.ro
You may also bring the matter before the competent courts.
11. Changes to this policy
We may update this policy when the services we use or the applicable law change. The date of the latest update is shown at the top of the page. For substantial changes — a new provider, a new purpose, a new legal basis — we notify you by e-mail or through a visible notice on the site, before the change takes effect.
12. Contact
For any question regarding data protection: ionut@scalux.ro, phone +40 756 080 853.