Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how ELVORA LIGHTING SRL (“ELVORA”, “we”, “us” or “our”) collects, uses, stores, discloses and protects personal data when you visit www.elvoralight.com, use its associated pages or contact us regarding our lighting products, solutions or project services.

This Policy applies to website visitors, prospective customers, architects, designers, developers, contractors, suppliers, business representatives and other persons who communicate with ELVORA through the website.

The website is an informational and project-enquiry platform. It does not currently provide public user accounts, online checkout, payment processing or e-commerce purchases.

2. Data controller

The controller responsible for processing your personal data is:

ELVORA LIGHTING SRL CUI: 54681980 Trade Registry number: J2026031475004 EUID: ROONRC.J2026031475004 Registered office: Str. Padesu nr. 8, Bl. 5, Sc. 2, Et. 8, Ap. 52, Sector 4, București, 041345, România Website: https://www.elvoralight.com Privacy contact: sales@elvoralight.com Telephone: +40 762 008 500

ELVORA has not stated that it has appointed a Data Protection Officer. Privacy requests should therefore be sent to the privacy contact above.

3. Personal data we collect

Depending on how you use the website, we may process the following categories of personal data.

3.1 Information submitted through the contact form

When you submit a project enquiry, we may collect:

• Your name;
• Company or organisation;
• Email address;
• Telephone number;
• Project type, project location and project stage;
• Lighting requirements and areas of interest;
• Indicative budget range;
• Your message and other information you voluntarily provide;
• Preferred language;
• The page from which the enquiry was submitted;
• Project documents, drawings, specifications, photographs, archives or other files that you upload;
• The date and time of submission; and
• A record that you acknowledged the applicable privacy information.

Name, email address and message are required so that we can identify and respond to your enquiry. Other fields are optional unless indicated otherwise.

Please do not submit special-category data, government identification numbers, payment-card information or information that is not relevant to your project enquiry.

If you provide personal data concerning another person, you must have an appropriate basis for doing so and, where required, inform that person about this Policy.

3.2 Technical and security data

When you visit or interact with the website, we or our service providers may automatically receive:

• IP address;
• Browser type and user-agent information;
• Device and operating-system information;
• Requested pages, referring page and approximate request time;
• Language preference;
• Cookie and consent preferences;
• Security, error and diagnostic information; and
• reCAPTCHA risk and verification information when you use the contact form.

This information is used to deliver the website, maintain security, prevent spam and abuse, diagnose technical problems and record cookie choices.

3.3 Analytics data

If you consent to Analytics cookies, Google Analytics 4 may collect information concerning:

• Pages viewed and navigation paths;
• Approximate location derived from IP address;
• Browser, device and operating-system characteristics;
• Session and interaction information;
• Referring websites or campaigns; and
• Pseudonymous identifiers stored in Analytics cookies.

ELVORA configures Google Analytics with IP anonymisation. Google Analytics is not loaded before Analytics consent is given.

We do not currently use advertising pixels or marketing-profiling scripts.

3.4 Correspondence and business information

If you communicate with us by email, telephone or through another business channel, we may retain your contact details, correspondence, meeting notes, project information, quotations and follow-up communications.

4. Sources of personal data

We generally obtain personal data:

• Directly from you;
• From the organisation you represent;
• Automatically from your browser or device;
• From our hosting, security and analytics providers; or
• From a colleague, architect, consultant, contractor or project partner who introduces you or includes you in relevant project correspondence.

5. Why we process personal data and our legal bases

5.1 Responding to enquiries and preparing proposals

We process contact and project information to assess your requirements, communicate with you, arrange discussions, prepare a quotation or proposed scope and take other steps requested before a possible contract.

The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract. Where this provision does not apply, we rely on our legitimate interest under Article 6(1)(f) GDPR in responding to genuine enquiries and developing business relationships.

5.2 Managing business relationships

We may retain correspondence and project information to manage ongoing discussions, maintain business records, coordinate with relevant production or project partners and provide requested support.

The legal basis is performance of a contract, steps before a contract, or our legitimate interest in conducting and documenting our business activities.

5.3 Website operation and security

We process technical data to deliver the website, prevent spam and malicious activity, enforce rate limits, maintain system security, investigate incidents and troubleshoot errors.

The legal basis is our legitimate interest in operating a reliable and secure website. Where processing is necessary to comply with a legal security obligation, Article 6(1)(c) GDPR may also apply.

5.4 reCAPTCHA

The contact form may use Google reCAPTCHA v3 to distinguish legitimate submissions from automated abuse. reCAPTCHA evaluates technical and interaction signals and assigns a risk score.

We use this service on the basis of our legitimate interest in protecting the website and communication systems from spam, fraud and misuse. reCAPTCHA does not make decisions producing legal or similarly significant effects concerning you. If a legitimate submission is rejected, you may contact us directly by email.

5.5 Cookie preference records

We store and log cookie choices, including a consent identifier, selected categories, language, IP address, user agent and time of decision, so that we can honour your preferences and demonstrate compliance.

The legal bases are our legal obligations concerning consent and our legitimate interest in maintaining evidence of privacy choices.

5.6 Analytics

Google Analytics is used only after you give Analytics consent. The legal basis is Article 6(1)(a) GDPR and the applicable Romanian rules implementing the ePrivacy Directive.

You can withdraw consent at any time through “Cookie settings”. Withdrawal does not affect processing lawfully carried out before withdrawal.

5.7 Google Maps and other optional functions

Google Maps is loaded only after you allow Functional technologies. The legal basis for related personal-data processing is your consent.

You may refuse Functional technologies without losing access to the principal content of the website. Office addresses remain available in text form.

5.8 Legal obligations and legal claims

We may process and retain relevant information to comply with accounting, taxation, regulatory or judicial obligations and to establish, exercise or defend legal claims.

The legal basis is Article 6(1)(c) GDPR or our legitimate interest under Article 6(1)(f) GDPR in protecting our legal rights.

6. The contact-form acknowledgement

The checkbox displayed with the contact form should confirm that you have read this Privacy Policy and the Terms and Conditions. It is not the legal basis for processing your enquiry.

We normally rely on steps taken at your request before a possible contract or on our legitimate interest in responding to your communication. Separate consent is used where legally required, particularly for optional cookies.

7. Cookies and similar technologies

We use cookies and browser storage for consent management, language preferences, website functionality, security and, with consent, analytics and embedded maps.

Detailed information about each category, provider and duration appears in our Cookie Policy. You can modify or withdraw optional consent at any time through the “Cookie settings” link in the website footer.

8. Recipients of personal data

Personal data may be disclosed only where necessary to:

• Authorised ELVORA personnel responsible for sales, design, technical coordination, production or project support;
• Relevant personnel supporting ELVORA’s operations in Romania or Türkiye;
• Vercel, which provides website hosting, content delivery and server infrastructure;
• Supabase, which provides database, authentication and private file-storage infrastructure;
• Our email and SMTP service provider, used to deliver contact notifications and confirmations;
• Google, where reCAPTCHA, Google Analytics or Google Maps is used;
• Professional advisers, including lawyers, accountants, auditors and insurers;
• Selected manufacturers, suppliers or project partners, where sharing is necessary to assess or fulfil your request and you would reasonably expect such involvement;
• Public authorities, regulators, courts or law-enforcement bodies where disclosure is required by law; or
• A buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal data. We do not disclose personal data to unrelated third parties for their own advertising purposes.

Service providers may process personal data only under appropriate contractual instructions and confidentiality obligations.

9. International transfers

Some service providers or authorised recipients may process personal data outside Romania or the European Economic Area, including in the United States or Türkiye.

Where the recipient is outside a country recognised as providing adequate protection, ELVORA will use an appropriate transfer mechanism where required, such as:

• The European Commission’s Standard Contractual Clauses;
• The EU–US Data Privacy Framework for an eligible and certified recipient;
• Additional contractual, organisational or technical safeguards; or
• Another transfer mechanism permitted by Articles 45–49 GDPR.

You may request information about the applicable safeguards by contacting sales@elvoralight.com. Commercially sensitive information may be redacted from any copy provided.

10. Retention periods

We retain personal data only for as long as necessary for the relevant purpose.

Unless a longer period is required by law or justified by a dispute:

• Unsuccessful or preliminary project enquiries, related correspondence and uploaded files are retained for up to three years after the last substantive communication;
• Information connected with a customer, supplier or project contract is retained for the duration of the relationship and for the applicable statutory, accounting and limitation periods afterward;
• Cookie-consent logs are retained for up to three years from the relevant consent decision, replacement or withdrawal;
• Data-subject request records are retained for up to three years after the request is closed;
• Website security and diagnostic logs are normally retained for no longer than twelve months, unless required for an active security investigation;
• Google Analytics event-level information is retained for fourteen months, while aggregated reports may remain available for longer without directly identifying a visitor;
• Consent and language preferences stored on your device remain until their stated expiry, until replaced, or until you clear website data; and
• Residual copies may remain temporarily in restricted backups until those backups are overwritten in accordance with the normal backup cycle.

If an enquiry becomes part of a commercial relationship, information may be moved to relevant project, contractual, tax or accounting records and retained under the periods applicable to those records.

11. Security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures include access controls, authenticated administration, encrypted connections, private storage for contact attachments, input validation, rate limiting, security monitoring and restricted administrative access.

No internet service can guarantee absolute security. You should avoid submitting highly confidential information through the contact form unless appropriate arrangements have first been agreed with us.

Submission of a file or project brief does not by itself create a confidentiality or non-disclosure agreement.

12. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• Obtain confirmation whether we process your personal data;
• Request access to your personal data and receive a copy;
• Request correction of inaccurate or incomplete information;
• Request erasure of personal data;
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Receive data you provided in a structured, commonly used and machine-readable format where the right to portability applies;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with a competent supervisory authority; and
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

An objection based on your particular situation will be assessed against any compelling legitimate grounds we may have to continue processing.

13. Exercising your rights

Send requests to sales@elvoralight.com and include enough information to identify the relevant records and understand your request.

We may request proportionate proof of identity where necessary to prevent unauthorised disclosure or deletion. We normally respond within one month. The period may be extended by up to two additional months for complex or numerous requests, in which case we will inform you.

Rights are generally exercised free of charge. A reasonable fee or refusal may be permitted for requests that are manifestly unfounded or excessive.

14. Complaints

You may contact us first so that we can attempt to resolve your concern.

You also have the right to lodge a complaint with:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) 28–30 B-dul General Gheorghe Magheru Sector 1, 010336 București, România Website: https://www.dataprotection.ro Telephone: +40 318 059 211

You may alternatively complain to the data-protection authority in the EU or EEA country where you live, work or believe an infringement occurred.

15. Children

The website and ELVORA’s project services are directed primarily to professionals and business representatives. They are not intended for children.

Persons submitting a commercial or project enquiry should be at least 18 years old or otherwise legally authorised to act for the organisation they represent.

16. External websites

The website may contain links to social networks, manufacturers or other third-party websites. ELVORA does not control the privacy practices of those websites. Their own privacy policies apply when you leave our website.

17. Changes to this Policy

We may update this Policy when our processing activities, service providers or legal obligations change. The revised version will be published on this page with an updated date.

Where a material change affects processing based on consent, we will request fresh consent where legally required.

18. Contact

Questions, objections and data-protection requests should be sent to:

ELVORA LIGHTING SRL Email: sales@elvoralight.com Telephone: +40 762 008 500 Address: Str. Padesu nr. 8, Bl. 5, Sc. 2, Et. 8, Ap. 52, Sector 4, București, 041345, România