Privacy Policy
Protecting your personal data is important to us. This policy explains how we collect, use, and protect your information.
Last updated: 7 September 2026
1. Data Controller
In accordance with Regulation (EU) 2016/679 (GDPR), the controller of your personal data is:
Company name: AGRESS BUSINESS COMPANY SRL
Tax ID (CUI): 11650068
Trade Register No.: J1999000219172
Address: Bd. Siderurgiștilor nr. 15, bl. SD10B, parter, camera 7, Galați 800479, România
General email: hi@aestet.ro
Phone: +40 (744) 327 096
For any questions about the processing of your personal data, you can contact us at the email address above.
Data protection officer
We have appointed a data protection officer, who can be contacted directly about anything concerning your data and the exercise of the rights described below:
Name: Gabriel Ursan
Email: gabriel.ursan@gmail.com
Role: external officer, appointed under a services agreement
The officer's contact details are published here and are communicated to the Romanian National Supervisory Authority for Personal Data Processing, in accordance with Article 37(7) GDPR.
2. Data We Collect
2.1 Data you provide directly
When you complete the contact form on our website, we collect the following data:
- Full name — to address you correctly
- Email address — to respond to your request
- Phone number — for phone contact, if necessary
- City / Locality — to understand the geographical context
- Area of interest — to direct you to the right specialist
- Professional status — to understand your business profile
- Company name (optional) — for B2B clients
- Your message (optional) — additional details about your request
2.2 Automatically collected data
Our website may automatically collect certain technical information, including:
- IP address (anonymized in certain contexts)
- Browser type and operating system
- Pages visited and time spent
- Referral source (where you came from)
This data is collected through cookies and similar technologies, in accordance with our Cookie Policy.
2.3 What we do NOT collect
We do not collect or request:
- Payment data or financial information
- Sensitive data (ethnic origin, political beliefs, health data, etc.)
- Data about minors
3. Processing Purposes
We process your data for the following purposes:
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to enquiries from the contact form and the configurator | Art. 6(1)(b), pre-contractual steps |
| Quoting, negotiating and running the commercial relationship | Art. 6(1)(b), performance of a contract |
| Internal prioritisation of enquiries, through the score described in section 5 | Art. 6(1)(f), legitimate interest |
| Sending the newsletter and marketing communications | Art. 6(1)(a), consent, and Art. 12 of Romanian Law 506/2004 |
| Traffic analysis and advertising campaign measurement | Art. 6(1)(a), consent |
| Traceability of delivered medical devices and complaint handling | Art. 6(1)(c), legal obligation, Regulation (EU) 2017/745 |
| Invoicing, accounting and archiving | Art. 6(1)(c), legal obligation |
| Site security and prevention of form abuse | Art. 6(1)(f), legitimate interest |
Important: We do not sell or rent your personal data to third parties. We do not send unsolicited commercial communications (spam).
4. Who We Share Data With
Your data reaches the providers below, each named explicitly, with its role. We do not sell or rent personal data to anyone, and this list is complete as of the date of this update.
4.1 Processors
| Provider | What for | Where it processes |
|---|---|---|
| Sendinblue SAS (Brevo) | Sending confirmation emails, internal notifications and the newsletter | France |
| netcup GmbH | Hosting the website and the internal enquiry management application, on a dedicated virtual server | Data centre in Vienna, Austria. Provider based in Germany (Karlsruhe) |
| Online Presence Builder SRL (ursan.org) | Administration of the server and of the applications above, as part of the web maintenance service (updates, backups, monitoring) | Romania |
| Cloudflare, Inc. | Site delivery, protection against attacks and automated traffic | Global network, with European Union presence |
| Hotjar Ltd | Scroll and click maps, only with your consent for analytics | Malta, European Union |
4.2 Independent controllers
Google Ireland Limited and Meta Platforms Ireland Limited process data for traffic and advertising measurement in their own right, not only on our instructions. This processing happens only if you accept the corresponding categories in the cookie banner. If you refuse, none of their scripts load.
4.3 Authorities
We may disclose data to competent authorities (the Romanian tax authority, the data protection authority, the medical devices agency, courts) where legally required or to defend our rights.
4.4 Transfers outside the European Economic Area
Cloudflare, Inc. is a company based in the United States. Transfers to it are covered by the EU-US Data Privacy Framework, to which the company is certified, and additionally by the standard contractual clauses approved by the European Commission. The actual hosting of the website and of the internal application (netcup GmbH) takes place in the European Union, in Vienna, and the other providers also process within the European Union.
5. How We Prioritise Enquiries
When you submit the contact form or the configurator, our system automatically calculates a score between 0 and 100 and places the enquiry into one of three priority tiers. We tell you this openly, because it is a form of profiling within the meaning of Article 4(4) GDPR.
What goes into the score
- The professional status you select (doctor, clinic, salon and so on)
- The area of interest ticked in the form
- Whether you filled in a company name
- Whether the email address is a company one or a free one
- The town, to estimate delivery and installation distance
- The length and content of the message, plus simple spam signals such as random text or writing entirely in capitals
What the score does and does not do
The score sets the order in which the sales team picks up enquiries and which specialist they reach. That is all. It turns nobody away, blocks access to no product, does not influence the price you are quoted, and is not shared with any third party.
Every enquiry is read and handled by a person. There is no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.
The legal basis is our legitimate interest in responding promptly and competently (Article 6(1)(f)). You may object to this processing at any time by writing to gabriel.ursan@gmail.com, and your enquiry will then be handled in order of arrival.
6. Retention Period
We retain your data only as long as necessary for the purposes for which it was collected:
| Data type | Retention period |
|---|---|
| Enquiries that did not become a commercial relationship | 3 years from the last interaction |
| Customer data and active commercial relationships | For the duration of the relationship, plus statutory archiving periods |
| Accounting documents and invoices | 10 years, under accounting law |
| Traceability of delivered medical devices | At least 10 years from delivery, under Regulation (EU) 2017/745 |
| Newsletter subscription | Until you unsubscribe |
| Cookie consent record | 180 days, after which we ask you again |
| Website analytics data | 14 months in Google Analytics, 365 days in Hotjar |
| Server technical logs | Maximum 90 days |
At the end of retention periods, data is deleted or irreversibly anonymized.
7. Your Rights
Under GDPR, you have the following rights regarding your personal data:
Right of access (Art. 15 GDPR)
You can request a copy of the personal data we hold about you.
Right to rectification (Art. 16 GDPR)
You can request correction of inaccurate data or completion of incomplete data.
Right to erasure (Art. 17 GDPR)
You can request deletion of your data in certain circumstances ("right to be forgotten").
Right to restriction (Art. 18 GDPR)
You can request limitation of data processing in certain situations.
Right to data portability (Art. 20 GDPR)
You can request to receive your data in a structured, commonly used, and machine-readable format.
Right to object (Art. 21 GDPR)
You can object to data processing for direct marketing purposes or based on our legitimate interest.
Right to withdraw consent
Where processing is based on consent, you can withdraw consent at any time, without affecting the lawfulness of prior processing.
How to exercise your rights
To exercise any of these rights, write to us. The fastest route is directly to the data protection officer:
- Data protection officer: gabriel.ursan@gmail.com
- General email: hi@aestet.ro
- Mail: AGRESS BUSINESS COMPANY SRL, Bd. Siderurgiștilor nr. 15, bl. SD10B, parter, camera 7, Galați 800479, România
We will respond to your request within a maximum of 30 calendar days from receipt.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or disclosure:
- Encryption in transit: The website uses HTTPS for all communications
- Restricted access: Only authorized personnel have access to personal data
- Verified providers: We work only with providers who offer adequate security guarantees
- Data minimization: We collect only data strictly necessary for stated purposes
However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we commit to treating any security incident according to legal procedures.
9. Cookies and Similar Technologies
This website uses cookies and similar technologies. For complete information about the types of cookies used, their purposes, and how you can manage them, please consult our Cookie Policy.
Consent for non-essential cookies is requested on the first visit to the website and can be modified at any time.
10. Policy Changes
We reserve the right to update this Privacy Policy periodically to reflect changes in our practices or applicable legislation.
Significant changes will be communicated by:
- Updating the "Last updated" date on this page
- Displaying a notice on the website (for major changes)
We recommend that you periodically check this page to stay informed about our privacy policy.
11. Supervisory Authority
If you believe that the processing of your personal data violates data protection legislation, you have the right to file a complaint with the competent supervisory authority:
National Supervisory Authority for Personal Data Processing (ANSPDCP)
Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania
Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro
However, we encourage you to contact us first to try to resolve any issues directly.
Questions About Your Data?
If you have questions about this Privacy Policy or how we process your personal data, you can contact us:
AGRESS BUSINESS COMPANY SRL
Email: hi@aestet.ro
Phone: +40 (744) 327 096
Address: Bd. Siderurgiștilor nr. 15, bl. SD10B, parter, camera 7, Galați 800479, România
We will respond to requests within a maximum of 30 calendar days.