Skip to content
RO Free audit

Privacy policy

This English version is provided for convenience. If there is any difference between the English and Romanian versions, the Romanian version prevails. Last updated: October 26, 2026. On this page we explain what personal data we collect through the northform.ro website, for what purpose, how long we keep it, who we share it with and what rights you have under Regulation (EU) 2016/679 (GDPR).

Controller
WINETOURSIASI S.R.L., NORTHFORM brand
Data collected
Only what you send us through forms and, with your consent, analytics data
Contact
Through the form on the contact page

Who the controller is

The controller of your personal data is WINETOURSIASI S.R.L., which operates the NORTHFORM brand and the northform.ro website.

  • Tax ID (CUI): 39756787
  • Trade Register No.: J22/264/2019
  • Registered office and other company details: see the terms and conditions

For any question about your personal data, you can write to us through the form on the contact page or at the email address shown on the same page.

What data we collect

We mainly collect the data you provide to us, plus the minimum technical data needed for the website to work. To reach out to other businesses, we also use their publicly available contact details, as described in Contacting businesses.

  • Form data: name, email, phone, company, website, the service you are interested in and your message. Phone, company and website are optional. Together with the message, we save the page you sent it from and the time you gave your consent.
  • Technical security data: to prevent automated messages (spam), we temporarily use your IP address, in encoded form, to limit the number of messages sent within a short period.
  • Analytics data: only if you give your consent in the cookie banner, we collect data through Google Analytics 4 about how you use the website. Details in the cookie policy.

We do not intentionally collect sensitive data, such as health data. Please do not include it in your messages.

Why we use the data and on what legal basis

PurposeData usedLegal basis
To reply to your messageName, email, phone, messageYour consent, given by ticking the consent box in the form (Art. 6(1)(a) GDPR)
To prepare the quote or audit you requestedForm data, company, websiteSteps taken at your request before entering into a contract (Art. 6(1)(b) GDPR)
To perform the contract and issue invoicesIdentification and billing dataPerformance of the contract and compliance with legal tax obligations (Art. 6(1)(b) and (c) GDPR)
To protect the website from spam and abuseEncoded IP, time of submissionOur legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR)
To understand how the website is usedAggregated analytics dataYour consent, given in the cookie banner

We do not use your data for automated decisions that produce legal effects, and we do not sell it. We do not send you newsletters without separate consent.

How long we keep the data

  • Messages and contact details with no contract: up to 24 months from the last contact, after which we delete them.
  • Data related to a contract: for the duration of the collaboration and, after that, for as long as tax and accounting laws require for supporting documents.
  • Technical anti-spam data: one hour at most.
  • Analytics data: according to the retention period configured in Google Analytics and described in the cookie policy.

You can ask us at any time to delete your data before these periods end, except for data the law requires us to keep.

Who we share the data with

We share your data only with the providers we need to run the website and to communicate. They process it on our behalf, under contract, and may not use it for other purposes.

  • The hosting provider of the website, where messages sent through the forms are stored.
  • The email provider through which we receive notifications and reply to you.
  • Google, for Google Analytics 4 and Google Tag Manager, only if you consent to analytics cookies.
  • Meta, for Meta Pixel, only if you consent to marketing cookies.
  • Our accountant and the authorities, for invoices and tax obligations, where there is a contract.

Some providers, such as Google and Meta, may also process data outside the European Economic Area. In these cases, the transfer takes place on the basis of the mechanisms provided for by the GDPR, such as adequacy decisions or the standard contractual clauses adopted by the European Commission.

Contacting businesses (B2B outreach)

Sometimes we write to businesses we have not worked with yet, to point out an issue on their website or how they appear in Google and in AI assistants. For this we only use data the business has published itself: its name, website, and the email address and phone number shown publicly for contact, usually generic addresses (office@, contact@).

  • Legal basis: our legitimate interest in presenting NORTHFORM services to other businesses (Article 6(1)(f) GDPR).
  • Personal report: for each business we contact, we may prepare a page at northform.ro/raport/ that is not indexed by search engines and can only be opened with the link sent to that business. It contains observations about the business's public website and the result of a test run in an AI assistant.
  • How long we keep it: up to 12 months from the last contact, unless we start working together. We delete the report on request, at any time.
  • Objecting: just reply "no" or "stop" to our message. We will not write to you again and will keep only your email address on a suppression list, so we can honour that request.

Your rights

Under the GDPR, you have the following rights:

  • the right to access your data and to receive a copy of it;
  • the right to have incorrect data rectified;
  • the right to have your data erased;
  • the right to restriction of processing;
  • the right to data portability;
  • the right to object to processing based on legitimate interest;
  • the right to withdraw your consent at any time, without affecting the processing carried out before the withdrawal.

To exercise any of these rights, you can write to us through the form on the contact page or at the email address shown there. We reply within one month of receiving your request at the latest.

If you are not satisfied with the way we process your data, you can file a complaint with Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP), on the dataprotection.ro website.

Security

The website uses an encrypted connection (HTTPS). Messages from the forms are stored in a private area of the website, accessible only to the administrator. We use strong passwords and update the software regularly.

Changes to this policy

We may update this policy when our services or the law change. The date of the last update is shown at the top of the page. For commercial conditions, please also see our terms and conditions.

Privacy PolicyCookie Policy