Privacy policy

1. Who is the controller

The data controller is TOBIMAR CONSTRUCT SRL, tax ID RO17419985, registered with the Trade Register under no. J01/395/2005, with its registered office in Drâmbar locality, Ciugud commune, 28 Calea Alba Iulia, Alba County, postal code 517241. For requests regarding personal data, you can write to us at tobimarconstruct@tobimar.ro.

2. Data We Collect

We collect only the data necessary to respond to requests and to manage applications.

• Contact form: name, email, phone if provided, subject, message, IP address, and technical security data.
• Career form: name, email, phone, desired position, message, CV, file name and type, IP address, and the time of consent confirmation.
• Chatbot AI: the questions and answers in the conversation, the page from which the discussion was initiated, an anonymous technical session identifier, token usage, latency, and any errors. Please do not enter sensitive data.
• Technical data: information strictly necessary for session operation, CSRF protection, abuse prevention, and storing cookie preferences.
• Analytics and marketing data, only after consent: visited pages, page type, clicks on phone/email/CTA, successful form submissions, filters, and searches without the searched text. We do not transmit through tracking any name, email, phone, message, CV, IP, or user agent from the site forms.
• Local analytics data, only after consent: anonymous visitor and session identifiers, visited pages, page type, source/referrer at domain level, UTM parameters, device type, and conversions. We do not store IP, raw user agent, name, email, phone, message, CV, or search text.
• Accessibility preferences: text size, contrast, spacing, reading tools, and text-to-speech settings are stored locally in the browser, without being sent to the server.

3. Purposes and legal bases

We process data to respond to requests, prepare potential collaborations, evaluate applications, ensure site security, and comply with legal obligations.

• Steps taken at the data subject’s request before entering into a contract and performance of a contract, under Article 6(1)(b) GDPR.
• Our legitimate interest in communicating, protecting the website, preventing abuse, and defending the company’s rights, under Article 6(1)(f) GDPR.
• The legitimate interest in providing informative answers through the chatbot, verifying their relevance, and improving service quality, without automated decision-making with legal effects.
• Compliance with legal obligations under Article 6(1)(c) GDPR.
• Consent, only for optional technologies or situations where it is requested separately, under Article 6(1)(a) GDPR.
• Consent for analytics and marketing, used to measure audience, campaigns, and conversions through Google, Meta, and LinkedIn, when these tools are enabled.
• Consent for analytics, used for the local traffic and conversions dashboard, without personal data.
• The legitimate interest in providing functional accessibility tools requested by the user, without profiling and without tracking.

4. Who We May Share Data With

Access is restricted to authorized personnel and vendors who help us operate the website and communications, based on confidentiality and data protection obligations.

• Hosting, IT maintenance, email, and security providers.
• OpenAI, the provider of AI technology, receives the content sent in the chatbot and relevant fragments from public pages to generate the response. API requests are configured not to be stored for model training by the application.
• Legal advisors, accountants, or other specialists, when necessary.
• Public authorities, courts, or other entities, when required by law.
• Google Ireland Limited, Meta Platforms Ireland Limited, and LinkedIn Ireland Unlimited Company may receive analytics or marketing events only after the corresponding category is accepted in the preferences center. Instagram is measured through Meta Pixel, not through a separate tag.

5. Retention Period

Contact messages are generally retained for no more than 24 months, applications and CVs for no more than 12 months, and chatbot conversations for no more than 30 days from the last message. OpenAI may temporarily retain API data for abuse monitoring, typically for up to 30 days, in accordance with its applicable policies. Data may be retained longer if there is a legal obligation, a dispute, or a contractual relationship that justifies it. Cookie preferences are stored for a maximum of 180 days.

6. International Transfers

Using OpenAI, Google, Meta, LinkedIn, or other technical providers may involve processing data outside the European Economic Area. Such a transfer will be carried out only on the basis of a GDPR-permitted mechanism, such as an adequacy decision, the applicable transfer framework, or standard contractual clauses.

7. Your Rights

Under GDPR, you may request access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn.

• Send your request to tobimarconstruct@tobimar.ro. We may request additional information to verify your identity.
• You have the right to file a complaint with the National Supervisory Authority for Personal Data Processsing, dataprotection.ro.

8. Security and Updates

We apply reasonable technical and organizational measures, including access control, CSRF protection, submission limiting, and private storage of CVs. We may update the policy when functionalities or applicable requirements change; the current version is published on this page.