Privacy policy

1. Who we are and how to reach us

This website is operated by ANDREAS DISTRIBUTION S.R.L., a company registered in Romania, Trade Register number J52/1058/2025, CUI/CIF 52947512, VAT number RO52947512, share capital 200 RON, with its registered office at Str. 1 Decembrie 1918, Bl. C3, Sc. A, Ap. 40, Giurgiu, Romania.

We are the controller of the personal data described below, which means we decide why and how it is used.

For any question about your personal data, or to use any of the rights listed in section 8, write to andreas@andreasdistribution.com. You can also call +40 728 310 549 or +40 771 253 783. We have not appointed a data protection officer, because the scale of our processing does not require one.

2. What data we collect

We only collect what you send us yourself through the contact form on this website:

• your name
• the name of your company
• your city
• your phone number
• your email address
• the message you write
• which page you were on and which button you used, so that we understand the context of your enquiry
• whether you ticked the box agreeing to receive commercial information from us
• your IP address, kept for fifteen minutes only, so that nobody can use the form to send us hundreds of messages at once

Name, phone number and email are required, the rest is optional. We do not ask for and do not want any special categories of data, such as health data. Please do not include them in your message.

We do not use analytics or advertising tools, we do not build profiles and we do not take automated decisions about you. Cookies are described separately in our Cookie Policy.

3. Why we use it and on what legal basis

Purpose	Legal basis
Answering your enquiry and discussing possible cooperation, including sending prices, minimum order and delivery terms	Our legitimate interest, Article 6(1)(f) GDPR: you contacted us on your own initiative with a business enquiry and expect an answer
Preparing and performing a supply contract with your company	Steps taken at your request before entering into a contract and performance of the contract, Article 6(1)(b) GDPR
Sending commercial information about our brands, new products and offers	Your consent, Article 6(1)(a) GDPR, given by ticking the separate box in the form. The box is never ticked in advance
Keeping accounting records of concluded transactions	Legal obligation under Romanian accounting and tax law, Article 6(1)(c) GDPR
Protecting the contact form against automated abuse and mass sending	Our legitimate interest, Article 6(1)(f) GDPR: keeping the form usable and our mailbox reachable

Providing your data is voluntary, but without a name, a phone number and an email address we cannot answer you.

4. How long we keep it

• Enquiries that do not lead to cooperation: up to 12 months from the last contact, then deleted.
• Correspondence with active partners: for as long as the business relationship lasts.
• Accounting documents: for the periods required by Romanian law, normally 10 years.
• Marketing consent and the mailing list: until you withdraw your consent, and for a short period afterwards as proof that the consent existed.
• IP addresses used for abuse protection: fifteen minutes, then automatically removed.

5. Who else sees it

Your message is delivered to our own mailbox. We do not sell your data and we do not share it for marketing. Access to it inside the company is limited to the people who handle enquiries.

The only third parties involved are the service providers we rely on:

Provider	Role	Where
ROMARG SRL	Hosting of this website and the server that sends the form messages	Romania, European Union
Google Cloud EMEA Limited, Google Workspace	Our email service, where enquiries arrive and are stored	Ireland, with servers also outside the European Economic Area
Squarespace Domains II LLC	Registrar of our second domain name, holds only company contact details, not your data	United States

Each of them processes data on our behalf under a contract that obliges them to protect it. We may also disclose data to public authorities when the law requires it.

6. Transfers outside the European Economic Area

Because our email runs on Google Workspace, your message may be stored and processed on servers outside the European Economic Area, including in the United States. Such transfers are covered by the EU-U.S. Data Privacy Framework and by the standard contractual clauses approved by the European Commission, together with additional technical measures applied by the provider.

You can ask us for a copy of the safeguards that apply by writing to the address in section 1.

7. How we protect it

The website works over an encrypted connection. Messages are transmitted to our mailbox over an authenticated channel. The part of the website used to manage the catalogue is protected by a password and is not accessible to visitors.

8. Your rights

Under the GDPR you have the right to:

• Access: to be told whether we hold data about you and to receive a copy of it.
• Rectification: to have inaccurate data corrected and incomplete data completed.
• Erasure: to have your data deleted where there is no longer a reason to keep it.
• Restriction: to ask us to pause the use of your data while a question about it is being resolved.
• Objection: to object at any time to processing based on our legitimate interest, including any form of direct marketing.
• Portability: to receive the data you gave us in a common machine readable format, or to have it sent to another controller.
• Withdrawal of consent: where processing is based on your consent, in particular for commercial information, you can withdraw it at any time. Withdrawal does not affect what was done lawfully before it.

To use any of these rights, write to andreas@andreasdistribution.com. We answer within one month. If your request is complex, we may extend that period and we will tell you why. Using these rights is free of charge.

To stop receiving commercial information, it is enough to reply to any such message with a request to unsubscribe, or to write to the address above.

9. Complaints

If you believe we handle your data incorrectly, we would like to hear from you first, so that we can put it right. You also have the right to complain to the Romanian supervisory authority:

Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania, anspdcp@dataprotection.ro, dataprotection.ro.

10. Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. We recommend checking it before sending us a new enquiry.