Privacy policy

The controller

The controller is S.C. C&C Medis Vision S.R.L., registered in Romania under J40/8623/2005, VAT identification number RO17576980. TexHub is the name this catalogue trades under.

Enquiries concerning the processing of personal data are to be sent to hello@texhub.ro or made by telephone on 0722.295.776.

What data is collected, and at what point

Browsing the catalogue creates no obligation: there is no account to create, and traffic measurement does not start without express acceptance. The details are in the cookie policy.

Data is collected in five places: the quote request form, the catalogue search box, the selection sent along with the request, the quote and the discussion around it, and the copy of the messages sent. The first is described immediately below; the other four in the sections that follow.

Through the quote request form, the following is collected:

• the requester’s name and, optionally, the company name — so that it is known to whom the reply is addressed;
• the email address — to which the quote is sent;
• the telephone number, optional — for rapid clarifications;
• the date by which the goods are required, optional;
• a link to artwork files, where one is supplied;
• the products selected from the catalogue and the work requested on them — quantities, colours, sizes, customisation — together with anything entered in the free-text field.

On the public-institutions route, the institution's name and fiscal code are also collected; both are required in order to publish the product in the SICAP electronic catalogue.

The free-text field is not to be used for data that has not been asked for and, still less, for special-category data (health, beliefs, trade union membership). Such data is not required for a quote and is not processed.

Catalogue searches

Searches made in the catalogue are recorded, for a single purpose: to find out which products visitors look for and do not find. What is not found is visible from nowhere else, and this list is what shows what the catalogue is missing.

What is retained:

• the text searched for, in full and unaltered, exactly as it was typed — neither shortened nor filtered;
• the time of the search and the number of results returned;
• the result clicked, where one is clicked, and the position it held in the list;
• the language of the page;
• the network the search came from, derived from the IP address;
• an identifier of the visit, by which searches made in the same working session are linked to one another.

Of the IP address, only the network is kept, not the last part, the one that would identify a particular subscriber: in an IPv4 address the last of the four numbers becomes zero, and in an IPv6 one the first 48 bits are kept. That much is needed in order to tell an automated program sweeping the catalogue from a visitor; nothing beyond it is retained. The truncation happens before writing, so the full address never reaches the log.

The visit identifier is generated when the page loads and remains solely in the browser's memory, in a variable belonging to the open page. It is NOT written to the device: not in a cookie, not in local storage, not in session storage. It disappears when the page is closed or reloaded, and a later visit receives a different one, unconnected to the first. Precisely for this reason the recording involves no storage of information on the visitor's equipment, no cookie is placed for it, and no consent is sought — see the cookie policy.

The text is kept whole, and the consequence is stated here plainly: if an email address, a telephone number or other personal text is pasted into the search box by mistake, it reaches the log as it stands. Such data is not asked for and is not required in order to search. Its erasure may be requested at any time, under the “Rights of the data subject” section, and the request is carried out against every record containing the text indicated.

The pages visited, their order and the duration of the visit are not retained. Searches are not linked to quote requests, are not passed to third parties, do not serve to build a profile, and do not determine what is displayed to any visitor.

The selection sent along with the request

Where the request carries a list of products, the list is saved on the controller's server under a five-character code, and a link to it is included in the confirmation email. What is saved is the name given to the list, the products, the colours, the sizes and the quantities — not the contact details. The code opens the list to whoever holds it: it is made so that it can be dictated to a colleague. The list is deleted automatically 60 days after publication, and may be revoked earlier, from the “My cart” page, on the device it was sent from.

The quote and the discussion around it

Where a request is answered with a quote, the company name, the name of the contact person, the email address and the telephone number are retained, together with the versions of the quote, the messages written about it by either party, and the moment of acceptance. The number of times the quote document has been opened is also retained, so that it is known whether it arrived — the pages leafed through are not retained, and nothing outside that document is tracked. Basis: Article 6(1)(b) GDPR, the same pre-contractual steps as for the request the quote arose from.

The copy of the messages sent

Every email leaving the site — the internal notification, the confirmation to the requester, the quote — is kept in full in an internal archive, so that what was sent, and when, can be proved. The archive is not reachable from outside the server. Basis: Article 6(1)(f) GDPR — the controller's legitimate interest in being able to reconstruct commercial correspondence.

Purposes of processing and legal basis

Preparing and sending the quote

Basis: Article 6(1)(b) GDPR — steps taken at the request of the data subject prior to entering into a contract. Without this data the request cannot be answered.

Contact for clarifications

Basis: consent, Article 6(1)(a) GDPR — the box ticked when the form is submitted. Consent may be withdrawn at any time, without effect on processing carried out before the withdrawal.

Finding out which products are searched for and not found

Basis: Article 6(1)(f) GDPR — the controller’s legitimate interest in knowing what visitors look for in the catalogue and fail to find, in order to complete the range and the correspondence between codes and products. The processing is NOT based on consent and does not depend on it: the box ticked when the form is submitted concerns other data and another purpose. Objection to this processing may be made at any time, under the section below.

Preventing abusive automated submissions

Basis: Article 6(1)(f) GDPR — the controller’s legitimate interest in keeping the form operational and in preventing automated extraction of the catalogue. For this purpose an identifier derived from the IP address is retained briefly, strictly in order to count the requests received from one source within a given interval — on submission of the form, on a product-code lookup, and on the recording of searches. The pages visited are not retained.

Measuring use of the catalogue

Basis: consent, Article 6(1)(a) GDPR — the box shown on the first visit. Absent acceptance, nothing is loaded. Withdrawal is made from the cookie policy, as readily as consent was given.

No automated decisions producing effects on the data subject are taken, and no profiling is carried out.

Retention period

Quote requests are retained for the duration of the commercial discussion and for a further year from the last interaction relating to them. Erasure may be requested at any time, under the “Rights of the data subject” section; absent such a request, records older than a year are deleted at the periodic review of the archive. Where a request results in an order, the corresponding documents are retained separately, for the periods required by tax and accounting law.

Catalogue searches, together with the network kept from the IP address and the result clicked, are retained for 12 months from the time of recording, then deleted automatically. The period is the same as that of the form data, so that there are not two different durations for data gathered from the same site; 12 months because the question the log answers — what is searched for and not found — is seasonal, and below a full year two comparable months cannot be set against each other.

Selections published under a code are deleted automatically 60 days after publication. Copies of the messages sent follow the retention period of the request they belong to.

The anti-spam counters do not retain the IP address, only a fingerprint of it, together with a number. They are deleted automatically within 24 hours at most of the last request counted.

Recipients of the data

The data is neither sold nor rented. It is accessible to:

• those within the controller’s organisation involved in preparing the quote;
• the hosting and email provider, Zooku Solutions SRL, on whose servers in Romania the site, the mailbox and the database reside; it acts as a processor.
• Google, ONLY where traffic measurement has been accepted, and solely the browsing data — never the contents of the form. Analytics data also reaches servers outside the European Union, including in the United States; the transfer relies on the European Commission's standard contractual clauses and on the EU–US Data Privacy Framework.

The data from quote requests does NOT leave the European Economic Area: it remains on the server in Romania and in the controller’s mailbox. The only data that leaves is traffic analytics, and only where consent has been given. Any change to this is reflected on this page before it takes effect, not afterwards.

Rights of the data subject

The data subject has, as against the controller, every right conferred by the GDPR:

• the right of access to the data processed and to receive a copy of it;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure;
• the right to restriction of processing;
• the right to portability, in a format transferable to another controller;
• the right to object to processing based on the controller’s legitimate interest;
• the right to withdraw consent, at any time.

Requests are to be sent to hello@texhub.ro and are answered within one month at the latest. Where the request is complex, that period may be extended by up to two further months; the extension and the reason for it are communicated within the first month. Exercising these rights is free of charge.

Where the answer is unsatisfactory, a complaint may be lodged with the Romanian National Supervisory Authority for Personal Data Processing (dataprotection.ro), or the matter may be brought before the courts.

Security

The site is served over HTTPS only. The form checks the origin of the request, limits how many submissions come from one source, and sends nothing onward absent the consent tick. The database holding archived requests and searches is not reachable from outside the server, and the search log can be read only from the internal panel, after authentication.

No measure is perfect. Should a breach occur that puts the rights of the data subject at risk, the data subject and the supervisory authority are notified within the deadlines set by law.

Changes

Any change to this document is accompanied by an update to the date above. Material changes — a new purpose, a new recipient — are signalled visibly on the site.