Privacy Policy
We respect your privacy and use personal data only for clear, limited and lawful purposes. This policy explains what information WoodLock collects through this website, why we use it and the rights available to you.
1. Who controls your personal data
The WoodLock brand and this website are operated by DG WOODEN HOUSE S.R.L., with its registered office at Str. Pleașa nr. 81, camera 3, cod poștal 505800, Zărnești, județul Brașov, România, tax identification number 37838260, Trade Registry number J08/1766/2017, referred to below as “WoodLock”, “we” or “the controller”.
- General and privacy email: contact@woodlock.ro
- Telephone: 0735 997 833
2. What data we process and where it comes from
We process only the information needed for the purposes described below:
- Contact form: name, email address and any optional information you provide about your land, project or enquiry.
- WoodLock Roadmap request: the email address needed to deliver the requested material.
- CRM enquiry management: form type, language, source, enquiry date, status and latest relevant interaction, responsible person, and commercial notes strictly necessary to follow up the enquiry.
- Optional marketing: email address, your checkbox selection, date, time, source and the version of the consent wording.
- Technical and security information: IP address, request date and time, device and browser type, technical headers, anti-abuse identifiers and results, and infrastructure logs.
- Optional measurement and advertising: only after your consent, page URL and title, referring page, interaction date and time, IP address, browser and device information, cookie and campaign identifiers, and events such as viewing a page or successfully submitting a form. We do not send the free-text form message to advertising tools.
Form information comes directly from you. Technical information is received automatically from the device and browser used to access the website.
Please do not include national identification numbers, health information, financial information or other sensitive data that is not necessary for your enquiry.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to questions about WoodLock products, services, quotations or projects | Name, email, message | Steps requested before entering a contract — Article 6(1)(b) GDPR |
| Responding to general enquiries that do not concern a potential contract | Name, email, message | Our legitimate interest in communicating and responding — Article 6(1)(f) GDPR |
| Recording and managing the enquiry in Brevo CRM | Form information, source, enquiry status and relevant interaction history | Pre-contractual steps — Article 6(1)(b) GDPR; for organising and following up general enquiries, legitimate interests — Article 6(1)(f) GDPR |
| Sending the requested Roadmap once | A requested step before a potential contract — Article 6(1)(b) GDPR. The request does not automatically subscribe you to marketing. | |
| Sending WoodLock news, guides and offers | Email and consent record | Consent — Articles 6(1)(a) and 7 GDPR; Article 12 of Romanian Law 506/2004 |
| Protecting forms, preventing abuse and securing the website | Technical data and logs | Legitimate interests in network and information security — Article 6(1)(f) GDPR |
| Campaign measurement, retargeting and website-activity Custom Audiences through optional technologies such as Meta Pixel | Browsing, device, cookie, campaign and event data | Consent — Articles 6(1)(a) and 7 GDPR; Article 4(5) of Romanian Law 506/2004. The technology is not activated before consent. |
| Meeting legal obligations and defending our rights | Relevant enquiry or relationship data | Legal obligation — Article 6(1)(c), or legitimate interests — Article 6(1)(f) GDPR |
Fields marked as required are necessary to process your request. Without them, we cannot respond or deliver the requested material. The message field and marketing consent are optional.
4. Marketing communications
We send marketing communications only when you separately and voluntarily select the dedicated checkbox. Refusing marketing does not prevent form submission, Roadmap delivery or a response to your enquiry.
You may withdraw consent at any time through the unsubscribe link in each message or by emailing contact@woodlock.ro. Withdrawal applies to future processing and does not affect processing that was lawful before withdrawal. After unsubscribing, we may retain a minimal suppression record to prevent accidental re-enrolment.
5. Who may receive your information
Information is accessible only to authorised personnel and providers necessary to operate the service:
- Cloudflare, Inc. — website hosting, delivery and security, email routing and, if enabled, form protection through Cloudflare Turnstile;
- Brevo / Sendinblue SAS — managing enquiries and leads in the CRM, operational email delivery and, only with separate consent, marketing communications;
- Google Ireland Limited (Gmail) — the mailbox receiving messages sent to contact@woodlock.ro and relevant operational copies;
- Meta Platforms Ireland Limited — only if you have accepted optional technologies, for campaign measurement, conversion attribution, retargeting and website-activity Custom Audiences, under the Meta Privacy Policy and Meta Cookies Policy;
- technical providers, legal advisers, accountants or public authorities, strictly where necessary or legally required.
Providers acting on our behalf are contractually required to follow WoodLock’s instructions and meet applicable confidentiality, security and data-protection requirements.
Transfers outside the European Economic Area
Some providers or subprocessors may process information outside the European Economic Area. Where this occurs, we use a GDPR-recognised mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, with supplementary measures where required. You may request information about the applicable safeguards through the privacy address above.
6. How long we keep information
| Category | Retention period |
|---|---|
| Contact enquiries and related CRM and mailbox records that do not become contractual relationships | 24 months after the last meaningful interaction |
| Email used only to deliver the Roadmap | 30 days after successful delivery, unless marketing consent or a later conversation applies |
| Marketing information | until consent is withdrawn or after 24 months of inactivity, whichever occurs first, except for the minimal record needed to demonstrate consent or honour an unsubscribe request |
| Technical and security logs | up to 90 days, unless needed to investigate an incident |
| Optional-technology choice | Up to 6 months, after which we ask for a new choice; a new selection immediately replaces the previous one |
Meta advertising cookies _fbp and, where applicable, _fbc, once accepted | Up to 90 days according to information published by Meta; other information received by Meta is retained under Meta’s own policies |
If an enquiry leads to a contract, relevant information may be retained separately during the relationship and afterwards for applicable accounting, tax or legal-claims periods. At the end of the applicable period, information is securely deleted or anonymised.
7. Your rights
Subject to the conditions in the GDPR, you may request:
- access to your information and a copy of it;
- correction of inaccurate or incomplete information;
- erasure;
- restriction of processing;
- portability of information you provided, where the legal conditions apply;
- objection to processing based on legitimate interests;
- withdrawal of consent, without retroactive effect.
You may object to direct marketing at any time. After an objection, we will no longer use your information for that purpose.
You can withdraw consent for optional technologies as easily as you gave it by using the permanent “Cookie preferences” button. Withdrawal stops their future use without affecting processing that was lawful before withdrawal. You may also use the controls described in Meta’s policies for choices and rights exercised directly with Meta.
To exercise your rights, email contact@woodlock.ro. We respond without undue delay and normally within one month. The period may be extended as permitted by the GDPR for complex or numerous requests, in which case we will inform you. We may request limited additional information where necessary to verify identity.
9. Information security
We apply technical and organisational measures proportionate to the risks, including access limitations, secure authentication, infrastructure protection, encrypted transmission and incident procedures. No transmission or storage method can guarantee absolute security.
10. Automated decisions and children
WoodLock does not use information collected through the website for solely automated decisions that produce legal or similarly significant effects. Only with consent, Meta may associate Pixel activity with other information and use it for measurement, audiences and ad personalisation under its own policies. WoodLock does not make an automated decision with legal effects about you based on this activity.
The WoodLock website and forms are intended for people seeking information about a construction project and are not designed for children. If we learn that we accidentally received a child’s information without an appropriate legal basis, we will delete it.
11. Complaints and contact
We encourage you to contact us first at contact@woodlock.ro so that we can investigate and address your request.
You also have the right to lodge a complaint with Romania’s National Supervisory Authority for Personal Data Processing — ANSPDCP, 28–30 G-ral. Gheorghe Magheru Boulevard, District 1, Bucharest 010336, Romania, email anspdcp@dataprotection.ro, telephone +40 31 805 92 11, website dataprotection.ro.
12. Changes to this policy
We may update this policy when the website, our providers or legal requirements change. The current version and effective date will be published on this page. A policy change does not retroactively expand consent already given.