Privacy policy

1. The data controller

The controller of personal data processed through this site is INDART SVIGO S.R.L., with its registered office at Str. Egretei nr. 33, Bl. 25, Ap. 53, Brașov, România, CUI (unique registration code) 40387713. Data protection contact: office@indart.ro. LINIA345 has not appointed a data protection officer (DPO); for any question about your data, use the contact details above.

2. What we process today

The LINIA345 website presents our kitchens and allows online orders and the use of a customer account. It uses no traffic analysis tools, advertising networks or other tracking technologies and sends no newsletters. We process personal data only in the situations described below.

• Language preference — a functional cookie (`linia345_locale`) remembers the language you chose. Details in the Cookie policy.
• Approximate country, derived from your IP address — when you open the site without indicating a language, your IP address is checked, at the moment of the request, against a database held on our own server in order to establish which country the request comes from. The result is used for one purpose only: to offer you a suitable language and, for visitors in Romania or the Republic of Moldova, to send you to linia345.ro. This is a country-level estimate, not precise location, and it can be wrong. Your IP address is not sent to any third party for this, and the resulting country is not stored, is not written to any log and is not linked to you — it is used only to answer that one request. An address you type yourself (for example /en) and the language you pick from the language selector always take priority. Basis: the legitimate interest of serving the site in an appropriate language.
• Technical server logs — the server hosting the site records, for each request, technical access data: the IP address, the date and time, the address of the page requested, the response code, the page you came from and your browser identification. We use them for the security and operation of the site (basis: legitimate interest, art. 6 (1) f) GDPR). The retention period is given in §8.
• Customer account — you sign in without a password, through a link sent to your e-mail address; the first link used creates the account. For the account we process your e-mail address and the data you fill in or that come from your orders (name, telephone, delivery and billing address); the account is linked to the orders placed with the same e-mail address. Each sign-in creates a session, for which we record the IP address and browser type, and your browser receives a strictly necessary session cookie. The session expires after 30 days, and using the account extends it; you can sign out at any time. Basis: providing the account you asked for (art. 6 (1) b) GDPR); for session data, the legitimate interest of protecting the account (art. 6 (1) f)).
• Orders — when you place an order we process your e-mail address, telephone, name, delivery address, billing details (for a company, including its name and tax code), the products ordered, the amounts, the installation option, the order status and the version of the terms accepted. Basis: performance of the contract (art. 6 (1) b)) and legal tax and accounting obligations (art. 6 (1) c)). The shopping cart is kept only in your browser (localStorage) until the order is placed. After it is placed, your browser receives, for 24 hours, a strictly necessary cookie that allows only that browser to display the order confirmation.
• Newsletter option — at checkout you may tick, optionally, that you want to receive LINIA345 news by e-mail. The box is not ticked by default, and your choice is recorded with the order. Basis: your consent (art. 6 (1) a)), which you may withdraw at any time. We do not currently send newsletters (see §7).
• Correspondence you send us — if you write to the contact address, we process the data contained in your message in order to reply (basis: legitimate interest, or steps taken at your request prior to entering into a contract).

3. Third-party services

In your browser: none. All of the site’s resources — images, video and fonts included — are served from our own domain. When you visit the site, your browser makes no requests to third parties (not to Google Fonts, not to image providers, not to advertising networks). On the server, the site relies on service providers for hosting and for sending operational e-mails and, once online consultation booking is activated, on Google Calendar and Google Meet. The recipients are listed in §9, and the Google integration is described in §6.

4. The configurator

The LINIA345 configurator saves your projects (configurations, favourites, autosave) locally in your browser only (localStorage). This data is not transmitted to LINIA345 and is not linked to your identity. You can delete it at any time from your browser settings. If the configurator later offers saving projects to an account or sending them for consultation, this policy will be updated before that is activated.

5. Consultation requests

This section applies once online consultation booking is activated. Until then, the form on the consultation page is a preview: it does not send, store or transmit any data.

• How it works — you choose a day and a time from the available slots, fill in the form and send the request. The request is recorded as “pending”, and the slot you chose is no longer offered to other visitors — they only see that the time is no longer available, not your data. The request is approved or rejected by a person on the LINIA345 team, not automatically. Only after approval are an event created in the LINIA345 calendar and, for an online consultation, a Google Meet meeting link (§6).
• What data we process — your name, e-mail address, telephone number, the day and time chosen, any additional information you choose to write in the notes field and, where applicable, technical data needed to send and protect the request (for example the time it was sent and, to prevent abuse, the IP address). Please do not include sensitive data in the notes, such as health data.
• For what purposes — to record and assess the request, check availability, contact you, approve or reject the request, schedule and hold the consultation and send you the operational communications relating to it.
• Basis — steps taken at your request prior to entering into a possible contract, including the consultation you request (art. 6 (1) b) GDPR). For technical security data and, where applicable, for the establishment, exercise or defence of legal claims: legitimate interest (art. 6 (1) f)). Booking a consultation does not require marketing consent and does not subscribe you to any newsletter.
• Which data are required — your name, e-mail address, telephone and the chosen slot are necessary to schedule the consultation; without them the request cannot be sent. The notes are optional.
• E-mails — we send you only operational messages about your request: its receipt and its approval or rejection, the booking details and the meeting link, and any cancellation. Communication with you about the consultation takes place from the address consultanta@linia345.ro. These messages are not marketing communications.

6. Google Calendar and Google Meet

This section, too, applies once online consultation booking is activated. To schedule consultations, LINIA345 uses a dedicated Google account belonging to LINIA345, with the Google Calendar and Google Meet services.

• The LINIA345 calendar, not yours — LINIA345 accesses only its own calendar. We do not ask you to sign in with your Google account, we do not ask you for any authorisation and we have no access to your calendar or to any other data in your Google account.
• Checking availability — our server consults the LINIA345 calendar to find the periods already taken, so that they are not shown on the site as available. The check concerns only the busy slots in our calendar and does not involve sending your data to Google.
• The calendar event — only after we approve the request do we create an event for the consultation in the LINIA345 calendar, which we use to manage the booking (for example to change or cancel it). The event may contain your name, the date and time, your contact details and, where useful to prepare the discussion, the information you sent us. If you are added as a guest to the event, Google may send you the invitation and calendar notifications at your e-mail address.
• Google Meet — confirmed online consultations may take place through Google Meet; a meeting link may be generated for the approved booking, which we send to you. When you take part in the meeting, Google processes the data needed for the call (for example technical connection data, the display name, and the sound and image transmitted), in accordance with its own terms and privacy policy.
• Authorisation of access — access to the calendar is authorised by LINIA345, through Google’s OAuth mechanism, only for LINIA345’s own Google account. The authorisation data are kept on our server and are not sent to your browser.
• Limited use of data obtained from Google — Google Calendar data obtained through Google’s application programming interface (API) are used only for scheduling consultations and checking availability. They are not used for advertising, are not sold and are not passed to third parties except to the extent necessary for this functionality or where the law requires it. Our access is limited to what consultation scheduling requires.
• Google as provider — the Google Calendar and Google Meet services are provided, for users in the European Economic Area, by Google Ireland Limited. Google processes data in accordance with its own terms and its own privacy policy: policies.google.com/privacy.

7. Future processing — announced, not yet active

The following features are planned but are not active. They will collect data only after this policy has been updated with the full details:

8. How long we keep data

• The language cookie expires after 12 months.
• Consultation requests and contact correspondence — 12 months from our last interaction with you, including the corresponding event in the LINIA345 calendar. After that period the data are deleted or anonymised, unless they must be kept longer to comply with a legal obligation or for the establishment, exercise or defence of legal claims. If a consultation is followed by an order, the order data are kept under the rules for orders.
• Customer account — until the account is deleted, which you may request at any time (§12). The sign-in link expires after 15 minutes, and the session after 30 days.
• Orders, invoices and tax documents — for the periods required by the applicable tax and accounting legislation, even if you delete your account.
• Technical server logs — access logs are deleted automatically after about 15 days. Error logs, which record only requests that ended in an error and may contain the IP address, are archived only on days when they contain entries and are deleted after 14 archivings.
• Database backups are made daily and deleted automatically after about 15 days, so that data deleted from the database disappears from the backups within the same period.
• Newsletter (once active) — until consent is withdrawn / you unsubscribe or, for inactive contacts, at most 24 months from the last relevant interaction. After you unsubscribe we keep only the minimum record needed to respect your choice (a suppression record).

9. Who we disclose data to

We do not sell your data. It may be disclosed only to the following recipients, each only to the extent necessary for the service it provides:

• ROMARG SRL — the hosting provider, based in Romania, of the server on which the site runs and on which the database and the technical logs are kept.
• Our e-mail service provider — for sending operational e-mails (the sign-in link, the order confirmation and, once activated, messages about consultations).
• Google — for Google Calendar and Google Meet, once online consultation booking is activated (§6).
• Providers involved in fulfilling orders — the companies that deliver and, where applicable, install the products ordered, invoicing and accounting service providers and, once online payments are active, the payment provider.
• Public authorities — where the law requires it.

10. Transfers outside the EEA

Data stored by the site — accounts, orders, logs and, once activated, consultation requests — are kept on the server hosted by ROMARG SRL. The Google services used for consultations may involve processing of data outside the European Economic Area (EEA) as well. Google states that it maintains servers around the world and that, for transfers of data from the EEA, it relies on adequacy decisions of the European Commission — including the EU-U.S. Data Privacy Framework, under which Google LLC is certified — and, where required, on standard contractual clauses (details: policies.google.com/privacy/frameworks). If another provider processes data outside the EEA, the transfer takes place only with the safeguards provided by Chapter V of the GDPR, for example an adequacy decision or standard contractual clauses. You may request information about these safeguards at the contact address in §1.

11. Data security

The site is served over encrypted connections (HTTPS). We do not use passwords: access to the account is through single-use sign-in links, valid for 15 minutes, which our database keeps only in cryptographic form (hash). Access credentials for the services used by the site — including, once online booking is activated, the authorisation (OAuth tokens) for LINIA345’s Google calendar — are kept only on the server and are not exposed to website visitors. We do not collect or store your card data.

12. Your rights

You have the right of access, rectification, erasure, restriction, the right to data portability, the right to object and the right not to be subject to a decision based solely on automated processing. These rights apply to all data described in this policy, including data in consultation requests. Where processing is based on consent (for example the newsletter option), you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. LINIA345 does not take automated decisions with legal effects concerning you; consultation requests are approved or rejected by a person. You exercise your rights at office@indart.ro; we reply within one month at the latest, in accordance with art. 12 GDPR.

If you are dissatisfied, you may address the National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro — or the courts.

13. Changes

We update this policy whenever the reality of our processing changes — always before a new processing activity is activated. The version and date in the header identify the current form.