Privacy & GDPR notice.

Last updated: 15 August 2026

1. Controller

Gazolin Production SRL (operating the CarpaCore brand), with its registered operational base in Baia Mare, Maramureș, Romania (European Union), acts as the data controller for personal data collected through carpacore.com.

For any question regarding this notice or to exercise your rights, contact corporate@carpacore.com.

2. Data we collect

We collect only the data you submit through the corporate contact form: full name, corporate email address, company name, country, selected interest area and the free-text message you provide.

Our hosting infrastructure processes standard technical data such as IP address, user agent and request timestamps in server logs, for security and availability purposes.

3. Purpose and legal basis

Enquiry handling and pre-contractual communication — Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract).

Security, abuse prevention and service availability — Article 6(1)(f) GDPR (legitimate interest in operating a secure website).

Optional analytics cookies — Article 6(1)(a) GDPR (consent), which you may withdraw at any time via Cookie settings in the footer.

4. Retention

Enquiry data is retained for 24 months from the last contact, unless a contractual relationship is established, in which case statutory commercial and fiscal retention periods apply.

Server logs are retained for a maximum of 12 months.

5. Recipients and transfers

Data is processed inside the European Union. We do not sell personal data and do not share it with third parties for advertising purposes.

Where processors are engaged for hosting, email delivery or CRM operations, they act under a Data Processing Agreement pursuant to Article 28 GDPR, with processing located in the EU/EEA.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

Requests are answered within one month. You also have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP) or the authority of your habitual residence.

7. Cookies

The website functions without optional cookies. Analytics cookies are set only after explicit consent and can be revoked at any time through Cookie settings in the footer.

Two analytics tools are used, both loaded only after consent. Matomo (_pk_id, _pk_ses) is self-hosted on our own EU infrastructure. Microsoft Clarity (_clck, _clsk) is operated by Microsoft as a third-party processor and records usage interactions such as clicks and scrolling to produce heatmaps and session insights. If you decline, neither script is downloaded and analytics cookies already present are deleted.

A single technical entry is stored in your browser to remember your cookie preference.

8. Security

Transport is encrypted with TLS. Access to enquiry data is restricted on a least-privilege basis to the corporate team, with authentication and audit logging in line with our internal control set, which is designed against ISO/IEC 27001.

This notice applies to carpacore.com. Enquiries submitted through our Romanian site carpacore.ro are covered by the notice published there.