Privacy Policy
1. Introduction
QAPIROM PLAST SRL places great importance on protecting the personal data of persons who use the website https://www.qapistore.com (hereinafter the “Site”). This Privacy Policy is intended to inform Site users, in accordance with Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) and Romanian Law No. 190/2018 on its implementing measures, about how their personal data are collected, processed and protected.
The Site is intended exclusively for professionals. The data processed therefore mainly consist of professional contact details (name, position, professional email address and company), rather than consumer data.
2. Data Controller
The data controller responsible for the personal data collected through the Site is:
- QAPIROM PLAST SRL
- Loc. Borș, Parcul Industrial Borș, no. 2E, Bihor County, Romania
- Intra-Community VAT number: RO12562282
- Email: info@qapistore.com
3. Data Collected
3.1. Data collected through the contact form
When a user submits the Site contact form, the following data are collected: the user's email address, the content of the message, and the language and reference assigned to the request.
3.2. Data collected through a request for quotation
When a user submits a request for quotation, the following data are collected: the user's email address; the requested products, quantities and colours; any technical details provided (business sector, intended use and interest in volume pricing); the delivery method and address, where applicable; the company name and Intra-Community VAT number, or any equivalent supporting evidence, used to verify the requester's professional status, since the Site is reserved exclusively for professionals; and the requester's confirmation that the information provided is accurate. This professional identification information is declarative: it is not subject to automated verification and is not transmitted to any third-party service. It is verified manually by the QAPIROM PLAST SRL sales team.
A customer account is created automatically using the email address provided so that the request can be tracked. A temporary password is sent by email for this purpose.
3.3. Follow-up of a commercial offer
When a commercial offer issued following a request for quotation is accepted by the user, the Site records only the change of status (accepted or rejected) and the date of that change. No additional billing or payment data are collected by the Site at this stage. The remainder of the commercial relationship, including invoicing and delivery, is managed by QAPIROM PLAST SRL outside the Site in accordance with its usual commercial procedures. The Site does not currently offer any online payment method.
3.4. Browsing data
When the Site is accessed, certain technical data are recorded automatically for security purposes and to ensure the proper operation of the Site: IP address, request timestamps, pages viewed and browser type. These data are retained in the server's technical logs for a limited period necessary to detect security incidents and prevent abuse. The IP address is also used temporarily, without being stored in the database, to limit the number of Site form submissions and login attempts originating from the same source over a short period, in order to prevent automated abuse.
4. Cookies and Similar Technologies
The Site uses only cookies that are strictly necessary for its operation: a session cookie, which maintains the user's connection to the customer account from one page to another, with a rolling lifetime of approximately two hours of inactivity rather than a duration limited solely to the closing of the browser; and a security cookie, or anti-request-forgery token, which protects Site forms against fraudulent submissions. These cookies do not collect data for advertising or statistical purposes and do not require prior consent under the applicable exemptions. The Site does not currently use audience-measurement cookies, advertising cookies or third-party tracking cookies.
The contents of the quotation basket, including the selected products, quantities and selected factory, are stored directly in the user's browser using local storage. They are not transmitted to the server or retained by QAPIROM PLAST SRL until the request is submitted. This local storage has no automatic expiry period and remains in place until the user submits the request, empties the basket or deletes the browser's browsing data.
4.1. Map display of the factory location
The Site footer displays a Google Maps map solely to show the geographical location of the relevant production plant and make it easier to locate. This mapping feature is independent of the forms, customer account, requests for quotation, commercial offers and other data processing carried out by QAPIROM PLAST SRL. QAPIROM PLAST SRL does not transmit to Google Maps any data entered by users in these services, or any data relating to customers, requests for quotation or the commercial relationship. When the map is displayed, the user's browser may establish a technical connection with the services of Google Ireland Limited, in accordance with Google's own terms and privacy policy, available at policies.google.com/privacy.
5. Legal Basis for Processing
Depending on the circumstances, the data processing carried out through the Site is based on:
- the performance of pre-contractual measures and of the contract (Article 6(1)(b) GDPR): processing requests for quotation, managing the customer account and following up commercial offers;
- compliance with legal obligations (Article 6(1)(c) GDPR): retaining commercial and accounting documents, including quotations and invoices, for the period required by applicable law;
- the legitimate interests of QAPIROM PLAST SRL (Article 6(1)(f) GDPR): Site security, fraud prevention and responding to messages submitted through the contact form.
6. Purposes of Processing
The data collected are used for the following purposes:
- processing and responding to requests for quotation and contact requests;
- preparing and sending the corresponding commercial offers;
- managing the commercial relationship and following up commercial offers;
- managing the customer account, including authentication and request history;
- verifying the requester's professional status, since the Site is reserved exclusively for professionals;
- ensuring Site security and preventing fraudulent use;
- meeting the legal and accounting obligations of QAPIROM PLAST SRL.
7. Retention Periods
Data are retained only for the period strictly necessary for the purposes for which they are processed, after which they are deleted or anonymised, subject to the retention periods imposed by law for commercial and accounting documents. The table below summarises the main periods applied:
| Data category | Retention period |
|---|---|
| Customer account (login credentials) | For the duration of the commercial relationship, followed by deletion at the user's request (see Section 13) or after a prolonged period of inactivity |
| Requests for quotation, offers and commercial correspondence | Retained as commercial records for the statutory period applicable in Romania, including after deletion of the associated customer account |
| Invoices and accounting documents | Statutory retention period applicable to accounting documents in Romania |
| Contact-form messages that do not lead to a commercial relationship | 3 years from the last exchange |
| Technical connection logs (security) | 12 months |
8. Data Recipients
The data collected are intended for the internal departments of QAPIROM PLAST SRL authorised to process commercial requests, namely the sales and administrative teams. The data are not sold, rented or disclosed to third parties for commercial or advertising purposes. In particular, the company name and Intra-Community VAT number provided under Section 3.2 are not transmitted to any third-party verification service; they are checked manually and internally by the sales team.
9. Processors
QAPIROM PLAST SRL uses the following technical service provider, acting as a processor within the meaning of the GDPR, strictly for the purposes described in this Privacy Policy:
- OVH SAS (OVHcloud), France: hosting the Site and its database, and sending transactional emails such as confirmations, passwords and offers.
This service provider is selected on the basis of its GDPR compliance guarantees and is contractually bound by security and confidentiality obligations. The Site does not currently offer any online payment method and therefore does not use a payment service provider.
In addition, as stated in Section 4.1, Google Maps is used solely to display the geographical location of the factory. This feature is independent of the forms, customer account and the processing of requests for quotation or commercial offers. QAPIROM PLAST SRL does not transmit to Google Maps any data entered by users or any customer data. Google therefore does not act as a processor for QAPIROM PLAST SRL in connection with the management of the commercial relationship or the data collected through the Site.
10. Data Hosting
The Site is hosted by OVHcloud (OVH SAS), 2 rue Kellermann, 59100 Roubaix, France. The data are therefore hosted within the European Union, without transfer to a third country.
11. Data Security
QAPIROM PLAST SRL implements appropriate technical and organisational measures to protect personal data against loss, unauthorised access, disclosure or alteration. These measures include encryption of communications using HTTPS, irreversible password storage, access to data restricted to authorised persons only, and protection of Site form submissions against automated and fraudulent submissions.
12. User Rights
In accordance with the GDPR, every person whose data are processed by QAPIROM PLAST SRL has the following rights:
- Right of access: to obtain confirmation as to whether personal data concerning the person are being processed and to receive a copy of those data;
- Right to rectification: to have inaccurate or incomplete data corrected;
- Right to erasure: to request deletion of personal data, subject to the statutory retention obligations described in Section 7;
- Right to object: to object, on grounds relating to the person's particular situation, to processing based on the legitimate interests of QAPIROM PLAST SRL;
- Right to restriction of processing: to request that processing be restricted in certain cases provided for by the GDPR;
- Right to data portability: to receive the data provided by the person in a structured, commonly used and machine-readable format, or to request that such data be transmitted directly to another controller, where this right applies.
13. Exercising Your Rights
These rights may be exercised at any time by sending a request to info@qapistore.com, together with proof of identity where there is reasonable doubt concerning the requester's identity. QAPIROM PLAST SRL undertakes to respond to each request within a maximum of one month. This period may be extended by a further two months for complex requests, in accordance with the GDPR. A customer account may also be deleted directly from the customer area of the Site.
14. Competent Supervisory Authority
If, after contacting QAPIROM PLAST SRL, a user considers that his or her rights have not been respected, the user may lodge a complaint with the competent Romanian supervisory authority:
- Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania
- Website: www.dataprotection.ro
A user residing in another Member State of the European Union may also contact the supervisory authority of the user's country of residence.
15. Amendments to This Privacy Policy
This Privacy Policy may be updated at any time to reflect changes to the Site, the processing activities carried out or the applicable regulations. The date of the latest update is shown at the bottom of this page. Users are advised to consult this page regularly.
Last updated: 28 September 2026.