Privacy policy

1. Who processes the data

The controller is MTC ROMÂNIA IMPEX SRL (“MTC”), VAT/registration code 4379153, Trade Register number J1993002861126, EUID ROONRC.J1993002861126, with its registered office in Cluj-Napoca, Bd. 21 Decembrie 1989, nr. 129, bl. L7, sc. 3, ap. 54, 400604, Cluj County; phone +40 264 412 583.

For any question about personal data, write to gdpr@mtc.ro.

2. What data we process

• Browsing and security data: IP address, date and time, page requested, browser type and errors, processed by the hosting provider to deliver the website.
• Contact data: name, position, company, email, phone and the content of the correspondence.
• Data in requests for offers or samples: contact person, company, products and quantities wanted, technical details about the application.
• Data from the contractual relationship: signatories and representatives, offers, orders, contracts, delivery, installation and service documents, accounting documents, insofar as they contain personal data.
• Conversations with the virtual assistant, only if you choose to use it.
• Local browser storage: your choice regarding the assistant and the session identifier of the conversation.

We do not ask for special categories of data under Art. 9 GDPR, such as health or biometric data. Please do not send them to us or enter them in the assistant.

3. Why we process the data

• Delivering and protecting the website (operation, diagnostics, security, abuse prevention). Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• Answering messages and requests, preparing offers and sending samples. Legal basis: steps prior to a contract, when you are a party to the future contract (point b); otherwise, our legitimate interest in business-to-business communication (point f).
• Selling, delivering, installing and servicing products. Legal basis: performance of the contract (point b) or, for representatives of legal entities, our legitimate interest (point f).
• Invoicing and mandatory archiving. Legal basis: tax and accounting obligations (point c).
• Defending our rights and handling complaints. Legal basis: our legitimate interest (point f) and, where applicable, legal obligations (point c).
• The virtual assistant. Legal basis: your consent (point a), which you can withdraw at any time from “Privacy settings” at the bottom of the page.

The legitimate interest pursued is the secure operation of the website, abuse prevention, managing professional relationships and defending MTC’s rights.

4. Contact form and virtual assistant

In this version of the website, the form on the Contact page is a demonstration and does not send any data; you can contact us by email or phone.

The virtual assistant is an optional service, designed and provided by BEYOND SOFTWARE SRL. Only after you explicitly accept it are your messages sent to an Azure OpenAI artificial intelligence model in Microsoft Azure, which generates the answer. The model runs in Microsoft’s European Union data zone (Sweden, with a fallback in Germany).

Conversations are kept for 30 days after the last message and are then deleted automatically. You can delete a conversation at any time from the chat window. After deletion, a conversation may remain for at most 7 days in the database backups, which are used only for recovery after an incident.

The assistant does not take solely automated decisions that produce legal effects concerning you (Art. 22 GDPR); its answers are for information and may contain errors.

5. Who receives the data

The data are accessed only by MTC’s authorised staff and by the providers that help us process them:

• BEYOND SOFTWARE SRL (VAT/registration code 40707869, Trade Register number J2019000787121, EUID ROONRC.J2019000787121, Cluj-Napoca) designed and provides the virtual assistant, as a contracted service, and manages the website hosting and the DNS zone of the mtc.ro domain, as MTC’s processor.
• Microsoft Azure (Microsoft Ireland Operations Limited) provides the infrastructure of the website and of the assistant, as sub-processor, under the Microsoft data processing agreement.
• Microsoft 365 (Microsoft Ireland Operations Limited) hosts MTC’s email, as MTC’s processor.
• Partners involved in an order, for example the carrier or the manufacturer of a machine under warranty, only with the data needed for that order.
• Accounting or legal advisers and public authorities, only when disclosure is necessary and has a legal basis.

We do not sell personal data and we do not use it for targeted advertising.

6. Where the data are processed

The website is delivered by Microsoft Azure, from a resource in the West Europe region. The assistant and its logs run in the Sweden Central region, and the artificial intelligence model in the EU data zone. Email is hosted by Microsoft 365.

If a provider accesses or transfers data outside the European Economic Area, for example for technical support, the transfer takes place only with the safeguards required by the GDPR: an adequacy decision or standard contractual clauses. You can ask for details about the safeguards at gdpr@mtc.ro.

7. How long we keep the data

• The website delivery logs are kept by Microsoft, as hosting provider; MTC does not keep website access logs.
• Conversations with the assistant: 30 days after the last message; in backups, at most 7 days after deletion.
• Technical logs of the assistant: 30 days, without the content of the conversations. Anti-abuse counters of the assistant: 35 days.
• Your choice regarding the assistant, saved in the browser: until you change it or clear the website data; the session identifier: until the tab is closed.
• Requests and correspondence that do not lead to a contract: as long as needed to answer you and for any follow-up on the request; they are then deleted, unless there is a legal obligation to keep them.
• Order correspondence and documents, including warranty and service records: for the duration of the contractual relationship and then as long as needed for legal obligations and the defence of rights.
• Financial and accounting documents: the periods set by accounting and tax law.

When the period expires, the data are deleted or anonymised. Exercising the right to erasure does not remove legal archiving obligations.

8. Cookies and browser storage

This website does not use cookies, analytics or tracking technologies and does not contact other services before you accept the assistant: fonts and images are delivered from mtc.ro. When you answer the virtual assistant panel, your browser saves your choice locally so that we can respect it, and after you accept the assistant, its window keeps a session identifier for the conversation, only until the tab is closed. This storage is strictly necessary (Law no. 506/2004, Art. 4(5)) and is not used for any other purpose.

9. Security

We apply technical and organisational measures appropriate to the risks: access only for people with assigned duties, encrypted connections (HTTPS), a strict content security policy, no third-party scripts, and incident procedures. No transmission over the internet is entirely free of risk; for technical information of high commercial value we recommend the channels agreed by contract and, where appropriate, a confidentiality agreement.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest, the right not to be subject to a solely automated decision, and the right to withdraw consent at any time, without affecting the processing carried out before withdrawal.

Send your request to gdpr@mtc.ro. We answer without undue delay, within one month at most; for complex requests the period may be extended by two further months, and we will inform you within the first month. Requests are free of charge, with the exceptions provided by law. We ask for additional information only if we have reasonable doubts about your identity.

You can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

11. Data received from other people

When a company sends us a representative’s data for an offer or an order, we use only the data needed for professional communication. Send us other people’s data only if you have a legal basis and they have been informed.

12. Marketing communications

Correspondence about a request, an offer or an order is not marketing. We do not use conversations with the assistant for promotional messages and we do not carry out profiling. Promotional emails are sent only with the legal basis required by law, and you can object to receiving them at any time.

13. Changes

We may update this policy if our operations, providers or the law change; the date of the last update is shown at the top of the page.