1. Who We Are (Data Controller)

Stand Expo SRL is the Data Controller responsible for your personal data collected via this website.

Stand Expo SRL

CUI: RO14683132 | J2002004807401

20 Ramuri Tei Street, Sector 2, 020355 Bucharest, Romania

Phone: +40 726 247 393

Stand Expo has appointed a Data Protection Manager (DPM) responsible for overseeing GDPR compliance. The DPM can be contacted at the email address above.

2. Personal Data We Collect

2.1 Data You Provide Directly

We collect personal data that you voluntarily submit, including:

Name and contact details (email, phone, address) when you submit our contact form or design request form
Employment information if you submit a job application or CV
Communications and correspondence you send us

2.2 Data Collected Automatically

When you visit our website, we and our third-party service providers automatically collect certain technical information:

IP address
Browser type and version
Operating system
Pages visited and time spent on the site
Referrer URL
Date and time of access

This data is collected through server log files and, where consent is given, through Google Analytics and Google Ads cookies. Please refer to our Cookies Policy for full details.

2.3 Data From Third Parties

In the course of providing our services, we may receive personal data from clients, business partners, publicly available sources or recruitment agencies. If you provide us with data about a third party, you confirm you are entitled to do so and that we may process it in accordance with this policy.

Our website is not intended for children under 18. We do not knowingly collect data from minors.

3. How We Use Your Personal Data

We use personal data for the following purposes and legal bases:

Purpose	Examples	Legal Basis (GDPR Art. 6)
Responding to enquiries	Handling contact form submissions and follow-ups	Art. 6(1)(b) — contract / pre-contract; Art. 6(1)(f) — legitimate interest
Service delivery	Design, production and implementation of exhibition stands	Art. 6(1)(b) — performance of contract
Website analytics	Understanding visitor behaviour via Google Analytics (with consent)	Art. 6(1)(a) — consent
Advertising	Running Google Ads campaigns, conversion tracking, remarketing (with consent)	Art. 6(1)(a) — consent
Website security	Server logs, reCAPTCHA, spam prevention	Art. 6(1)(f) — legitimate interest
Marketing communications	Sending newsletters or promotional updates	Art. 6(1)(a) — consent (you may unsubscribe at any time)
Legal compliance	Tax, accounting, regulatory obligations	Art. 6(1)(c) — legal obligation
Recruitment	Processing job applications	Art. 6(1)(b) — pre-contractual steps

We do not sell or rent your personal data to third parties.

4. Third-Party Services and Data Processors

4.1 Google Analytics 4

We use Google Analytics 4 (Google LLC) to analyse website usage. Google Analytics collects data including IP addresses, pages visited, session duration and device information. This data is sent to Google servers in the United States.

Legal basis: Your explicit consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via our cookie banner.

4.2 Google Ads (Advertising)

We use Google Ads for online advertising, including conversion tracking and remarketing. When you interact with our ads or visit our site after clicking an ad, Google may set advertising cookies that track your activity to measure campaign performance and show you relevant ads on other Google partner sites.

Legal basis: Your explicit consent (Art. 6(1)(a) GDPR). These cookies are only activated after you accept the “Marketing” category in our cookie banner. You may opt out via the cookie banner or by visiting Google’s ad settings.

Ad privacy settings: https://adssettings.google.com

4.3 Cookiebot (Consent Management)

We use Cookiebot by Cybot A/S (Havnegade 39, 1058 Copenhagen, Denmark) to manage cookie consent. Cookiebot records your consent choices and presents the cookie banner. It processes your IP address and consent log data to provide its service.

4.4 Google reCAPTCHA

We use Google reCAPTCHA on our forms to prevent spam. reCAPTCHA processes IP addresses, mouse movements and browsing behaviour. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in protecting our site from abuse.

4.5 Crisp (Live Chat)

We use Crisp live chat, provided by Crisp IM SAS (2 Rue Paul Louis Courier, 75007 Paris, France). When you open and use the chat widget, Crisp collects and processes the following data:

Your name and email address, if you voluntarily provide them in the chat
The content of your chat messages
Your IP address (stored server-side, linked to your session)
Timestamps and basic device/browser information

All Crisp data is stored exclusively on EU servers (messaging data in the Netherlands, plugin data in Germany). No data is transferred outside the European Union.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in providing customer support. If you provide your email address via the chat for follow-up communication, processing of that email for marketing purposes would require your separate consent.

Data retention: If you do not send a message, your session and IP are deleted automatically 30 minutes after your last page access. If a chat conversation takes place, your IP address is retained for a minimum of 1 year as required by French law. Chat message content is retained until you or Stand Expo deletes the conversation.

We have signed a Data Processing Agreement (DPA) with Crisp IM SAS as required under Art. 28 GDPR.

Crisp’s privacy policy: https://crisp.chat/en/privacy/

4.6 Website Hosting

Our website is hosted by a third-party provider. Server log data (IP addresses, access times, browser information) is retained for security and maintenance purposes for a maximum of 30 days.

5. International Transfers of Personal Data

Some of our third-party service providers (principally Google LLC) are located in the United States, which is outside the European Economic Area (EEA). Where personal data is transferred to third countries, we ensure adequate protection is in place through one or more of the following mechanisms:

Standard Contractual Clauses (SCCs) approved by the European Commission
The EU–US Data Privacy Framework (for Google LLC, which is certified under this framework)

You can request a copy of the applicable transfer mechanisms by contacting us at office@standexpo.ro.

6. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law. General retention periods:

Data Type	Retention Period
Contact form submissions	Until the enquiry is resolved + 3 years
Contract-related data	10 years (Romanian legal requirements)
Server log files	Maximum 30 days
Cookie consent records (Cookiebot)	1 year
Analytics data (Google Analytics)	As per your GA4 retention settings (default 14 months)
Advertising data (Google Ads)	As per Google’s data retention policies
Chat session data — no conversation started (Crisp)	Deleted automatically 30 minutes after last page access
Chat conversation data (Crisp)	Until deleted by you or Stand Expo; IP retained minimum 1 year (French legal requirement)
Job applications (unsuccessful)	6 months after decision, unless you consent to longer

7. Your Rights Under GDPR

As a data subject, you have the following rights:

Right of access — to request a copy of the personal data we hold about you
Right to rectification — to request correction of inaccurate or incomplete data
Right to erasure (“right to be forgotten”) — to request deletion of your data where there is no overriding legal basis for retention
Right to restriction — to request that we limit processing in certain circumstances
Right to data portability — to receive your data in a structured, machine-readable format
Right to object — to object to processing based on legitimate interest or for direct marketing
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at office@standexpo.ro. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

8. Contact Form

When you submit our contact form, we collect your name, email address, and message content to respond to your enquiry. This data is processed under Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (legitimate interest in responding to business enquiries). Data is retained until your request is resolved and for up to 3 years thereafter.

You may request deletion of your contact data at any time by writing to office@standexpo.ro.

9. Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration or disclosure. These include secure server configurations, access controls and data encryption in transit (HTTPS).

When we engage third-party processors, we require them to implement equivalent security measures and to process data only on our documented instructions.

Despite these measures, no online transmission or storage system is 100% secure. You transmit data to us at your own risk. If you become aware of a security concern, please contact us immediately.

10. Links to Third-Party Websites

Our website may contain links to external websites operated by third parties. These sites have their own privacy policies, which are independent from ours. We are not responsible for their content or practices. Please review each site’s policy before submitting any personal information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date is 12 March 2026. Material changes will be notified prominently on our website. Your continued use of the website after changes are posted constitutes your acceptance of those changes.

12. How to Make a Complaint

If you have concerns about how we process your personal data, please contact our Data Protection Manager at office@standexpo.ro in the first instance. We will endeavour to resolve your concern promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with the competent supervisory authority. As a Romanian company, our lead supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania

Phone: +40 318 059 211

Website: www.dataprotection.ro

13. Contact

For all data protection enquiries, please contact:

Stand Expo SRL — Data Protection Manager