CONTRAIL MACHINERY S.R.L., as personal data controller (“Contrail”, “we”, “us”, “our”), takes responsibility for protecting and respecting the confidentiality of personal data.
This Privacy Policy explains how we collect, use, disclose, and protect personal data in the context of:
using our website www.contrailmachinery.com (“Website”);
contacting us via the Website or other channels;
requesting quotations (RFQs) for machines/services;
ordering spare parts via our online store (where available).
This Policy is based on the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and applicable national provisions.
If you have questions about this Policy or about how we process your data, you can contact us at the details below.
1. Controller identification and contact details
Controller: CONTRAIL MACHINERY S.R.L.
Registered office/pickup location: 79 Rudeni Street, Building D, Chitila, Ilfov County, 077045, Romania
Company ID: 33845800
Email: office@contrail.ro
Phone :+40 374 020 640
We handle requests promptly and in accordance with applicable law. Requests are generally handled free of charge; however, if requests are manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or refuse the request, as permitted by law.
2. Definitions
For the purposes of this Policy:
Personal data: any information relating to an identified or identifiable natural person (“data subject”).
Processing: any operation performed on personal data (collection, storage, use, disclosure, deletion, etc.).
Restriction of processing: marking stored personal data to limit future processing.
Profiling: automated processing of personal data to evaluate certain personal aspects (e.g., interests inferred from browsing).
Controller: the legal entity that determines the purposes and means of processing (here: CONTRAIL MACHINERY S.R.L.).
Consent: freely given, specific, informed, and unambiguous indication of the data subject’s wishes.
Supervisory authority: the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).
Cookies: small text files stored on your device when you browse the Website.
Retargeting/remarketing: marketing activity where ads may be shown based on previous interactions with the Website.
3. Categories of personal data we may process
Depending on how you interact with us, we may process the following categories of data:
3.1. Website and navigation data
IP address, browser type, device data, and operating system
pages visited, time/date, referrer, interaction data
cookie identifiers (where applicable)
3.2. Contact and communication data
name, surname
email address, phone number
company name and role (if applicable)
the content of messages and attachments you provide (including technical information)
3.3. RFQ and technical data (machines/services and spare parts inquiries)
machine model and serial number (where relevant)
part references, drawings, photos, specifications
communication history and clarifications
3.4. Online store order data (spare parts)
ordered spare parts, quantities, order references
billing details (name/company, billing address, VAT/tax identifiers where applicable)
order status and communications
3.5. Payment-related data (bank transfer only)
We do not process card payments on the Website. Payments are made by bank transfer.
We may process data that appears in payment-related documents/records (e.g., payer name, payment reference, transaction identifiers) for reconciliation and accounting.
3.6. Pickup/delivery data
pickup contact details and appointment-related communications
if delivery is agreed separately: delivery address, contact name/phone for the carrier, and delivery coordination details
3.7. Marketing preference data (where applicable)
newsletter subscription status, opt-in/opt-out logs
interactions with marketing emails (e.g., open/click data), where such tools are used
4. Collection and processing of personal data, purposes, and legal bases
We process personal data for the purposes and under the legal bases described below, such as:
compliance with applicable legal obligations;
performance of contracts and pre-contractual steps;
your consent (where required);
our legitimate interests (e.g., security, fraud prevention, service improvement), balanced against your rights.
4.1. Online store activities (spare parts)
4.1.1. Purpose: Placing and managing an order for spare parts
Legal basis: performance of a contract/steps before entering into a contract
Data categories: identification/contact data, billing data, ordered items, order timestamps, communications
Processing duration: for the period needed to manage the order, plus any legally required retention for related documents
Recipients/processors: website/e-commerce service providers; internal staff responsible for order processing
4.1.2. Purpose: Issuing documents (proforma/invoice) for orders
Legal basis: legal obligation (accounting/tax rules)
Data categories: billing data, ordered items, invoice details
Processing duration: retained for statutory periods applicable to accounting documents and for audit/legal defense needs
Recipients/processors: accounting providers; competent public authorities, where legally required
4.1.3. Purpose: Payment reconciliation (bank transfer)
Legal basis: performance of a contract and/or legal obligation (accounting)
Data categories: payment reference, payer name (as appears in bank records), invoice/order reference
Processing duration: retained in line with accounting/statutory requirements and internal financial record keeping
Recipients/processors: banks (as independent controllers), accounting providers (where applicable)
4.1.4. Purpose: Preparing the order and arranging pickup from our headquarters
Legal basis: performance of a contract
Data categories: name/contact details, order reference, pickup communications
Processing duration: as needed for pickup and order completion; communications may be retained for operational traceability
Recipients/processors: internal staff; IT/hosting providers (where communications flow through Website systems)
4.1.5. Purpose: Optional delivery (only if agreed separately)
Legal basis: performance of a contract and/or steps before entering into a contract
Data categories: delivery address, contact person, phone number, shipment coordination details
Processing duration: as needed to arrange delivery and manage related claims
Recipients/processors: courier/transport partners (only the minimum necessary data)
Important: Delivery is arranged only upon written agreement, and costs/terms are handled separately.
4.2. RFQs, inquiries, and technical correspondence (machines/services and spare parts)
4.2.1. Purpose: Handling requests for quotation (RFQs) and technical discussions
Legal basis: steps prior to entering into a contract and/or legitimate interest in responding to inquiries
Data categories: contact data; company/role (if applicable); technical data you provide (serial numbers, part refs, drawings, photos); message content
Processing duration: for the duration of the quotation process and a reasonable period thereafter for traceability and follow-up
Recipients/processors: internal technical/sales teams; IT/email providers
4.3. Customer support, claims, warranty/service (where applicable)
4.3.1. Purpose: Handling support requests, complaints, and service communications
Legal basis: performance of a contract and/or legitimate interest in improving products/services and handling claims
Data categories: contact data, order/invoice references, issue descriptions, photos/videos (if provided)
Processing duration: for the duration of the support/service handling and a reasonable period thereafter for legal defense
Recipients/processors: internal support/service teams; IT providers; authorities where legally required
4.4. Website security, fraud prevention, and abuse protection
4.4.1. Purpose: Security monitoring and preventing misuse/fraud
Legal basis: legitimate interest in securing the Website, systems, and users
Data categories: IP address, logs, device/browser data, security events
Processing duration: kept for limited periods necessary for security and troubleshooting
Recipients/processors: hosting/security providers; competent authorities if legally required
4.4.2. Google reCAPTCHA (anti-spam/abuse)
We use Google reCAPTCHA to protect forms and the Website against spam, automated abuse, and attacks.
Legal basis: legitimate interest in ensuring Website security and preventing abuse (and/or consent where required by your local rules/configuration)
Data categories: IP address, device/browser data, interaction signals (e.g., mouse movements/typing patterns), risk signals used to determine whether traffic is legitimate
Recipients: Google may act as an independent controller for certain processing under its terms/policies
4.5. Marketing activities and online advertising
We may run marketing activities to communicate relevant information about our products and services (e.g., updates, technical information, events). Where required, we rely on consent; in other cases, we may rely on legitimate interest, always offering a clear opt-out.
4.5.1. Purpose: Newsletter / direct marketing communications (where used)
Legal basis: consent (where required) and/or legitimate interest (where allowed)
Data categories: name, email; marketing interaction data (opens/clicks) where such tracking is enabled
Processing duration: until you unsubscribe/withdraw consent, plus a limited period to record your preference
Recipients/processors: email service providers (if used), IT providers
You can opt out at any time via the unsubscribe option in emails or by contacting us at office@contrail.ro.
4.5.2. Purpose: Online analytics (Google Analytics)
We use Google Analytics to understand how visitors interact with the Website and to improve performance and content.
Legal basis: consent, where required for analytics cookies (managed via cookie banner/settings)
Data categories: cookie identifiers, IP address and related network data, device/browser info, usage events (pages viewed, clicks, session data)
Recipients: Google (as provider)
4.5.3. Purpose: Online advertising and remarketing (Meta Pixel)
We use the Meta Pixel (Facebook/Instagram) to measure advertising effectiveness and, where enabled, to support remarketing.
Legal basis: consent, where required for marketing cookies/trackers (managed via cookie banner/settings)
Data categories: website events (e.g., page views), cookie/device identifiers, IP address, browser/device information
Recipients: Meta may process data as an independent controller under its own policies
4.5.4. Profiling / micro-targeting (where enabled)
Where marketing/remarketing tools are enabled based on your consent, you may see ads on other platforms that relate to your interactions with our Website. This may involve segmentation/profiling based on online identifiers and browsing events.
5. Sharing and transfers of personal data
We have a firm approach to data protection and do not sell personal data.
We may share personal data with third parties mainly for:
preventing fraud and securing transactions;
ensuring Website operation and IT support;
analytics and marketing activities (where enabled and consented);
complying with legal obligations and responding to lawful requests by authorities;
establishing, exercising, or defending legal claims.
Data minimization applies: we share only what is necessary for the specific purpose and expect our partners to implement appropriate safeguards.
6. International transfers (outside EU/EEA)
In the context of using providers such as Google and Meta, personal data may be transferred and/or processed outside the EU/EEA (including in the United States). Where applicable, such transfers are carried out using recognized safeguards (e.g., contractual clauses and other mechanisms required by data protection law).
7. Data retention
We take measures to ensure that personal data is not stored longer than necessary for the purposes for which it is processed.
We may retain certain documents longer:
if required by law;
if necessary for ongoing or future legal proceedings;
to establish, exercise, or defend our rights.
8. Security of processing
We continuously evaluate and update the security measures we implement to ensure they remain appropriate for protecting individuals’ rights and freedoms. We use technical and organizational measures (e.g., access control, secure hosting, monitoring, and staff awareness practices) designed to protect personal data.
9. Your rights as a data subject
Under the GDPR, you may have the following rights (depending on your circumstances):
Right of access: obtain confirmation whether we process your data and receive a copy.
Right to rectification: correct inaccurate or incomplete data.
Right to restriction: limit processing in specific cases.
Right to erasure: request deletion in cases provided by law.
Right to withdraw consent: at any time, where processing is based on consent (does not affect processing already carried out).
Right to object: especially where processing is based on legitimate interest; and at any time for direct marketing.
Right to data portability: receive your data in a structured, commonly used format and transmit it to another controller, where applicable.
Right to lodge a complaint with the Romanian supervisory authority (ANSPDCP).
To exercise your rights, contact us at office@contril.ro. We may request information necessary to confirm identity and to handle the request securely.
10. Cookies and similar technologies
Information collected through cookies and similar technologies is part of browsing the Website. Cookies may be used for:
ensuring Website functionality and proper display of content;
maintaining security and preventing abuse;
analytics and performance measurement (where enabled);
marketing/remarketing (where enabled and consented).
For details about specific cookies, categories, and how you can control or disable them, please consult our Cookie Policy.
11. Third-party links and social media
The Website may include links to third-party websites or social media platforms. If you access those links, the processing of your data will be governed by the policies of those third parties. We encourage you to read the privacy policies applicable to those platforms.
12. Automated decision-making
We do not make decisions that produce legal or similarly significant effects solely by automated means.
However, where marketing tools are enabled based on consent, some level of profiling/segmentation may occur for advertising purposes (e.g., showing relevant ads based on browsing events).
13. Changes to this Privacy Policy
We may update this Policy from time to time.
14. Contact
CONTRAIL MACHINERY S.R.L.
79 Rudeni Street, Building D, Chitila, Ilfov County, 077045, Romania
CUI: 33845800
Privacy email: office@contrail.ro
Phone: +40 374 020 640