Privacy Policy

Last updated: septembrie 2026

Protecting your data matters to us. This policy explains what personal data we process, for what purpose, on what legal basis, and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018 and applicable national law.

Who is the data controller

Compania SRL, registered office at Str. Exemplu nr. 1, Sectorul 1, București, tax ID 00000000, registered with the Trade Registry under no. J00/000/2020, a company providing private services to its clients and partners.

You can contact us on any data-protection matter at contact@exemplu.ro or by phone on 000.000.000. We are not legally required to appoint a Data Protection Officer (DPO); requests regarding your data are handled directly by the company’s management.

What data we process

Identification and contact data: name, surname, email address, phone number — when you contact us via the form, by phone, on WhatsApp, or through the virtual assistant (chatbot).
Data for booking a car: rental period, pickup location, chosen car, country you are travelling from, and date of birth (required to verify the legal minimum driving age) — entered in the booking form.
Data required to provide the requested services: identification data and any documents you send us to carry out the service (for example name, contact details and, where applicable, data required for drawing up related documentation or issuing an invoice), strictly to the extent necessary to perform the contract and meet legal obligations.
Billing data: data required to issue tax documents.
Content of conversations with the AI assistant (chatbot): the messages you send in the chat window, if this feature is active — see the “Virtual assistant (AI chatbot)” section below.
Technical and usage data: IP address, device and browser type, pages visited, referral source — collected through cookies and similar technologies, only with your consent (see the Cookie Policy).

Purposes of processing

Responding to requests sent through the form, by phone, email or chatbot, and sending quotes;
Providing the requested services: preparing documentation and fulfilling the obligations we take on towards you;
Sending documentation to the partners or collaborators involved in providing the service, where necessary;
Meeting legal obligations (accounting, archiving and other obligations set out by law);
Measuring and improving the website (traffic statistics) and, where applicable, marketing and remarketing — only based on your consent;
Administrative communications related to your services.

Legal basis

We process your data on the basis of: performance of the service contract or pre-contractual steps taken at your request (Art. 6(1)(b) GDPR); our legal obligations (point (c)); your consent for statistics and marketing cookies, third-party content and optional communications (point (a)); and our legitimate interest in managing and protecting our business (point (f)). Identification data is processed exclusively to provide the requested services and to meet the related legal obligations.

Data about other people that you provide to us

For some services you give us personal data about people other than yourself — for example collaborators, representatives or contact persons. By submitting such data, you confirm that you have the necessary basis to provide it to us and that you have informed, or will inform, those people about the processing of their data by Compania for the purpose of providing the service, under the terms of this policy. You may share this privacy policy with them, as it explains the applicable purposes, legal bases and rights. Compania processes this data exclusively to carry out the requested service and discloses it, where applicable, to the partners involved and, where the law requires it, to the competent institutions.

Statistics, marketing and cookies

With your consent given through the cookie banner, we use third-party tools to understand how the website is used and, where applicable, for marketing campaigns:

Google Analytics 4 and Google Tag Manager (Google Ireland Ltd.) — aggregated traffic statistics, to improve the website. Activated only if you accept the “Statistics” category.
Google Ads (Google Ireland Ltd.) and Meta Pixel (Meta Platforms Ireland Ltd.) — measuring ad performance and, where applicable, remarketing. Activated only if you accept the “Marketing” category.

We apply Google Consent Mode v2: before you give consent, these tools do not set cookies or send identification data. We do not make any automated decisions with legal effects on you; any audience segments used for ads do not produce such effects. You can withdraw your consent at any time from “Cookie settings” (page footer). Details: Google Privacy Policy, Meta Privacy Policy.

Virtual assistant (AI chatbot)

If a virtual assistant (AI-based chatbot) is active on the website, it helps you with general information about our services and can take down a contact request. Please note:

The conversation may be processed through a third-party AI technology provider, acting as a data processor under a data processing agreement; messages may be stored temporarily to provide and improve the service.
Responses are for general information purposes only, may contain inaccuracies, and do not constitute individualised professional advice. A Compania consultant will confirm the details relevant to your specific situation.
Please do not enter sensitive data or data that is not necessary into the chat (for example a national ID number or details from identity documents). For such data, please use the service’s secure channels.
You can request at any time to be put through to a human contact.

Who we may disclose data to

We do not sell or rent out your data. It may be accessed, strictly for the purposes above, by: the partners and collaborators involved in providing the service, under confidentiality obligations; the competent public authorities, where providing the service or the law requires it; suppliers who support our activity (accounting, web and email hosting, our statistics/marketing provider and, where applicable, the AI assistant provider). These act as processors or independent controllers, subject to confidentiality obligations. Data may be disclosed to authorities only where the law requires it.

How long we keep your data

Data is kept only for as long as necessary for the purpose it was collected for, or for as long as our legal obligations require (accounting and archiving deadlines, and other obligations set out by law). Statistics/marketing data is kept for the lifetime of the related cookies (see the Cookie Policy). Afterwards, the data is deleted or anonymised.

Transfers outside the EEA

Some providers (for example Google, Meta, or the AI assistant provider) may process data, including your IP address, on servers located outside the European Economic Area. These transfers rely on appropriate safeguards under Articles 44–49 GDPR (the EU–US Data Privacy Framework adequacy decision, or standard contractual clauses, as applicable).

Your rights

Under GDPR, you have the right to: access your data, rectification, erasure (“the right to be forgotten”), restriction of processing, data portability, objection, and not to be subject to an automated decision with legal effects. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. The right to erasure may be limited by legal obligations to retain documents.

To exercise these rights, write to us at contact@exemplu.ro. You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — www.dataprotection.ro.

Processing of the Romanian national ID number (CNP)

Where providing our services or a legal obligation requires processing the Romanian national ID number (CNP), we apply the safeguards set out in Law no. 190/2018 (Art. 4): we process the CNP exclusively for the purpose it was collected for, based on the data-minimisation principle, with restricted access limited to relevant staff and with specific technical and organisational security measures.

Minors

Our services and website are intended for people with full legal capacity and are not aimed at minors. We do not knowingly collect data from minors under 16; if you notify us of such a situation, we will delete the data.

Data security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure: a secure connection (HTTPS), restricted access to documents, and protected storage.

Changes to this policy

We may update this policy to reflect changes in the law or in our services. The version in force is the one published on this page, with the last-updated date shown at the top.