Meet us at EuroTier 2026 Hannover · 10-13 November 2026 Hall 13, Stand A48

Privacy policy

This policy explains how HU RO SRL handles personal data when you visit www.fermatvending.com or contact us through it. It is based on the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and the Romanian implementing rules (Law no. 190/2018). Effective: November 2026.

1. Data controller

HU RO SRL
Sânsimion, Str. Principală nr. 562B, 537285, Harghita County, Romania
VAT ID: RO5874966 · Trade Register No.: J1994000586196 · EUID: ROONRC.J1994000586196
E-mail: office@fermatvending.com · Phone: +40 723 015 125, +40 726 973 531

We have not appointed a data protection officer, as our activities do not require one. For any data protection question, contact us at the e-mail address or phone number above.

2. What data we process, why and on what legal basis

2.1. Quote requests, dealer applications and contact via the form

Data: name, company, e-mail address, phone number, country, the machine you are interested in, your message, the type of request and the page language. Required fields are marked with an asterisk; without them we cannot answer.

Purpose: answering your request, preparing an offer, assessing a dealer application.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR).

Protection against abuse: together with the form we store a one-way, irreversible hash of your IP address and the technical identifier of your browser (user agent), so that we can filter out mass automated submissions. Legal basis: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).

Retention: enquiries are deleted automatically from the website database after 24 months. We keep the e-mail notification for the same period. If an enquiry leads to a contract, we transfer the data needed to our contract and accounting records and keep it for as long as the law requires.

2.2. Online offer form (offer.fermatvending.com)

The “Request an offer” buttons lead to our online offer form, which is also operated by HU RO SRL. There we process your company name, the contact person’s name, e-mail address, phone number, country, address, EU VAT number (if you enter it), whether you are an end user or a dealer, and the machine and configuration you choose, in order to prepare your offer and send it to you by e-mail. Legal basis: Art. 6(1)(b) and (f) GDPR; for the optional newsletter box, your consent (point (a)). Retention: up to 24 months if the offer does not lead to a contract; if it does, as described in section 2.1.

2.3. Direct contact by e-mail, phone or WhatsApp

If you write to us, call us or tap the WhatsApp button, we process the data you give us (name, contact details, content of the conversation or message) to answer you and, where relevant, to make an offer. Legal basis: Art. 6(1)(b) and (f) GDPR. The WhatsApp button only opens the app; WhatsApp Ireland Ltd. provides that service under its own terms and privacy policy.

2.4. Newsletter

If you subscribe to our newsletter at the bottom of the page, we use your e-mail address to send you news about FERMAT and Fermag products, launches and events. Legal basis: your consent (Art. 6(1)(a) GDPR). We send the newsletter with Mailchimp (The Rocket Science Group LLC, a subsidiary of Intuit Inc., United States), which also records your subscription, whether you open the e-mails and which links you click. Every e-mail contains an unsubscribe link; once you unsubscribe, we remove your address from the mailing list.

2.5. Website operation and security

Each time a page is loaded, the hosting server records technical data (IP address, date and time, page requested, browser and operating system, error messages) in order to deliver the website, find errors and fend off attacks. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). Retention: up to 30 days, unless investigating a security incident requires longer.

2.6. Statistics and advertising measurement (only with your consent)

Only if you agree in the cookie banner:

  • Google Analytics 4 (Google Ireland Ltd.): aggregated statistics on which pages are viewed and where visitors come from. Google Analytics 4 does not store full IP addresses. We keep the data for up to 14 months.
  • Google Ads conversion tracking (Google Ireland Ltd.): measures whether a visit that started from a Google ad led to an enquiry.
  • Meta Pixel (Meta Platforms Ireland Ltd.): measures the results of our Facebook and Instagram ads. We and Meta are joint controllers for collecting the data and transmitting it to Meta (Art. 26 GDPR); Meta is responsible for any further processing. In essence, under the joint controller agreement Meta handles data subject requests concerning the data it processes.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law no. 506/2004). You can withdraw your consent at any time with the “Cookie settings” button at the bottom of every page; withdrawal does not affect the lawfulness of processing before it.

2.7. Embedded videos and map (only with your consent)

We load YouTube videos (youtube-nocookie.com) and the Google Maps map on the contact page only if you accept the “External media” category or press the play button. Until then we show a placeholder and no data is sent to Google. Once loaded, Google Ireland Ltd. processes the data (for example your IP address and playback data) under its own responsibility.

2.8. Our social media pages

The website contains plain links to our Facebook, Instagram, Threads and YouTube pages, without plug-ins; data reaches these providers only if you click a link.

3. Who receives the data

Within our company, only the staff who need the data to answer you can see it. The following providers have access as processors, under written contracts: our hosting and IT service provider, our e-mail provider and our newsletter service (Mailchimp). With your consent, Google Ireland Ltd. and Meta Platforms Ireland Ltd. receive data as described in sections 2.6 and 2.7. We may also disclose data to authorities where the law requires it. We do not sell personal data.

4. Transfers outside the European Union

Google, Meta and Mailchimp (Intuit) may transfer data to the United States. These companies participate in the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission; where it does not apply, the European Commission’s standard contractual clauses are used.

5. Your rights

  • Access (Art. 15 GDPR): you can ask what data we hold about you and request a copy.
  • Rectification (Art. 16) and erasure (Art. 17).
  • Restriction of processing (Art. 18).
  • Data portability (Art. 20): you can receive the data you gave us in a machine-readable format.
  • Objection (Art. 21): you can object at any time to processing based on legitimate interest, and to the newsletter and advertising measurement without giving reasons.
  • Withdrawal of consent (Art. 7(3)): at any time, with effect for the future.

Send your request to office@fermatvending.com. We reply within one month; where justified, we may extend this by two further months and will tell you so (Art. 12(3) GDPR).

Complaints: you can lodge a complaint with the Romanian supervisory authority, Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), www.dataprotection.ro, with the EU supervisory authority where you live or work, or go to court. Please write to us first so that we can resolve the matter quickly.

6. Automated decision-making

We do not use automated decision-making or profiling that has legal effects on you.

7. Security

The website runs over an encrypted connection (HTTPS), the administration area requires two-factor authentication, session data is stored encrypted, and only authorised staff can access the data.

8. Changes to this policy

If our data processing changes, we will update this policy; the current version is always available on this page.