Who controls the data
For personal data collected through esma.ro, ESMA Cloud Systems acts as the data controller. We are based in Bucharest, Romania.
Questions or requests concerning personal data can be sent to office@esma.ro.
Data we collect
Information you provide
- Your name and work email address.
- The organisation or role you mention, if any.
- The content of your message and subsequent correspondence.
- Any other information you choose to provide.
Technical and security information
When you use the enquiry form, the website may process your IP address, request origin, submission time and security-session information. This is used to validate the request, prevent repeated submissions and detect spam or malicious activity. Standard server logs may also contain technical request information.
Purposes and legal bases
We process personal data only when we have a valid reason:
- To answer enquiries and discuss a potential project: taking steps at your request before entering a contract and our legitimate interest in business communication.
- To manage an active client or supplier relationship: performing a contract and related administrative obligations.
- To protect the website and form: our legitimate interest in preventing spam, fraud and security incidents.
- To comply with law: where records must be kept or disclosed under a legal obligation.
We do not use website enquiries for unrelated marketing without an appropriate legal basis. The form uses automated anti-spam rules, but we do not carry out profiling or decisions producing legal or similarly significant effects.
Sensitive data and client systems
Please do not send patient information, health records, passwords, production credentials or other sensitive data through the public enquiry form. If such information is necessary for a project, we will agree on an appropriate secure channel and contractual safeguards first.
This policy describes the public ESMA website. It does not describe personal data processed inside software operated for a client, such as a medical registry or learning platform. The controller and processor roles, instructions, security measures and retention rules for those systems are set out in the relevant client agreement and data-processing terms.
Recipients and international transfers
Access is limited to ESMA team members who need the information to respond or manage the relationship. We may also use service providers for website hosting, email delivery, infrastructure, security or professional advice. They may process information only for the relevant service and under applicable contractual and confidentiality obligations.
We do not sell or rent personal data. We may disclose information when required by law, to protect legal rights or in connection with a legitimate corporate transaction.
If a provider processes personal data outside the European Economic Area, we use an available lawful transfer mechanism and appropriate safeguards where required.
How long we keep data
We keep enquiry and correspondence data only for as long as needed to answer the request, assess or manage a potential relationship and establish or defend legal claims. If an enquiry becomes a project, relevant records are retained according to the project agreement and applicable accounting or legal requirements.
Security and rate-limiting information is kept only for the operational period needed to protect the form and investigate abuse. When information is no longer required, it is deleted, anonymised or securely archived where a legal obligation applies.
Cookies, local storage and analytics
The website stores your language preference in your browser’s local storage. The enquiry form uses a temporary, essential session cookie to protect submissions against cross-site request forgery. The session cookie is not used for advertising and normally expires when the browser session ends.
At the date shown above, we do not use advertising cookies, behavioural tracking or third-party analytics on this website.
Security
We use reasonable technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure or loss. These include access controls and form protections such as session validation, anti-spam checks and submission limits.
No internet transmission or storage system can be guaranteed completely secure. If you believe information sent to us may be at risk, contact us promptly.
Your data-protection rights
Depending on the circumstances, the GDPR gives you rights to:
- be informed and obtain access to your personal data;
- correct inaccurate or incomplete data;
- request erasure or restriction of processing;
- object to processing based on legitimate interests;
- receive or transfer data where portability applies; and
- withdraw consent where processing relies on consent, without affecting earlier lawful processing.
To exercise a right, email office@esma.ro. We may ask for information needed to verify your identity. You may also lodge a complaint with Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP) or another competent supervisory authority.
For additional general information, see the European Commission’s overview of individual data-protection rights.
Changes and contact
We may update this policy when the website, our processing or legal requirements change. The date at the top identifies the latest version.
Privacy questions and rights requests can be sent to:
office@esma.ro