Privacy Policy

A. Who We Are (Data Controller)

B. Scope of This Policy

This Privacy Policy applies to:

• Our website redlinetuning.ro and all its pages
• Lead qualification forms, booking systems, and contact forms
• Communications via WhatsApp, email, and phone calls
• Any other digital touchpoint where we collect personal data

C. Categories of Personal Data We Collect

• Identification & Contact Data: full name, phone number, email address, city/location
• Vehicle Information: make, model, year, colour, vehicle class, uploaded photos
• Service & Project Data: desired services (PPF, wrapping, detailing), coverage preferences, budget range, timeframe, project notes
• Communication Records: WhatsApp messages, email correspondence, call records (when applicable)
• Technical & Usage Data: IP address, device type, browser type, pages visited, referring URLs, session duration, clicks, scrolls
• Cookies & Online Identifiers: analytics cookies (Google Analytics GA4), advertising cookies (Google Ads, Meta Pixel), functional cookies
• Marketing & Campaign Data: UTM parameters, campaign source/medium, conversion events, consent preferences, newsletter subscriptions

D. Sources of Data

• Directly from you: when you fill out forms, contact us, or upload information
• Automatically collected: via cookies, analytics tags, and tracking pixels when you use our website

E. Purposes & Legal Bases (GDPR Article 6)

Contract Performance (Art. 6(1)(b))

To handle inquiries, provide quotes, process bookings, deliver services, and manage warranties. No consent required, necessary for pre-contractual and contractual obligations.

Legal Obligation (Art. 6(1)(c))

To comply with invoicing, tax, accounting, and record-keeping obligations under Romanian law. Retention periods defined by law (typically 5-10 years for financial records).

Legitimate Interest (Art. 6(1)(f))

To ensure site security, prevent fraud, improve service quality, and send limited direct marketing to existing customers. You have the right to object at any time.

Consent (Art. 6(1)(a))

For non-essential cookies, analytics/advertising (GA4, Google Ads remarketing, Meta Pixel), and marketing communications. You can withdraw consent at any time: via "Cookie Settings" in the footer, by unsubscribing from marketing emails, or by contacting us directly. Withdrawal does not affect the lawfulness of processing before withdrawal.

F. Advertising, Analytics & Profiling

We use Google Consent Mode v2 via Google Tag Manager (GTM) to manage tags for analytics and advertising. When you refuse consent, tags operate in a privacy-preserving mode, non-essential cookies are not set, and only anonymized/aggregated signals are sent.

Tools we use (with your consent):

• Google Analytics 4 (GA4): tracks page views, user interactions, conversion funnels. Processed by Google Ireland Ltd.
• Google Ads (Remarketing & Conversion Tracking): shows personalized ads to visitors who didn't convert.
• Meta Pixel (Facebook/Instagram): tracks events (PageView, Lead) for remarketing. Processed by Meta Platforms Ireland Ltd.

Profiling & Interest-Based Ads: advertising profiles/segments (e.g., "interested in luxury car protection") may be inferred only if you consent to marketing cookies. You can opt out anytime via "Cookie Settings" in the footer.

G. Data Processors & Recipients

We share data with trusted processors under Data Processing Agreements (DPAs) and GDPR-compliant safeguards:

• Hosting & Platform (including sub-processors for cloud infrastructure)
• Analytics & Ads: Google Ireland Ltd. (GA4, Google Ads), Meta Platforms Ireland Ltd. (Meta Pixel)
• Email & CRM: Google Workspace / Brevo (or similar)
• Messaging: WhatsApp Business (Meta Platforms Ireland)
• Payment Providers: Stripe, PayPal, or local banks (if applicable)

All processors are contractually bound to protect your data and use it only for specified purposes.

H. International Data Transfers

Some processors (e.g., Google, Meta) may transfer data outside the European Economic Area (EEA). We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, along with supplementary measures, to ensure adequate protection.

I. Data Retention

• Inquiry/Lead Data: up to 12-24 months, or until you withdraw consent/object
• Contract Data: per legal retention requirements (5-10 years for tax/accounting records)
• Marketing Data: until consent is withdrawn, or after 24 months of inactivity
• Analytics/Cookies: session-based or up to 26 months (GA4 default), configurable

After retention periods expire, data is securely deleted or anonymized.

J. Cookies & Cookie Management

Types of cookies:

• Strictly Necessary: essential for site operation (always active)
• Functional: remember preferences (language, region)
• Analytics: measure site performance (GA4), requires consent in EEA
• Marketing/Advertising: remarketing & personalized ads (Google Ads, Meta Pixel), requires consent

When you first visit our site, you'll see a cookie banner with options to Accept All, Reject All (only necessary cookies), or Customize. Non-essential scripts (GA4, Google Ads, Meta Pixel) are blocked until you grant consent.

Change your mind? Click "Cookie Settings" in the footer anytime to update preferences. You can also control cookies via your browser settings, note that disabling necessary cookies may impair site functionality.

K. Your GDPR Rights

Under GDPR and Romanian Law 190/2018, you have the following rights:

• Right to Access, request a copy of your personal data
• Right to Rectification, correct inaccurate or incomplete data
• Right to Erasure, request deletion ("right to be forgotten")
• Right to Restriction, limit how we process your data
• Right to Portability, receive data in a structured format
• Right to Object, object to processing based on legitimate interests

L. Children's Data

Our services are not directed to individuals under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us immediately.

M. Data Security

We implement robust technical and organizational measures:

• Encrypted data transmission (SSL/TLS)
• 24/7 CCTV monitoring and controlled-access facility
• Role-based access controls and authentication
• Regular security audits and updates
• Insurance coverage for data incidents

N. Social Media & External Links

Our website may contain links to third-party sites (e.g., Instagram, Facebook). We are not responsible for their privacy practices. Please review their policies before sharing data.

O. Policy Updates

We may update this Privacy Policy to reflect changes in our practices or legal requirements. The "Last updated" date indicates the most recent revision.

P. Contact Us