Privacy Policy
Data controller
The website www.klarwin.com belongs to PROCESS ENGINEERING S.R.L. ("Klarwin", "we"), headquartered at Str. Eufrosin Poteca nr. 26, sector 2, Bucharest, registered with the Trade Registry under no. J40/3719/2004, tax code RO16217333. We act as the controller of the personal data processed through this website, in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Romanian law. For any data-protection question or to exercise your rights, contact us at gdpr@klarwin.com.
What data we collect & where it comes from
We process: (a) data you give us through our forms — name, business email, phone, company, job role, industry and the content of your message; a CV and its contents if you apply for a job; and, optionally, your answer to "How did you hear about us?"; (b) data collected automatically when you use the site, only where you consent to the relevant cookies — usage and device data, and attribution data such as the campaign/source that first brought you to the site and, where present, a Google Ads click identifier (gclid). We collect this directly from you and automatically via cookies and similar technologies (see the Cookie Policy).
Purposes & legal bases
| Purpose | Legal basis |
|---|---|
| Receive, respond to and manage your inquiry; keep business-contact records and manage our sales/lead pipeline (CRM) | Legitimate interest — Art. 6(1)(f) |
| Provide the products/services requested and manage our contractual relationship with clients and business partners | Performance of a contract / steps prior to a contract — Art. 6(1)(b); and legal obligations (e.g. accounting) — Art. 6(1)(c) |
| Send newsletters and marketing communications | Your consent — Art. 6(1)(a) (and Law 506/2004) |
| Measure site usage and attribution (analytics, first-touch source, gclid) | Your consent — Art. 6(1)(a) |
| Advertising, retargeting and ad-conversion measurement, including sharing a hashed email with advertising partners | Your consent — Art. 6(1)(a) |
| Protect the site against bots and abuse (Cloudflare Turnstile) | Legitimate interest (security) — Art. 6(1)(f) |
| Recruitment (if you send a CV) | Steps prior to a contract / your consent — Art. 6(1)(b)/(a) |
Legitimate interest & your right to object
Where we rely on legitimate interest (managing your inquiry and our sales pipeline), we have carried out a balancing assessment weighing our interest against your rights and reasonable expectations as a business professional who contacted us; a summary is available on request. You have the right to object at any time to this processing (gdpr@klarwin.com), and we will stop unless we have compelling legitimate grounds.
Marketing communications
We send marketing emails only if you separately opt in and confirm your subscription (double opt-in). You can withdraw your consent at any time via the unsubscribe link in every email or at gdpr@klarwin.com. Submitting an inquiry does not subscribe you to marketing.
Advertising, pixels & hashed email
If you consent to marketing cookies, we use advertising tools from Meta, Google and LinkedIn to measure the performance of our ads and to show relevant ads to people who have visited our site (retargeting). For conversion measurement, our server may share a hashed (pseudonymised, SHA-256) version of your email address — never your plain email — with these partners through their server-side interfaces (e.g. the Meta Conversions API). A hashed email is still personal data under the GDPR. We do this only with your consent, which you can withdraw at any time via the cookie settings.
Analytics & session recording
With your consent, we use Google Analytics 4 and Microsoft Clarity (loaded via Google Tag Manager) to understand how visitors use the site. Clarity records anonymised sessions with form inputs masked (we do not see what you type into fields). These tools run only under analytics consent (Google Consent Mode v2); GA4 event data is retained for 14 months.
Automated decisions & profiling
We may prioritise inquiries based on light, non-intrusive signals to help our team respond appropriately. We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.
Recipients & processors
We share personal data only with the processors below, under data-processing agreements, and with authorities where legally required:
| Processor | Role | Location |
|---|---|---|
| Brevo (Sendinblue) | CRM + email marketing | EU |
| Supabase | Database + media storage | EU |
| Resend | Transactional email | US |
| Vercel | Website hosting | US |
| Analytics + advertising | US | |
| Microsoft | Clarity (session analytics) | US |
| Meta | Advertising (Pixel + Conversions API) | US |
| Advertising (Insight Tag) | US |
International transfers
Some processors are located outside the EEA (in the United States). For these transfers we rely on appropriate safeguards under Chapter V of the GDPR — primarily the European Commission's Standard Contractual Clauses — and, where the specific provider is certified, additionally on the EU-US Data Privacy Framework. We keep these safeguards under review and apply supplementary measures where necessary.
Data retention
We keep personal data only as long as necessary: contract and client data for the duration of the relationship and afterwards for the periods required by accounting and tax law (generally up to 10 years under Romanian law); inquiry and lead records held on legitimate interest for up to 3 years from our last meaningful interaction, unless you ask us to erase them sooner; newsletter data until you unsubscribe, keeping proof of consent as needed to demonstrate compliance; analytics data per each tool's retention (GA4: 14 months); recruitment data for up to 6 months unless you agree to a longer period; and cookies for the duration shown in the Cookie Policy.
Security
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including encryption in transit, access controls and use of reputable, contractually-bound processors.
Your rights
Under the GDPR you have the right to: access your data; have it rectified; have it erased; restrict or object to its processing (including processing based on our legitimate interest, and profiling); data portability; and withdraw consent at any time without affecting prior processing.
To exercise any right, email gdpr@klarwin.com. You also have the right to lodge a complaint with the Romanian supervisory authority — Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, sector 1, 010336 București, anspdcp@dataprotection.ro — or with the data-protection authority of your country of residence.
Children
Our website is intended for business users and is not directed to children under 16. We do not knowingly collect data from children.
Cookie Policy
This cookie policy applies to all users of www.klarwin.com. Non-essential cookies load only after you consent via our cookie banner, where you can accept or reject each category (rejecting is as easy as accepting) and change your choice at any time. Google Tag Manager is the container that loads the tags below; it is not itself a tracker.
Cookie categories
- —Necessary — Cloudflare Turnstile (bot protection / security) and your cookie-consent choice. Always active.
- —Functional —
klarwin_first_touch(first-party, up to ~13 months): records only how you first arrived, to attribute your own inquiry. No cross-site tracking. - —Analytics (consent) — Google Analytics 4 and Microsoft Clarity (session replay, inputs masked).
- —Marketing (consent) — YouTube (video embeds), Meta Pixel and LinkedIn Insight Tag.
Changes to this policy
We may update this policy to reflect changes in our practices or the law. The "last updated" date below shows the current version. Last updated: 22 July 2026.
GDPR Contact
If you need more details about how our company processes personal data, please send a request to:
gdpr@klarwin.com