This is an English translation of the Romanian original. In case of any discrepancy between this translation and the Romanian version, the Romanian version prevails. Read the Romanian version of this Policy.
Privacy Policy
WHITEDECOR SRL · tandemcasa.ro
Version 2.4 · In force from 15 October 2026
This Policy applies to everyone who interacts with WHITEDECOR SRL — whether you visit the tandemcasa.ro website or the Tandem Casa showroom in Bucharest, or contact us by email, phone or WhatsApp. It explains what personal data we collect about you, for what purposes we process it, to whom we disclose it, how long we keep it and what rights you have as a data subject.
This Policy has been drawn up in accordance with Regulation (EU) 2016/679 (GDPR), Law no. 190/2018, Law no. 506/2004 and the other regulations applicable in Romania and in the European Union.
The company responsible for your personal data is:
Name: WHITEDECOR SRL
Registered office: București, Bd. Ghencea nr. 154A, parter, sector 6
Trade Register number: J40/15494/2015
Unique registration code: RO34773469
Legal representative: Corneliu Său (Administrator)
Contact email: [email protected]
Website: tandemcasa.ro
Tandem Casa showroom: Bd. Ghencea nr. 154A (Centrul Comercial Danielli), parter, sector 6, București
As the controller, we determine the purposes and means of the processing of your data and are directly responsible for the processing we carry out, in accordance with the applicable law. Independent controllers are responsible for the processing they carry out on their own behalf (sections 7.2 and 7.3). For the collection of data through Meta Pixel and its transmission to Meta, we are responsible jointly with Meta Platforms Ireland Limited, as joint controllers (section 7.3).
This Policy concerns you directly if you:
• visit the tandemcasa.ro website;
• fill in a contact form or a quote request, or subscribe to our newsletter;
• visit the Tandem Casa showroom in Bucharest;
• communicate with us by email, phone, WhatsApp or other channels;
• enter into a contract for the sale of our products.
This is the data you share with us through forms or in direct communication:
• first name and surname;
• phone number;
• email address;
• home and/or delivery address (when you request a quote or place an order);
• the content of your message or the details of your request;
• design preferences and project details (when you request a quote for furniture).
This is the data the website collects automatically during your visit — exclusively with your prior consent:
• IP address (anonymised, for Google Analytics 4);
• browser type, operating system, device;
• pages visited, visit duration, traffic source;
• cookie identifiers for analytics and advertising (Google Analytics 4, Google Ads, Meta Pixel).
If you allow the “Session recordings (Microsoft Clarity)” category, the following data is also collected through Microsoft Clarity:
• data about your interaction with the website: clicks, scrolling, mouse movements and screen taps, as well as the content of the pages as we display it to you — the content of form fields is always hidden and is not transmitted, and other personal data displayed on the page is masked;
• the addresses of the pages visited and the page you came from (referrer);
• device data: device type, browser, operating system, screen size;
• approximate location, determined on the basis of the IP address — the IP address is processed by Microsoft;
• the Microsoft Clarity user identifier (the _clck cookie) and the Microsoft identifiers stored in cookies on the clarity.ms and bing.com domains (for example, MUID).
Microsoft Clarity recordings are not anonymous: they are linked to the Clarity identifier of your browser.
If you allow the “Marketing” category, we transmit to Meta Platforms Ireland Limited, through Meta Pixel, events relating to your use of the website: page views, the successful submission of a form, a designer's partnership application, subscription to the newsletter, clicks on the phone number, email or WhatsApp, opening the showroom map or clicking on the Google Maps link. Together with the events, we transmit only the type of form or contact channel and, for the price calculators, the estimated amount of the calculation and the currency. With each event, Meta automatically receives:
• the page address and the page you came from (referrer);
• the IP address and browser data (user agent);
• the identifiers stored in the _fbp and _fbc cookies — the browser identifier and, if you reached the website from a Facebook or Instagram ad, the click identifier (fbclid).
If you are logged in to your Facebook or Instagram account in the same browser, or if there are Meta cookies on the facebook.com domain, Meta may link the event to your account or to those cookies. We do not transmit the content of forms (name, phone, email, message) to Meta — neither in plain text nor in hashed form — and automatic configuration of the pixel is disabled, so the pixel does not itself collect button clicks or page metadata.
If you allow the “Marketing” category, for two conversions — the successful submission of the price calculator for kitchens (including the form on the “Bucătării Brașov” page) and of the “Mobilare completă” (complete furnishing) price calculator — we transmit to Google Ads, through the enhanced conversions feature, the phone number you entered in the form concerned. The website converts the number to international format (+40…), and the Google tag irreversibly transforms it (SHA-256 hash) directly in your browser and transmits it to Google together with the conversion; if the number cannot be converted to international format with certainty, it is not transmitted. We do not transmit your name, and these forms do not collect your email address. The transmission takes place only if you allowed the “Marketing” category on or after 15 October 2026 (section 9.1).
We collect this data only after you give your consent in the cookie banner — for all categories, via “Accept all”, or for each category individually, via “Settings”. Microsoft Clarity data is collected only if you have allowed the “Session recordings (Microsoft Clarity)” category, which is separate from the “Analytics” category (Google Analytics); Meta Pixel data is collected only if you have allowed the “Marketing” category (section 7.3). Full details in section 9.
In the Tandem Casa showroom we collect video images (without sound) through a surveillance system installed for the safety of people and property. Full details in section 11.
All personal data comes directly from you — from forms, from your visit to the showroom, from your communication with our team or, with your consent, from the device you use to visit the website (section 4.2). We do not buy databases and do not work with data brokers.
We do not process special categories of personal data within the meaning of Art. 9 GDPR — that is, data concerning health, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning sex life.
The tandemcasa.ro website is not intended for persons under the age of 16, and we do not knowingly collect data about minors. If you are a parent or legal guardian and believe that we have collected data about a minor without your consent, write to us at [email protected] and we will delete it immediately.
We do not process data at random. For each activity we have a clear legal basis, in accordance with Art. 6 GDPR:
Purpose
Categories of data
Legal basis
Responding to requests sent through the contact form
name, phone, email, message content
Consent — Art. 6(1)(a) GDPR
Preparing the quote and performing the furniture sale contract
name, phone, email, delivery address, project details
Performance of a contract — Art. 6(1)(b) GDPR
Fulfilling tax and accounting obligations
billing data (including personal numeric code (CNP) / tax identification code (CUI), on request)
Legal obligation — Art. 6(1)(c) GDPR + Law 82/1991
Marketing communications by newsletter
name, email
Consent — Art. 6(1)(a) GDPR
Statistical analysis of traffic (Google Analytics 4)
anonymised IP, pages visited, cookie identifier
Consent — Art. 6(1)(a) GDPR + Law 506/2004
Analysing how the website is used through click maps and session recordings (Microsoft Clarity)
interactions with the website (clicks, scrolling, mouse movements, taps), page content without the content of form fields, pages visited and the page you came from, device and browser data, approximate location based on the IP address, the Clarity user identifier
Consent — Art. 6(1)(a) GDPR + Art. 4(5) of Law no. 506/2004 (the “Session recordings (Microsoft Clarity)” category); sharing with Microsoft Advertising — only if you have also accepted the “Marketing” category
Proof of consent for cookies (the consent log)
random identifier (the tandem_consent_id cookie), the choice made for each category, date and time, policy version, source of the choice (banner, settings or the dedicated window), language, region and page — without the IP address
Legal obligation — Art. 6(1)(c) in conjunction with Art. 7(1) GDPR
Online advertising (Google Ads, remarketing and Google Ads conversion measurement, including enhanced conversions for the price calculators; Meta Pixel — Facebook and Instagram: conversion measurement, optimisation of ad delivery, remarketing audiences)
cookie identifier, browsing behaviour; for Google Ads enhanced conversions: the phone number entered in the price calculators, irreversibly transformed (SHA-256 hash) in the browser before transmission; for Meta Pixel: events on the website (section 4.2), the page address and the page you came from, IP address, browser data, the identifiers stored in the _fbp and _fbc cookies
Consent — Art. 6(1)(a) GDPR + Art. 4(5) of Law no. 506/2004 (the “Marketing” category); for Meta Pixel — only consent given on or after 14 October 2026; for Google Ads enhanced conversions — only consent given on or after 15 October 2026
Communication via WhatsApp Business
name, phone, conversation content
Consent and/or performance of a contract — Art. 6(1)(a) / 6(1)(b)
Customer relationship management through a CRM (Kommo)
contact data, interaction history
Legitimate interest — Art. 6(1)(f) GDPR
Video surveillance in the showroom
video images
Legitimate interest — Art. 6(1)(f) GDPR + Law 333/2003
Responding to requests from public authorities
data relevant to the case
Legal obligation — Art. 6(1)(c) GDPR
We do not keep data for longer than necessary. This is how long we store each category:
Data category
Retention period
Requests made through the contact form (with no subsequent contract)
2 years from the last interaction
Data relating to sale contracts
Term of the contract + 5 years (Law 82/1991, as amended by Government Emergency Ordinance no. 26/2023)
Accounting data and invoices
5 years for current documents; 10 years for payroll records
Newsletter data (marketing)
Until consent is withdrawn
Analytics data (Google Analytics cookies)
Maximum 14 months (GA4 default setting)
Microsoft Clarity data (session recordings, click maps)
At Microsoft: session recordings — 30 days; click maps and click data, sessions marked by our team (tagged or saved as favourites) and a random sample of recordings — up to 9 months. Clarity cookies set by the website: _clck — 365 days, _clsk — 1 day, _cltk (sessionStorage) — until the tab is closed; Microsoft cookies on the clarity.ms and bing.com domains — from a few minutes to approximately 13 months (details in the Cookie Policy). For the processing it carries out on its own behalf, Microsoft may retain the data in accordance with its own Privacy Statement.
Meta Pixel data
We do not store the data transmitted through Meta Pixel; Meta retains it in accordance with its own privacy policy. Cookies: _fbp and _fbc (tandemcasa.ro) — 90 days; fr (facebook.com) — 90 days.
Data for Google Ads enhanced conversions (the hashed phone number)
We do not store the hash values; Google retains them in accordance with the Google Ads Data Processing Terms. We keep the phone number as part of your request, for the periods in this table that apply to that request.
Cookie consent log
Up to 3 years from the date of the choice
CCTV images
30 days, after which they are deleted automatically
Data in the Kommo CRM (active customers)
3 years from the last commercial interaction
Data for handling complaints
3 years from the resolution of the complaint
Data requested by authorities
In accordance with the statutory periods applicable to each case
When the applicable period expires, the data is deleted, anonymised or archived — where the law requires us to keep it.
To provide our services, we work with a few trusted providers. Your data may reach the following categories of recipients, only to the extent strictly necessary:
• Google Ireland Limited: Google Analytics, Google Ads, Google Tag Manager — EU/US servers, certified under the EU-US Data Privacy Framework; for Google Ads enhanced conversions (section 4.2), Google Ireland Limited acts as a processor in accordance with the Google Ads Data Processing Terms, and the data may be transferred to Google LLC (US) (section 8.2);
• WhatsApp Business (Meta Platforms Ireland Limited): business messaging platform for communicating with customers — Meta Ireland (EU), with ancillary processing in the US;
• Intuit Inc. (MailChimp): email marketing platform (newsletter) — US servers, certified under the EU-US Data Privacy Framework;
• Kommo Inc.: CRM system for managing customer relationships — with a Data Processing Agreement (DPA) and Standard Contractual Clauses.
For Microsoft Clarity — the click map and session recording service we use on tandemcasa.ro — Microsoft Ireland Operations Ltd is not our processor but an independent controller, in accordance with the Microsoft Clarity Terms of Use. That is why it is not listed in section 7.1. Specifically:
• WHITEDECOR SRL decides to integrate Microsoft Clarity into the website and, in doing so, to collect the data described in section 4.2 from your device and transmit it to Microsoft. We are responsible for this stage — including informing you and obtaining your consent (judgment of the CJEU in Case C-40/17, Fashion ID);
• Microsoft is the controller for the processing it subsequently carries out on its own behalf and may use the data in accordance with its Privacy Statement (privacy.microsoft.com/privacystatement), including to improve its services and to create user profiles for purposes that include advertising;
• if you have also accepted the “Marketing” category, Microsoft Clarity may also share the data with Microsoft Advertising, Microsoft's advertising service;
• the content of form fields is not transmitted to Microsoft, and other personal data displayed on the page is masked in the browser before transmission;
• the data may be transferred to Microsoft Corporation (US) on the basis of the EU-US Data Privacy Framework and of Standard Contractual Clauses (section 8.2); the retention periods are set out in section 6.
For the processing carried out by Microsoft on its own behalf, you can also exercise your rights directly with Microsoft, through the channels indicated in its Privacy Statement. For the collection and transmission stage on tandemcasa.ro, you can contact us at [email protected]. You can withdraw your consent at any time (section 9.3).
For Meta Pixel (ID 630698020843724) — the tool through which we measure the effectiveness of our advertising on Facebook and Instagram — Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) is not our processor. Specifically:
• for the collection of data through Meta Pixel from your device and its transmission to Meta, WHITEDECOR SRL and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR; judgment of the CJEU in Case C-40/17, Fashion ID), in accordance with Meta's “Controller Addendum” (www.facebook.com/legal/controller_addendum); we are responsible for informing you and for obtaining your consent, through the cookie banner;
• Meta carries out any further processing as an independent controller, including for its own purposes — displaying advertising and improving its own products — in accordance with its Privacy Policy (www.facebook.com/privacy/policy);
• our purposes: measuring the conversions generated by our advertising on Facebook and Instagram, optimising the delivery of these ads and building audiences for remarketing;
• the data transmitted is described in section 4.2; the content of forms (name, phone, email, message) is not transmitted to Meta, neither in plain text nor in hashed form;
• Meta Pixel loads only if you allowed the “Marketing” category on or after 14 October 2026 (section 9.1);
• the data may be transferred to Meta Platforms, Inc. (US) on the basis of the EU-US Data Privacy Framework and of Standard Contractual Clauses (section 8.2); we do not store the data transmitted through Meta Pixel, and Meta retains it in accordance with its own policy (section 6).
In respect of the joint processing (the collection and transmission of data through Meta Pixel), you can exercise your rights both with WHITEDECOR SRL, at [email protected], and with Meta. For the further processing carried out by Meta on its own behalf, contact Meta through the channels indicated in its Privacy Policy. You can withdraw your consent at any time (section 9.3).
• Accounting firm: processor for the fulfilment of tax and accounting obligations;
• Law firm: for specific legal advice or in the event of litigation.
Upon formal request from the competent authorities — the General Prosecutor's Office, the Police, the courts, ANAF (the National Agency for Fiscal Administration), ANSPDCP — within the limits and under the conditions laid down by law.
Products are delivered exclusively by the in-house team of WHITEDECOR SRL. We do not use external couriers.
We do not sell, rent or trade your personal data in any form. Data is disclosed exclusively to the recipients listed above and only to the extent strictly necessary to fulfil the stated purposes. Processors process it only on our behalf; Microsoft, as an independent controller, may also use it for its own purposes described in section 7.2 — only if you have allowed session recording; Meta may also use it for its own purposes described in section 7.3 — only if you have allowed the “Marketing” category.
Our servers are located in Romania, within the European Economic Area. Your data therefore remains under the direct protection of the GDPR and of the applicable Romanian law.
Some of the services we use are provided by international companies whose servers are located in the United States. These are:
• Google Analytics, Google Ads, Google Tag Manager;
• Meta Platforms (WhatsApp Business, Meta Pixel) — for Meta Pixel, the data may be transferred by Meta Platforms Ireland Limited to Meta Platforms, Inc. (US) (section 7.3);
• Intuit Inc. (MailChimp);
• Kommo Inc. (CRM);
• Microsoft (Microsoft Clarity) — the data may be transferred by Microsoft Ireland Operations Ltd to Microsoft Corporation (US), which processes it as an independent controller (section 7.2).
These transfers take place exclusively on the basis of a European Commission adequacy decision (Art. 45 GDPR) or of appropriate safeguards (Art. 46 GDPR):
• the EU-US Data Privacy Framework — European Commission Decision (EU) 2023/1795;
• the Standard Contractual Clauses adopted by European Commission Decision (EU) 2021/914.
Both safeguards apply to Microsoft Clarity: Microsoft Corporation is certified under the EU-US Data Privacy Framework, and the transfer from Microsoft Ireland Operations Ltd to Microsoft Corporation is covered by Standard Contractual Clauses.
Both safeguards also apply to Meta Pixel: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, and the transfers are additionally covered by Standard Contractual Clauses.
If you would like a copy of the safeguards applied to these transfers, write to us at [email protected].
The tandemcasa.ro website uses cookies in accordance with Art. 4 of Law no. 506/2004 and with the GDPR. Full details are in the Cookie Policy, available on the website.
On your first visit to the website, all non-essential cookies — analytics, session recording (Microsoft Clarity), functional and marketing cookies — are disabled. They are activated only after you press “Accept all” in the cookie banner or after you allow them individually via “Settings”. Microsoft Clarity does not load at all until you allow the “Session recordings (Microsoft Clarity)” category.
If, before Microsoft Clarity was introduced, you accepted at least one category of non-essential cookies, we ask you separately, through a small dedicated window, whether you allow session recording (“Allow” / “Don't allow”). Your answer concerns Microsoft Clarity only — your previous choices for the other categories remain unchanged. If you rejected all non-essential cookies at that time, we do not ask you again: recording stays off and you can turn it on at any time from “Cookie settings”. Consent to session recording is valid for 9 months; after this period we ask you again.
Until you allow the “Marketing” category, Meta Pixel does not load and the website does not send any request to Meta servers. Consent to “Marketing” given before 14 October 2026 does not cover Meta Pixel, because the description of the category at that time did not mention Meta. If you allowed the “Marketing” category at that time, we show you the cookie banner again, and the “Marketing” switch in “Cookie settings” stays off until you switch it on yourself or press “Accept all”. If you rejected the “Marketing” category, we do not ask you again.
The phone number from the price calculators is transmitted through Google Ads enhanced conversions (section 4.2) only if you allowed the “Marketing” category on or after 15 October 2026 — from that date, the description of the “Marketing” category in the banner mentions this transmission. Consent to “Marketing” given before 15 October 2026 does not cover the transmission of the phone number: in that case, the number is not transmitted, and the banner is not shown to you again because of this change, since it involves neither a new service nor a new recipient, but additional data for the same Google Ads conversion measurement. The website recognises consents given on or after 15 October 2026 by the indication of the banner version stored in the tandem_consent_prefs cookie. Through Google Consent Mode, the ad_user_data signal is set to granted only if you have allowed the “Marketing” category.
• Strictly necessary: session cookies and the cookies that store your consent status (including tandem_consent_prefs, which stores your choices for each category, the date of your choice and the version of the cookie banner in which you made your choice, and tandem_consent_rec, which stores your decision on session recording and its date) — used without consent, in accordance with Art. 4(6)(b) of Law 506/2004;
• Functional: embedded content from third-party providers (Google Maps and videos) — used only after consent; disabling them may limit the display of this content;
• Analytics: Google Analytics 4 (G-SQ89792Z0W) — used only after consent;
• Session recordings (Microsoft Clarity): click maps (heatmaps) and session recordings — a category separate from the analytics category (Google Analytics), with its own switch, off by default; used only after your separate consent. The cookie names and their durations are set out in the Cookie Policy;
• Marketing: Google Ads and remarketing via Google Tag Manager (GTM-NWTRQLZS), as well as Meta Pixel (ID 630698020843724) for advertising on Facebook and Instagram — used only after consent. For the price calculators, with consent to “Marketing” given on or after 15 October 2026, Google Ads also receives the phone number, irreversibly transformed (hash), through enhanced conversions; these do not add any new cookies (section 4.2). Meta Pixel sets the _fbp and _fbc cookies on tandemcasa.ro, and Meta may read or set the fr cookie on facebook.com; Meta may also use the data for its own purposes, including advertising (section 7.3). If you have also allowed session recording, consent to marketing additionally allows Microsoft Clarity to share data with Microsoft Advertising (section 7.2).
You can change your choices at any time via the cookie icon in the bottom-left corner of the page (the “Cookie settings” button). Changes do not affect data collected before — they apply only from then on.
To stop session recording: open “Cookie settings” (the cookie icon in the bottom-left corner of the page), switch off “Session recordings (Microsoft Clarity)” and press “Save choices” (or “Reject all”). The page reloads, recording stops, and the Clarity cookies set by the website (_clck, _clsk) and the _cltk session identifier are deleted. Cookies set by Microsoft on its own domains (clarity.ms, bing.com) cannot be deleted by the website — you can delete them in your browser settings. Data already transmitted to Microsoft remains subject to the periods set out in section 6.
To stop Meta Pixel: open “Cookie settings”, switch off “Marketing” and press “Save choices” (or “Reject all”). Meta Pixel immediately stops transmitting events, including on the page that is already open, and the _fbp and _fbc cookies set on tandemcasa.ro are deleted. Meta cookies on the facebook.com domain (for example, fr) cannot be deleted by the website — you can manage them in your Facebook or browser settings. Data already transmitted to Meta is retained by Meta in accordance with its own policy (section 7.3).
To stop the transmission of the phone number through Google Ads enhanced conversions: open “Cookie settings”, switch off “Marketing” and press “Save choices” (or “Reject all”). From that moment, the website no longer transmits the phone number to Google Ads, and the ad_user_data signal is set to denied. Hash values already transmitted are retained by Google in accordance with the Google Ads Data Processing Terms (section 6).
• Newsletter via MailChimp — exclusively on the basis of an explicit opt-in when you subscribe, followed by confirmation by email (double opt-in);
• Online advertising via Google Ads — exclusively on the basis of cookie consent; for the price calculators, conversion measurement also uses enhanced conversions, with the phone number irreversibly transformed (hash), only with consent to “Marketing” given on or after 15 October 2026 (section 9.1);
• Remarketing via Google Ads — exclusively on the basis of cookie consent;
• Advertising on Facebook and Instagram via Meta Pixel — exclusively on the basis of cookie consent;
• Direct communication via WhatsApp Business — when you initiate the contact.
Google Analytics 4 and Google Ads involve a form of statistical and demographic profiling — we segment users by geographic area, interests and browsing behaviour so that we can improve the website and display relevant advertising.
Through Meta Pixel, we measure the conversions generated by our advertising on Facebook and Instagram and, on the basis of the events on the website, build audiences for remarketing, to which we may show our ads on these platforms. Meta may link the events to your Facebook or Instagram account (section 4.2) and, as an independent controller for the further processing, may also use the data for its own purposes, including advertising, in accordance with its Privacy Policy (section 7.3).
We do not use Google Ads enhanced conversions to create profiles based on your phone number: we use them only to measure conversions — Google compares the hash value with Google account data so that we can determine more accurately which Google ads led to the requests sent from the price calculators. We do not use the phone number to show you ads or to build customer lists (the Customer Match feature is not used). Google processes the hash value as a processor, on our behalf (section 7.1).
We use Microsoft Clarity click maps and session recordings only to see how the website is used and to improve it — we do not use them to evaluate you as a person. Microsoft, as an independent controller, may, under its own responsibility, create user profiles for purposes that include advertising, in accordance with its Privacy Statement; Clarity data is shared with Microsoft Advertising only if you have also accepted the “Marketing” category (section 7.2).
This profiling:
• is carried out exclusively after you consent to the relevant cookie category;
• is not used for decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you — which is why Art. 22 GDPR does not apply;
• can be disabled at any time by changing your cookie preferences (section 9.3); for data already received by Microsoft or by Meta, you can also contact them directly (sections 7.2 and 7.3).
You can withdraw your consent to marketing at any time (Art. 7(3) GDPR). Withdrawal does not affect processing carried out before it — it applies only from then on. You can use any of the following means:
• the “Unsubscribe” link included in every marketing email (immediate effect);
• changing your cookie preferences via the cookie icon in the bottom-left corner of the page (the “Cookie settings” button) — switching off the “Marketing” category immediately stops Meta Pixel and deletes the _fbp and _fbc cookies, and the website no longer transmits the phone number to Google Ads through enhanced conversions (section 9.3);
• a written request to [email protected];
• a written request sent to the registered office of WHITEDECOR SRL.
The Tandem Casa showroom — located at București, Bd. Ghencea nr. 154A (Centrul Comercial Danielli), parter, sector 6 — is monitored by video surveillance cameras.
Purpose: the safety of people and property
Legal basis: legitimate interest — Art. 6(1)(f) GDPR in conjunction with Law no. 333/2003 on the guarding of premises
Categories of data: video images (no audio recording)
Retention period: 30 days, after which the images are deleted automatically
Access to the images: authorised staff of WHITEDECOR SRL and, upon formal request, the competent authorities
Information: visitors are informed by pictograms and notices visible at the showroom entrance
The GDPR grants you a number of rights, which we fully respect (Arts. 12–22, 77 and 79):
• The right to be informed (Arts. 13–14);
• The right of access to your data (Art. 15) — including obtaining a first copy of the data free of charge;
• The right to rectification (Art. 16);
• The right to erasure / “the right to be forgotten” (Art. 17);
• The right to restriction of processing (Art. 18);
• The right to data portability (Art. 20);
• The right to object to processing, including processing for direct marketing (Art. 21);
• The right not to be subject to a decision based solely on automated processing (Art. 22);
• The right to withdraw consent (Art. 7(3)) — at any time, without having to give reasons;
• The right to lodge a complaint with ANSPDCP (Art. 77);
• The right to an effective judicial remedy (Art. 79).
The first copy of your data is free of charge. For any further copies, we may charge an administrative fee proportionate to the actual cost of processing the request (Art. 15(3) GDPR).
To exercise any of these rights, contact us at:
Email: [email protected]
Postal address: WHITEDECOR SRL, Bd. Ghencea nr. 154A, parter, sector 6, București
We respond to your requests within a maximum of 30 days of receipt. In complex cases or where we receive a large number of requests, this period may be extended by a maximum of 2 months — we will inform you if this happens (Art. 12(3) GDPR).
To protect you from fraudulent requests, we may ask for additional information to confirm your identity before processing your request (Art. 12(6) GDPR).
Exercising your rights is free of charge. For manifestly unfounded or excessive requests — in particular because of their repetitive character — we may charge a reasonable fee or refuse to act on the request (Art. 12(5) GDPR).
Data security is an operational priority. This is specifically what we do (Art. 32 GDPR):
• we host the data on servers located in Romania (European Economic Area);
• we encrypt data in transit (TLS) and at rest (AES-256);
• we control access through role-based access control (RBAC) and multi-factor authentication (MFA);
• we keep regular, encrypted backups in a separate location;
• we apply an internal password policy and train our staff every year;
• we monitor access through audit logs;
• we have a security incident response plan.
We also apply the principles of data protection by design (privacy by design) and by default (privacy by default), in accordance with Art. 25 GDPR.
If a security breach involving your data occurs:
• we notify ANSPDCP within a maximum of 72 hours of becoming aware of it (Art. 33 GDPR);
• we notify you directly, without undue delay, if the breach poses a high risk to your rights and freedoms (Art. 34 GDPR).
We have not appointed a Data Protection Officer (DPO), because we do not meet the criteria that make such an appointment mandatory under Art. 37 GDPR. For any question relating to your personal data, write to us at:
Email: [email protected]
Postal address: WHITEDECOR SRL, Bd. Ghencea nr. 154A, parter, sector 6, București
If your rights are infringed, you can lodge a complaint with the national supervisory authority:
National Supervisory Authority for Personal Data Processing (ANSPDCP)
Address: B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, 010336 București
Phone: +40.318.059.211
Email: [email protected]
Website: www.dataprotection.ro
Alternatively, you can bring proceedings directly before the competent courts (Art. 79 GDPR).
We update this Policy from time to time — whenever the legal framework changes or our operational practices evolve.
Typographical corrections, editorial clarifications and technical updates are published on the website without individual notice.
Changes affecting the purposes, legal bases, recipients or your rights are brought to your attention by email (if we are in direct communication) and/or by being displayed prominently on the website, as follows:
• where a change introduces new consent-based processing (for example, a new service that uses cookies), it does not apply to you until you give a new and separate consent, through the cookie banner or a dedicated window; if you do not give your consent, the new processing does not take place, and your previous choices for the other categories remain valid;
• other substantial changes, concerning processing that is already under way, will be notified to you at least 30 days before they take effect.
Previous versions of this Policy remain available on request sent to [email protected].
This Policy is based on the following legal acts:
• Regulation (EU) 2016/679 — GDPR;
• Law no. 190/2018 — on measures implementing the GDPR in Romania;
• Law no. 506/2004 — on the processing of personal data and the protection of privacy in the electronic communications sector;
• Law no. 82/1991 — the Accounting Law, as amended by Government Emergency Ordinance (OUG) no. 26/2023;
• Law no. 333/2003 — on the guarding of premises, goods and valuables and the protection of persons (for CCTV);
• Decision (EU) 2021/914 — Standard Contractual Clauses for the transfer of data to third countries;
• Decision (EU) 2023/1795 — EU-US Data Privacy Framework.
Version: 2.4
Publication date: 15 October 2026
Effective date: 15 October 2026
What changed: we added Google Ads enhanced conversions for the price calculators for kitchens and for Mobilare completă (complete furnishing) to the “Marketing” cookie category: Google Ads receives only the phone number from the form, irreversibly transformed (SHA-256 hash) in the browser, and only with your consent given on or after 15 October 2026; the purpose (conversion measurement), the legal basis, the role of Google Ireland Limited as a processor under the Google Ads Data Processing Terms, data retention, the consent mechanism and its withdrawal (sections 4.2, 5, 6, 7.1, 9.1, 9.2, 9.3, 10.1, 10.2 and 10.3).
In case of any discrepancy between the Romanian version of this Policy and its translations, the Romanian version prevails.