1. Who is responsible for your data?
The controller for enquiries addressed to Altema is Alexandru-Cătălin Ciobanu PFA, trading as Altema.
- Tax ID (CIF)
- 51141462
- Trade Register No.
- F2025001121004
- Registered Office
- Str. Elena Farago, No. 9, Craiova, Romania
- Country
- Romania
- Primary Business Email
- office@altema.ro
- Secondary Email
- alexandrucatalin.ciobanu04@gmail.com
- Phone
- +40 761 615 598
2. Data and the current contact form
The local prototype asks for your name, email, optional company or organization, service requested, and project brief. The brief may include data type, estimated volume, goals, and target timeline. Name, email, service, and brief are required only to demonstrate field validation.
Opening the prototype as local files does not send these fields. The optional loopback PHP test processes them on the local test server to prepare an unsent message; it does not connect to the original PHP form. Raw form contents are not stored by the test backend. Values remain in the page while you interact with it. Your browser may independently offer autofill or restore form values; manage those features in your browser settings.
If you use an email or telephone link, you initiate contact through your own mail or calling application. Altema may then receive your contact details, message, and any information you choose to provide. Please do not send passwords, confidential datasets, or sensitive personal information in an initial enquiry.
No real analytics or remote third-party scripts are loaded by this prototype. The consent interface stores only the chosen preference; see section 9 for the proposed production analytics configuration. When files are opened locally, this code does not generate web-server access logs. A hosted version may involve host or infrastructure logs, which have not been verified.
3. Purposes and legal grounds
No production email delivery is enabled. The optional loopback PHP test prepares unsent messages only. For actual correspondence initiated by email or telephone, the following legal grounds must be selected according to the circumstances:
- Responding to an individual's request for a quotation or pilot before a potential contract: Article 6(1)(b) GDPR, where the individual is the prospective contracting party.
- Business correspondence with a company's representative: Article 6(1)(f), where justified by the legitimate interest in responding to relevant business enquiries and assessed against the individual's rights.
- Compliance with an identified legal obligation: Article 6(1)(c), only where that obligation actually applies.
The demo does not subscribe you to marketing. The proposed optional analytics feature is consent-gated as described in section 9; contacting Altema does not constitute analytics or marketing consent.
4. Recipients and service providers
The prototype does not transmit form entries to any recipient. Actual email or telephone correspondence is received by the controller using the contact channels above. The secondary address is a Gmail account administered by Altema. The owner has confirmed that the hosting already automatically forwards email received at office@altema.ro to this account; the form backend does not add a separate Gmail recipient. The exact Google contractual entity, account terms, processing locations, access settings and any onward transfers must still be verified. The primary email's provider is not established by the website code.
LinkedIn and X are ordinary outbound links, not embedded feeds, widgets, or tracking scripts. Visiting them takes you to a separate service whose own privacy rules apply.
5. Retention
The prototype has no application-managed persistent storage for form values. A separate consent preference can be stored for the proposed 180-day period described in section 9. It does not establish the retention of actual email correspondence or future hosted logs.
For production, retention must be tied to the enquiry's purpose and status, whether it develops into a contract, applicable record-keeping obligations, and any necessary handling of claims. Retaining data indefinitely by default is not an approved policy.
6. International transfers
The local demo does not send form data or analytics events abroad. This does not establish where actual email services or future hosting process data.
7. Your rights and how to contact us
Subject to the GDPR's conditions and exceptions, you can request access, correction, erasure, restriction, or portability of your personal data. You can object to processing based on legitimate interests. Where consent is the basis, you may withdraw it without affecting earlier lawful processing.
Send requests to office@altema.ro, or use the secondary email or registered office above. Describe the request and provide enough context to locate the correspondence. Do not send identity documents unless proportionate verification is subsequently required.
The GDPR normally requires a response within one month of receipt; an extension of up to two further months is possible where justified, with notice during the first month. Rights are not absolute and legal exceptions may apply.
You may complain to a competent supervisory authority, including Romania's ANSPDCP (complaint procedure; opens in a new tab), or an authority in the EU country where you habitually reside, work, or consider an infringement occurred.
8. Choices, automated decisions, and changes
Using the demo form is optional and does not create a contract or a service request. The prototype performs basic field validation, not automated decisions with legal or similarly significant effects, and contains no profiling functionality.
This draft covers the website and initial enquiries, not the processing of client datasets under a future service agreement. Any such processing needs separate, verified contractual arrangements.
The date above identifies this draft's latest update. The final policy must be reviewed when the form, providers, hosting, or tracking configuration changes. See the Cookie Policy for the current technical inventory.
9. Optional Google Analytics — proposed production configuration
Altema plans to use Google Analytics 4 with the existing Measurement ID G-2HDHLWMELQ to understand page use and interest in pilot projects. Real tracking is disabled in this local prototype, including after you accept Analytics. Only a preference record is stored by the consent interface.
For the proposed production configuration, Analytics is optional and based on consent under Article 6(1)(a) GDPR. No Google tag or measurement request is loaded before Analytics is accepted. Rejecting Analytics does not prevent browsing or contacting Altema. Change or withdraw your choice through Cookie Settings in any footer. Withdrawal stops subsequent measurement; it does not undo earlier processing.
When activated after approval, Google Analytics would receive pseudonymous browser/session identifiers, a fixed page title and normalized page URL, and technical connection information required by the service. The custom events are request_pilot (an approved CTA location only) and generate_lead (a fixed form identifier, only after confirmed server success). These custom payloads exclude names, emails, phone numbers, company names, project briefs, submission keys, URL queries, fragments, and referrers. This does not make Google Analytics anonymous.
The proposed integration disables advertising consent, Google signals, and advertising personalization signals. All Enhanced Measurement options must be disabled in the web-stream settings before activation so automatic form or link collection cannot bypass the custom event rules. No user-provided-data collection or User-ID should be enabled.
The consent record is stored in your browser under altema.consent.v1, with the analytics choice, policy version, choice time, and expiry. The implementation proposes an expiry of 180 days for both acceptance and rejection. This is an operational proposal awaiting approval, not a legal retention requirement. If browser storage is unavailable, choices apply in memory for that page only. Storage behavior for local file: pages is browser-dependent; the published site must be tested on its actual origin.
For international transfers, hosting, email and non-analytics retention, the unresolved points in sections 4–6 still apply. Google Analytics must remain disabled until these points have been reviewed and this draft updated. See the Cookie Policy for the full proposed inventory and controls.
10. Enquiry delivery and existing Gmail forwarding
After separately approved activation, the Request a Pilot backend will address each enquiry only to office@altema.ro. The owner has confirmed an existing automatic hosting forward from that address to alexandrucatalin.ciobanu04@gmail.com, a Gmail account administered by Altema. The application does not add a Gmail To, CC or BCC recipient. The forwarded message contains your name, email, optional company, selected service and project description, for responding to your business enquiry and following up on a possible engagement. Your validated email is used as Reply-To; the sender is an authorized Altema domain address.
No real email delivery is enabled in this prototype. Local-file use remains a browser-only demonstration. When explicitly served through the loopback PHP development server, the test backend prepares an unsent message for the single fixed business recipient. It never calls PHP mail() or opens an SMTP connection. The proposed production transport delegates to the hosting mail system through PHP mail(), with no mailbox password in the application. Production and non-loopback access are disabled by default.
The prepared PHP workflow uses a strictly necessary form-security session cookie, altema_pilot_session, when the PHP endpoint is used. It holds a random session identifier, not form contents, with HttpOnly and SameSite=Strict attributes and Secure on HTTPS. The cookie has browser-session lifetime; the token's configured validity is 30 minutes. Server-side session cleanup must be verified on hosting. The static-file demo does not create this cookie.
To limit abuse and repeat requests, the backend keeps keyed digests of request content and IP addresses, random receipts, timestamps, status and counters. These are pseudonymous operational data, not anonymous statistics. Raw field values and full message bodies are not written by the application's deduplication store. Proposed settings are a 15-minute rate window, a 15-minute duplicate-content window and 24-hour request-status records; records are pruned on subsequent requests. A scheduled cleanup is needed for guaranteed physical deletion when traffic stops. These proposed periods and the security-processing legal basis need approval before activation.
The existing hosting forwarding rule routes the full enquiry email to Gmail after actual delivery to the business address; this is separate from Google Analytics. Analytics consent is not a condition for sending an enquiry and does not serve as consent for email handling. The generate_lead integration is reserved for confirmed acceptance of a new request by the hosting mail system (or an explicitly selected SMTP transport), with Analytics consent, and contains no form values or mailbox addresses. Test-only, duplicate and unconfirmed outcomes do not trigger this event.
Requests for access, correction or deletion may be sent to the controller contact details in section 1. The response process must cover both mailboxes, subject to applicable retention obligations. Acceptance by PHP mail() or SMTP is not a guarantee that either message arrived in an inbox.