Privacy policy

1. Who processes the data

The controller is MTC ROMÂNIA IMPEX SRL, which operates the BarrierLab laboratory: VAT/registration code 4379153, Trade Register number J1993002861126, EUID ROONRC.J1993002861126, registered office in Cluj-Napoca, Bd. 21 Decembrie 1989, nr. 129, bl. L7, sc. 3, ap. 54, 400604, Cluj County; phone +40 264 412 583.

For any question about personal data, write to gdpr@mtc.ro.

This policy explains how we process the data of website visitors, of people who send requests and of the representatives of clients and suppliers, in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian law. Technical data about a film or a material are not, as a rule, personal data, but they may be confidential business information.

2. What data we process

• —Browsing and security data: IP address, date and time, page requested, browser type, errors and abuse-protection events.
• —Contact data: name, position, company, email, phone and the content of the correspondence.
• —Data in the testing or assessment request: contact person, type of request, packed product, materials and tests wanted, details of the packaging machine and process, and the photos sent later by email.
• —Data from the contractual relationship: signatories and representatives, offers, orders, contracts, sample receipt documents, reports and accounting documents, insofar as they contain personal data.
• —Conversations with the virtual assistant, only if you choose to use it.
• —Local browser storage: your choice about the assistant and the conversation session identifier.

We do not ask for special categories of data under Art. 9 GDPR, such as health or biometric data. Please do not enter them in the form or in the assistant.

3. Why we process the data

• —Delivering and protecting the website (operation, diagnostics, security, abuse prevention). Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).
• —Answering messages and requests, preparing offers. Legal basis: steps prior to a contract, when you are a party to the future contract (Art. 6(1)(b) GDPR); otherwise, our legitimate interest in business-to-business communication (point f).
• —Contracting and providing the services (communication, documentation, traceability, delivery of results). Legal basis: performance of the contract (point b) or, for representatives of legal entities, our legitimate interest (point f).
• —Invoicing and mandatory archiving. Legal basis: tax and accounting obligations (point c).
• —Defending our rights and handling complaints. Legal basis: our legitimate interest (point f) and, where applicable, legal obligations (point c).
• —The virtual assistant. Legal basis: your consent (point a), which you can withdraw at any time from “Privacy settings” at the bottom of the page.

The legitimate interest pursued is the secure operation of the website, abuse prevention, handling professional requests and defending MTC’s rights. The required fields of the form are needed to assess the request; without them we cannot answer you.

4. The request form

The form on the Contact page sends the request by email to laborator@barrierlab.ro, as text only, with your address as the reply address. You receive a reference code, with which you can email us the photos. Requests are not kept on the form server after sending.

To limit abuse, the form server counts requests per day using a hashed form of the IP address, from which the address cannot be read; the counters are deleted automatically the next day. The form’s technical logs do not contain the content of the requests.

5. The virtual assistant

The virtual assistant is an optional service designed and provided by BEYOND SOFTWARE SRL. Only after you accept it explicitly are your messages sent to an Azure OpenAI artificial intelligence model in Microsoft Azure, which generates the answer. The model runs in Microsoft’s European Union data zone (Sweden, with Germany as backup).

Conversations are kept for 30 days from the last message and are then deleted automatically. You can delete a conversation at any time with the “Delete conversation” button in the chat window. After deletion, a conversation may remain for up to 7 days in the database backups, which are used only for recovery after an incident.

To limit abuse and costs, the service counts messages per day using a hashed form of the IP address; the address is not saved, and the counters are deleted after 35 days.

Under the Azure OpenAI service terms, Microsoft does not use the messages to train models and may keep them for up to 30 days, solely to detect abuse.

The assistant does not take solely automated decisions that produce legal effects on you (Art. 22 GDPR); its answers are for information.

6. Who receives the data

The data are accessed only by MTC’s authorised staff and by the providers that help us process them:

• —BEYOND SOFTWARE SRL (VAT/registration code 40707869, Trade Register number J2019000787121, EUID ROONRC.J2019000787121, Cluj-Napoca) designed and provides the virtual assistant, as a contracted service, and manages the website hosting and the sending of form requests, as MTC’s processor.
• —Microsoft Azure (Microsoft Ireland Operations Limited) provides the infrastructure of the website, the form and the assistant, as sub-processor, under the Microsoft data processing agreement.
• —Hostinger hosts the laboratory mailbox, as MTC’s processor.
• —Accounting or legal advisers and public authorities, only when disclosure is necessary and has a legal basis.

We do not sell personal data and we do not use it for advertising.

7. Where the data are processed

The website is delivered by Microsoft Azure, from a resource in the West Europe region. The form, the assistant and their logs run in the Sweden Central region, and the artificial intelligence model in the EU data zone.

If a provider accesses or transfers data outside the European Economic Area, for example for technical support, the transfer takes place only with the safeguards required by the GDPR: an adequacy decision or standard contractual clauses. You can ask for details about the safeguards at gdpr@mtc.ro.

8. How long we keep the data

• —Technical logs of the form and the assistant: 30 days, without the content of requests or conversations.
• —The website delivery logs are kept by Microsoft, as hosting provider; MTC does not keep website access logs.
• —Abuse-prevention counters: until the next day for the form and 35 days for the assistant.
• —Assistant conversations: 30 days from the last message; in the backups, up to 7 days after deletion.
• —Requests and correspondence that do not lead to a contract: as long as needed to answer you and for any follow-up on the request; they are then deleted, unless there is a legal obligation to keep them.
• —Project correspondence, test files and reports: for the duration of the project and then as long as needed for legal obligations, traceability of results and the defence of rights.
• —Financial and accounting documents: the periods set by accounting and tax law.
• —Your choice about the assistant, saved in the browser: until you change it or clear the website data; the session identifier: until you close the tab.

When the period expires, the data are deleted or anonymised. Exercising the right to erasure does not remove legal archiving obligations.

9. Cookies and browser storage

This website does not use cookies, analytics or tracking technologies and does not contact other services before you accept the assistant. If you use the virtual assistant, your browser stores locally your choice about the assistant, so that we can respect it, and, once you accept the assistant, a session identifier for the conversation, kept only until you close the tab. This storage is strictly necessary (Law no. 506/2004, Art. 4(5)) and is not used for any other purpose.

10. Security

We apply technical and organisational measures appropriate to the risks: access only for people with assigned duties, Azure services accessed through managed identities with no passwords in code, encrypted connections and incident procedures. No transmission over the internet is entirely free of risk; for technical information of high commercial value we recommend the channels agreed by contract and, where appropriate, a confidentiality agreement.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest, the right not to be subject to a solely automated decision, and the right to withdraw consent at any time, without affecting the processing carried out before withdrawal.

Send your request to gdpr@mtc.ro. We answer without undue delay, within one month at most; for complex requests the period may be extended by two further months, and we will inform you within the first month. Requests are free of charge, with the exceptions provided by law. We ask for additional information only if we have reasonable doubts about your identity.

You can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.

12. Data received from other people

When a company sends us a representative’s data for a job, we use only the data needed for professional communication. Send us other people’s data only if you have a legal basis and they have been informed.

13. Marketing communications

Correspondence about a request, an offer or a job is not marketing. We do not use data from the form or from assistant conversations for promotional messages and we do not carry out profiling. Any future newsletter would have its own legal basis and its own notice.

14. Changes

We may update this policy if our operations, providers or the law change; the date of the last update is shown at the top of the page.