Privacy policy

The controller responsible for processing your data is:

Company name

AUTOKIT S.R.L.

Registered office

Str. Harghita nr. 81/C, et. parter, ap. 3, Miercurea Ciuc, jud. Harghita, Romania

Trade register number

J19/347/2006

Tax identification number (CUI)

RO18612843

Email

contact@autokit.ro

Phone

+40 745 880 518

Website

autokit.ro

We have not designated a data protection officer, because the law does not require one. For any question about your personal data, write to us at contact@autokit.ro.

The quote and contact form on the site asks for your name, email address and message. All three fields are required: without them we cannot answer you. Many visitors also mention their car model in the message. Photos cannot be sent through the form.

Legal basis: for quote requests, Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). For other questions, Art. 6(1)(f) GDPR (our legitimate interest in answering the questions we receive).

How your message travels: the form is processed on our website's server (Vercel). From there, the message is sent by email, using the email-sending service Resend, to our mailbox contact@autokit.ro. This mailbox is hosted by our email and hosting provider in Romania. Messages received there are also forwarded to a Google (Gmail) mailbox we use. We do not save the content of the form in the server logs.

The form has an invisible anti-spam field and a check of how long it took to fill in. These store nothing.

If you contact us directly by email, phone, WhatsApp or Facebook, we process the data you send us. The legal bases are the same as for the form.

The site only shows plain links to WhatsApp and Facebook. No data is sent to WhatsApp or Meta until you tap such a link. WhatsApp Ireland Ltd and Meta Platforms Ireland Ltd process messages under their own policies: WhatsApp privacy policy and Meta privacy policy.

If you visit AUTOKIT's Facebook Page, Meta and AUTOKIT are joint controllers (Art. 26 GDPR) for the Page statistics (Page Insights). Details: Meta's Page Insights Controller Addendum.

How long we keep the data: enquiries that do not lead to a job are deleted at the latest 12 months after the last message, from every place where they are kept (mailboxes and WhatsApp). If a job follows, the data become part of our customer records and invoices. We keep these for the periods required by Romanian accounting and tax law.

The site is hosted by Vercel Inc. (USA). When it delivers the pages to you, Vercel processes your IP address, information about your browser and device (user agent), the page requested and the time of access. The purpose is to deliver the site and keep it secure. Your browser sends these data automatically with every request; without them, the site cannot be delivered to you.

Legal basis: Art. 6(1)(f) GDPR, that is, our legitimate interest in operating the site and keeping it secure (GDPR recital 49).

Vercel is our processor for hosting. For some usage data of its own service ("service-generated data"), Vercel decides itself. Details: Vercel privacy policy.

We do not keep these logs ourselves. Our hosting plan keeps runtime logs for a short time only.

Our site sets no cookies. We save only two pieces of information in your browser:

• In the browser's local storage, the key "autokit-consent": your privacy choice, that is, which optional features you accepted and when. This is strictly necessary to remember your choice and needs no consent (Art. 4(6) of Law No. 506/2004). It stays saved until you change or delete it. After 12 months we ask you again.
• In the browser's session storage, the key "autokit-lang-hint": whether you closed the language suggestion. It is deleted when you close the tab.

The optional features that need your consent are "Statistics" (Plausible, see the section on statistics) and "Google Maps" (see the section on Google Maps). You choose in the privacy banner. You can change your choice at any time with the "Cookie settings" link in the footer of every page. Please note: if you load the Google map, Google may set or read its own cookies in your browser (details in the section on Google Maps).

Nothing optional loads before you choose. If you refuse, you can use the site just the same.

Fonts, icons and flags are served from our own domain. No third party is contacted when a page loads.

Only if you accepted "Statistics", we use Plausible Analytics, open-source software. Our web developer, Dextra, runs it for us on its own server (plausible.dextra.dev). The server is reached through the network of Cloudflare, Inc. (USA), which Dextra uses.

Plausible sets no cookies and stores nothing on your device. To count unique visitors, it computes an identifier from your IP address and browser data, using a random value (salt) that changes every day. The IP address itself is not stored, and the daily identifier is discarded.

Plausible records:

• the page visited and the site you came from;
• the country (derived from the IP address);
• the device type, browser and operating system;
• sending the contact form, including failed attempts (only the technical reason, never what you typed);
• clicks on WhatsApp, phone or email links;
• questions about a specific service;
• clicks on the buttons at the top of the home page;
• changing the language;
• clicks on links to other sites;
• how far you scroll the page and how long you stay on it.

We see only aggregated statistics, not individual visitors.

Legal basis: your consent (Art. 4(5) of Law No. 506/2004 and Art. 6(1)(a) GDPR). You can withdraw your consent at any time with the "Cookie settings" link. Withdrawal does not affect the lawfulness of processing carried out before it.

Dextra is our processor. Cloudflare is Dextra's processor (sub-processor). Details: Plausible data policy and Cloudflare privacy policy.

The Google map does not load automatically. It loads only after you click "Load map" or if you accepted "Google Maps" in the privacy banner. Only then does your browser connect to Google. Google receives your IP address and browser data and may set or read cookies.

For users in the European Economic Area, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible. The data may also be processed by Google LLC in the USA.

AUTOKIT and Google are joint controllers only for the collection and transmission of data triggered by embedding the map on the site (judgment of the Court of Justice of the European Union in Fashion ID, C-40/17). What Google does with the data afterwards is decided by Google alone: Google privacy policy.

Legal basis: your consent (Art. 4(5) of Law No. 506/2004 and Art. 6(1)(a) GDPR). You can withdraw it at any time with the "Cookie settings" link. Withdrawal does not affect the lawfulness of processing carried out before it.

If you do not want to load the map, you can use the address shown as text or the plain "Open in Google Maps" link.

On the site we show a selection of public reviews from AUTOKIT's Google Business Profile. For each review we show the reviewer's first name and the initial of their family name, the star rating and the review text. We also show our translation into the other site languages, marked as translated.

Source of the data: reviews publicly available on Google (Art. 14 GDPR). Legal basis: Art. 6(1)(f) GDPR, that is, our legitimate interest in showing genuine customer feedback about our work. We keep the reviews for as long as they are shown on the site.

If you wrote a review, you can object at any time by writing to contact@autokit.ro. We will remove the review from the site.

We do not check whether reviewers were our customers. Google does not check this either. The full list of reviews is on Google.

Your data reaches only the following recipients, each for the role described:

• Vercel Inc. (USA): hosting the site and processing the form;
• Resend (Plus Five Five, Inc., USA): sending the emails generated by the form;
• our email and hosting provider in Romania: the mailbox contact@autokit.ro and the domain;
• Google: the Gmail mailbox to which we forward messages; Google Maps, only if you load the map;
• Dextra, our web developer: site maintenance and, with your consent, visitor statistics; its sub-processor Cloudflare, Inc. (USA);
• WhatsApp and Meta: only if you contact us through these channels;
• our accountant and public authorities: only if a job follows or the law requires it.

We do not sell your data and do not use it for advertising.

Vercel, Resend, Cloudflare and Google LLC are located in the USA. These companies are certified under the EU-U.S. Data Privacy Framework. In its adequacy decision of 10 July 2023 (Commission Implementing Decision (EU) 2023/1795), the European Commission found that data sent to companies certified under this framework are adequately protected. Where a company’s contract with us includes the EU standard contractual clauses, they serve as a fallback in case the framework no longer applies.

List of certified companies: dataprivacyframework.gov. You can request a copy of these safeguards at contact@autokit.ro.

Regarding your personal data, you have the following rights:

• right of access: to find out what data we hold about you and receive a copy (Art. 15 GDPR);
• right to rectification: to have wrong or incomplete data corrected (Art. 16 GDPR);
• right to erasure (Art. 17 GDPR);
• right to restriction of processing (Art. 18 GDPR);
• right to data portability, for data processed on the basis of consent or a contract (Art. 20 GDPR);
• right to object (Art. 21 GDPR), described below;
• right to withdraw your consent at any time (Art. 7(3) GDPR).

To exercise your rights, write to contact@autokit.ro. We answer within one month at the latest. For complex requests, this period can be extended by two further months; in that case we let you know. Exercising your rights is free of charge. We ask you to confirm your identity only if we have reasonable doubts about who is making the request.

You have the right to lodge a complaint with the Romanian supervisory authority:

Authority

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), the Romanian National Supervisory Authority for Personal Data Processing

Address

B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania

Email

anspdcp@dataprotection.ro

Phone

+40 318 059 211

Website

www.dataprotection.ro

You can also lodge a complaint with the authority in the EU country where you live or work. In Hungary, for example, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu).

We would appreciate it if you contacted us first, but this is not a condition.

We do not make decisions based solely on automated processing of data, and we do not create profiles.

We update this policy when the site or the way we process data changes. The date at the top of the page shows the current version. Last updated: 3 October 2026.