Who we are
The controller of your personal data is WINLEX SRL. We process data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.
- Company name
- WINLEX SRL
- VAT ID / Trade Register no.
- 31707452 / J2013000965224
- Address
- Iași, Romania
- Data protection contact
- suport@winlex.ro · 0751 898 519
What data we collect
We only collect the data you give us when you contact us:
- Contact form: name, company (optional), email address, phone number (optional), subject and message.
- Email, phone or WhatsApp: your contact details and what you write or tell us.
- Contractual relationship: the contact person's details and those needed for invoicing.
The website counts visits directly on our server, without cookies and without third-party services. For security and to understand how the website is used, we keep an access log: IP address, time, page opened, referring page, device and browser type, as well as clicks on phone, email or WhatsApp. The log is deleted automatically after 30 days; after that only anonymous totals remain. We do not build visitor profiles and do not use this data for advertising.
Why and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to messages and preparing quotes | Steps prior to entering into a contract, at your request – Art. 6(1)(b) |
| Providing contracted services and technical support | Performance of a contract – Art. 6(1)(b) |
| Invoicing and accounting records | Legal obligation – Art. 6(1)(c) |
| Website security and abuse prevention | Legitimate interest – Art. 6(1)(f) |
| Access log and visit statistics, for security and to improve the website | Legitimate interest – Art. 6(1)(f) |
Before you send the contact form, we ask you to confirm that you have read this policy and agree to the processing of your data in order to receive a reply. We keep the date and time of this confirmation together with your message.
We do not use your data for marketing without your explicit consent and we never sell it.
How long we keep it
- Messages and quotes that do not become a contract: at most 2 years from the last contact.
- Contract and invoice data: for the duration of the contract and then as long as accounting law requires.
- Server technical logs: usually at most 90 days.
- Website access log (with IP address): 30 days.
- Visit statistics: at most 13 months, as anonymous totals only.
After these periods, data is deleted or anonymised.
Who we share it with
Data only reaches those who need it so we can serve you:
- the website and email hosting provider;
- our accountant or accounting firm;
- public authorities, only when required by law.
These providers process data only on our instructions and are required to protect it. We do not transfer data outside the European Economic Area. If you choose to message us on WhatsApp, messages also pass through Meta's services, under their privacy policy.
Data in our clients' systems
When we provide IT support or manage servers, backups or video surveillance systems, we may have access to our clients' data. In these cases the client remains the data controller and WINLEX acts as a processor: we access data only as far as needed for the job, only with the client's consent and under the terms set by contract.
For the video surveillance systems we install, the client is responsible for informing the people being filmed and for GDPR compliance. We help with recommendations on camera placement, storage time and access to recordings.
How we protect data
The website uses an encrypted connection (HTTPS). Access to your data is limited to the people who need it, with strong passwords and additional authentication where possible. Backups are protected in the same way as the original data.
Your rights
Under the GDPR, you have the right:
- to find out what data we hold about you and to receive a copy;
- to have incorrect data corrected;
- to have your data deleted when we no longer have a legal reason to keep it;
- to restrict processing;
- to receive your data in a structured format (portability);
- to object to processing based on legitimate interest;
- to withdraw your consent at any time, where processing is based on it.
Write to us at suport@winlex.ro and we will reply within 30 days. If you are not satisfied, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.
Changes
We may update this policy when our services or the law change. The version in force is always the one on this page, with the date of the last update shown at the top.