Privacy Policy

1. Introduction

Allengra SRL ("Allengra", "we", "us") develops and manufactures ultrasonic flow sensors and control valves. This Privacy Policy explains how we collect, use, and protect personal data when you visit our website at allengra.eu (the "Website"), contact us, request a quote, or apply for a job with us.

We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable Romanian data protection law.

2. Data Controller

The controller responsible for the processing of your personal data is:

Allengra SRL
Str. Nojoridului 90, 410542 Oradea, Romania
Trade Registry No.: J2012000173055 · Fiscal code (CUI): 29693860 · EUID: ROONRC.J2012000173055
Email: info@allengra.eu

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. For any questions about this Privacy Policy or our handling of your personal data, please contact us at the email address above.

3. What Personal Data We Collect and Why

3.1 Visiting the Website

When you visit the Website, our hosting infrastructure automatically processes technical data that your browser transmits, including:

• IP address
• Date and time of the request, pages visited
• Browser type and version, operating system, device type
• Referrer URL
• Approximate location (country level, derived from your IP address)

Purpose: delivering the Website, ensuring its security and stability, and defending against attacks and abuse.
Legal basis: our legitimate interest in operating a secure and functional website (Article 6(1)(f) GDPR).
Retention: server log data is retained for a short period for security purposes and then deleted or anonymised.

3.2 Contact and Quote Requests

When you use our contact form or request a quote for a product, we collect:

• Name, company name, email address, phone number
• Your message, the product you are interested in, and (optionally) the requested quantity
• Technical data submitted with the form: IP address, country, and the page from which you submitted the request

Purpose: responding to your enquiry, preparing quotes, and managing our business relationship with you or the company you represent.
Legal basis: where you contact us on your own behalf, taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR); where you contact us as a representative or employee of a company, our legitimate interest in responding to and managing business enquiries (Article 6(1)(f) GDPR). Providing this data is voluntary; however, without the required fields we cannot process your enquiry.
Recipients: enquiries are stored and managed by a cloud-based customer relationship management (CRM) provider (see Section 5).
Retention: we retain enquiry data for as long as needed to handle your request and, where a business relationship follows, for the duration of that relationship plus applicable statutory retention periods.

We only send you marketing communications (such as newsletters or product updates) if you have given us your consent (Article 6(1)(a) GDPR) or where otherwise permitted by law. You can withdraw your consent or object to marketing at any time by contacting info@allengra.eu or using the unsubscribe link in any marketing email.

3.3 Job Applications

When you apply for a position through our careers pages, we collect:

• Name, email address, phone number
• Your CV, application message, LinkedIn profile URL (if provided), and the position applied for
• Technical data submitted with the application: IP address and country

Purpose: assessing your application and conducting the recruitment process.
Legal basis: taking steps at your request prior to entering into an (employment) contract (Article 6(1)(b) GDPR) and, in Romania, applicable national employment law. Providing your data is voluntary, but we cannot consider your application without it.
Recipients: applications are stored on our own content management system hosted on Allengra-controlled infrastructure. They are accessible only to personnel involved in recruitment.
Retention: if your application is unsuccessful, we delete your application data within a reasonable period after the conclusion of the recruitment process, unless you give us consent to keep your application on file for future openings.

3.4 Spam and Abuse Protection (Google reCAPTCHA Enterprise)

To protect our forms against spam and automated abuse, we use Google reCAPTCHA Enterprise, provided by Google. When you submit a form, reCAPTCHA analyses signals such as your IP address, browser and device information, and interaction behaviour to assess whether the submission is made by a human.

Legal basis: our legitimate interest in protecting the Website and our business processes from spam, abuse, and automated attacks (Article 6(1)(f) GDPR).

We use reCAPTCHA solely in connection with our forms, for security and fraud-prevention purposes — not for advertising. Because it is strictly necessary to provide the form functionality you request securely, it operates independently of your cookie consent choices, as described in our Cookie Policy. Further information about Google's processing is available in Google's Privacy Policy.

3.5 Cookies, Analytics, and Advertising

We use cookies and similar technologies on the Website. Non-essential cookies — including Google Analytics 4 (audience measurement) and Google Ads (advertising and campaign measurement) — are only set with your consent (Article 6(1)(a) GDPR), which you can give, refuse, or withdraw at any time via our cookie consent banner, provided by CookieYes. Strictly necessary cookies are used on the basis of our legitimate interest in operating the Website (Article 6(1)(f) GDPR).

We have configured Google Consent Mode so that Google tags remain inactive until you grant consent.

Full details of the cookies we use, their providers, purposes, and storage durations, as well as instructions for changing your consent choices, are set out in our Cookie Policy. You can also reopen the consent banner at any time via cookie settings.

3.6 Embedded Content (e.g. YouTube Videos)

Some pages embed content from third-party providers, such as YouTube videos on our product pages. When such content is loaded, the third-party provider receives technical data (including your IP address) and may set cookies, subject to your consent choices in the cookie banner. See our Cookie Policy for details.

3.7 Social Media Links

The Website contains links to our profiles on LinkedIn, YouTube, Facebook, and Instagram. These are plain links: no data is transmitted to these providers by simply visiting our Website. If you follow a link, the respective provider's privacy policy applies.

4. Legal Bases — Overview

We process personal data only where at least one of the following applies:

• Consent (Article 6(1)(a) GDPR) — e.g. analytics and advertising cookies, marketing communications
• Contract or pre-contractual steps (Article 6(1)(b) GDPR) — e.g. enquiries, quotes, job applications
• Legal obligation (Article 6(1)(c) GDPR) — e.g. statutory retention of business correspondence and accounting records
• Legitimate interests (Article 6(1)(f) GDPR) — e.g. website security, spam protection, managing business relationships

Where we rely on legitimate interests, you have the right to object (see Section 8).

5. Recipients of Personal Data

We share personal data only with service providers ("processors") that support the operation of the Website and our business, under data processing agreements pursuant to Article 28 GDPR:

Provider	Service	Location of provider
Vercel Inc.	Website hosting and content delivery	USA (EU data processing available)
Cloud-based CRM provider	Storage and management of contact and quote enquiries	Ireland / USA
Google Ireland Ltd. / Google LLC	reCAPTCHA Enterprise, Google Analytics 4, Google Ads, Google Tag Manager, YouTube	Ireland / USA
CookieYes Ltd.	Cookie consent management	UK

We may also disclose personal data where required by law, to competent authorities, or to establish, exercise, or defend legal claims.

We do not sell personal data.

6. International Data Transfers

Some of our service providers are located in, or may transfer data to, countries outside the European Economic Area (EEA), in particular the United States and the United Kingdom.

• For the United Kingdom, an adequacy decision of the European Commission applies.
• For the United States, we rely on the EU–U.S. Data Privacy Framework where the relevant provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR), supplemented where necessary by additional safeguards.

Where our service providers engage sub-processors in other third countries, such transfers are safeguarded through Standard Contractual Clauses incorporated in the providers' data processing agreements.

You may request a copy of the relevant safeguards by contacting us at info@allengra.eu.

7. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Policy, and thereafter as required by statutory retention obligations. For example, under Romanian accounting law (Law no. 82/1991, as amended), accounting records and supporting documents must generally be kept for 5 years, and annual financial statements for 10 years. When retention periods expire, data is deleted or anonymised, unless continued retention is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access (Article 15) — obtain confirmation of whether we process your data and a copy of it
• Rectification (Article 16) — have inaccurate data corrected
• Erasure (Article 17) — have your data deleted where the conditions apply
• Restriction of processing (Article 18)
• Data portability (Article 20) — receive your data in a structured, commonly used, machine-readable format
• Objection (Article 21) — object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent (Article 7(3)) — at any time, without affecting the lawfulness of processing carried out before withdrawal. For cookies, you can change your choices at any time via the cookie settings on our Website.

To exercise any of these rights, contact us at info@allengra.eu. We will respond within one month, as required by Article 12 GDPR. We may ask you to verify your identity before acting on a request.

Right to lodge a complaint: if you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular the Romanian supervisory authority.

You may also contact the supervisory authority of the EU member state where you live or work.

9. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, and disclosure, including encrypted transmission (TLS/HTTPS), access controls, and spam and abuse protection on our forms. We regularly review our technical and organisational measures and update them where appropriate.

10. Automated Decision-Making

We do not use your personal data for automated decision-making that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Automated spam detection (reCAPTCHA) is used solely to protect our forms from abuse.

11. Children

The Website is aimed at business customers and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example when we introduce new services or when legal requirements change. The current version is always available on this page, with the "Last updated" date shown at the top. For significant changes, we will provide a more prominent notice on the Website.

13. Contact

Allengra SRL
Str. Nojoridului 90, 410542 Oradea, Romania
Email: info@allengra.eu

Thank you for trusting Allengra.