Privacy Policy

In Short

· We use personal data only for well-defined purposes: offers, contracts, delivery, service and warranty, invoicing, security, and compliance with legal obligations.

· We do not sell your data and we do not make it available to third parties for advertising purposes.

· Data is shared only with strictly necessary partners and suppliers bound by confidentiality agreements, as well as with authorities when required by law.

· You can exercise your rights at any time regarding access, rectification, erasure, objection, restriction, and data portability, and you may withdraw your consent for marketing and non-essential cookies.

For any questions, you can contact us at office@genereko.com.

Who we are
Scope and data subjects
Principles of processing
Data we process
Purposes, legal bases, and retention periods
Specific processing situations
To whom we disclose data
Transfers outside the EEA
Data security
Automated decision-making and profiling
Your rights
How to exercise your rights
Right to lodge a complaint
Cookies
Minors
Links to other websites
Changes to this policy
Contact

1. Who We Are

GENEREKO POWER SYSTEMS S.R.L. (“GENEREKO” or “we”) provides generator sets, portable and mobile generators, lighting towers, alternators, and related energy solutions, complemented by service, spare parts, and technical consultancy. The protection of personal data belonging to our customers and partners is an integral part of how we conduct our business. As a controller within the meaning of Regulation (EU) 2016/679 (“GDPR”), we determine the purposes and means of the processing activities described in this policy. Our identification details are as follows:

Name: GENEREKO POWER SYSTEMS S.R.L.
Sole Registration Code (CUI): RO 44925521
Trade Register Number: J23/5745/2021
Registered Address: Oraș Voluntari, Șos. Pipera-Tunari, Nr. 200A, Corp C, Etaj 1, Ap. 5, jud. Ilfov, Romania
Data Protection E-mail: office@genereko.com
Phone: +40 774 099 089; +40 720 412 522
Websites: https://genereko.ro and https://genereko.com

2. Scope and Data Subjects

This policy describes how we process personal data, both online and offline, in relation to our website, commercial activity, and service and warranty services. It targets the following categories of individuals:

visitors to our website;
persons requesting offers or information regarding our products and services;
representatives and contact persons of our customers, partners, distributors, and suppliers;
individual persons who are direct customers;
persons interacting with our social media pages;
job candidates for open positions.

For processing activities that fall outside the scope of this policy, such as the processing of our own employees’ data, we provide separate privacy notices.

3. Principles of Processing

Our processing operations adhere to the principles established by Article 5 of the GDPR. Specifically, we process data lawfully, fairly, and in a transparent manner, only for specified and legitimate purposes. We collect only the data we genuinely need and take reasonable measures to ensure it is accurate and kept up to date. We retain data only for as long as necessary, protect it through appropriate security measures, and take responsibility for compliance with these principles.

4. Data We Process

Depending on how you interact with us, we may process the following categories of data:

Identification and contact data: first and last name, company name, job title, email address, phone number, address.
Data from requests and correspondence: content of messages, contact and quote forms, and correspondence exchanged with us.
Commercial and contractual data: offers, orders, contracts, invoices, payment history, data regarding purchased or serviced equipment (model, serial number, intervention history, warranty).
Billing and payment data: data necessary for issuing invoices and collecting payments. We do not store complete bank card details. We request the personal identification number (CNP) or identity document details only when required by law, the legal basis for processing in this case being the legal obligation (Article 6(1)(c) of the GDPR), in compliance with Law No. 190/2018.
Technical data: IP address, browser and device type, pages accessed, date and time of access, cookie identifiers, and usage statistics collected via Google Analytics.
Data from social media interactions: profile name, messages, comments, and reactions to our posts, as well as aggregated statistics provided by platforms.
Recruitment data: information contained in your CV and cover letter.

Most of the data is provided directly by you. Some may come from the company you represent, public sources such as the trade register, or our partners. We do not request special categories of data, such as health data, and we ask that you do not send us such information.

The data required for quotes, contracting, invoicing, and service is essential for us to respond to you and deliver the requested products or services. Without this data, we may be unable to process your request.

5. Purposes, Legal Bases, and Retention Periods

The following table presents, for each purpose, the categories of data, the legal basis, and the retention period:

Processing Purpose	Data Categories	Legal Basis (GDPR)	Retention Period
Responding to requests and preparing offers	Identification and contact data; request content	Art. 6(1)(b) – steps at the request of the data subject prior to entering into a contract; Art. 6(1)(f) – legitimate interest to respond to commercial requests	12 months from the last interaction, if no contract is concluded
Conclusion and execution of contracts (sales, delivery, commissioning, service, warranty)	Identification and contact data; commercial data; equipment data	Art. 6(1)(b) – performance of a contract	For the duration of the contract and subsequently for the duration of warranty and limitation periods
Invoicing, accounting, taxation, and archiving	Identification data; commercial and billing data	Art. 6(1)(c) – legal obligations	According to applicable legislation (accounting documents are generally kept between 5 and 10 years)
Marketing communications (newsletter, offers)	Name, email, preferences	Art. 6(1)(a) – consent, pursuant to Law No. 506/2004; existing customers may be sent offers for similar products or services, with the option to unsubscribe free of charge in every message	Until consent is withdrawn
Cookies and website traffic analytics (Google Analytics)	Technical data (IP address, browser, device, pages accessed)	Art. 6(1)(a) – consent for non-essential cookies; Art. 6(1)(f) for strictly necessary ones	According to the Cookie Policy
Website and systems security, fraud prevention	Technical data, access logs	Art. 6(1)(f) – legitimate interest to ensure security	12 months
Establishment, exercise, or defense of legal claims	Necessary data, as applicable	Art. 6(1)(f) – legitimate interest	Until final settlement of the dispute and during the applicable limitation periods
Recruitment	Data from CV and cover letter	Art. 6(1)(b) and, for record keeping, Art. 6(1)(a) – consent	6 months from submission, if no contract is concluded
Compliance with legal requests from authorities	Requested data, as applicable	Art. 6(1)(c) – legal obligations	According to legal requirements

Upon reaching these deadlines, the data is securely erased or anonymized, except in situations where the law requires its retention for a longer period.

6. Specific Processing Situations

Contact and Quote Forms. The data submitted through forms is used exclusively to respond to you and, where applicable, to prepare a quote and continue commercial discussions.
Phone and Messaging Communication. We do not record phone conversations. For client communication, we also use messaging applications such as WhatsApp Business, installed on company phones. The phone number, profile name, and message content are used solely to respond to you and manage your request, based on pre-contractual steps or the contract (Article 6(1)(b) of the GDPR) or our legitimate interest in communicating efficiently with clients (point f). The application provider, WhatsApp Ireland Limited, also processes data according to its own privacy policy. If you prefer another communication channel, you can contact us by email or phone.
Social Media. We manage our own pages on social networks. When you write to us or interact with our posts, we use the data to respond to you and manage the community, based on our legitimate interest (Article 6(1)(f) of the GDPR). For page insights provided by the platforms, we may act as joint controllers together with them, within the meaning of Article 26 of the GDPR. Upon request, we will inform you of the essential terms of the joint controller agreement concluded with the platform, pursuant to Article 26(2) of the GDPR. Processing carried out by the platforms is also governed by their own privacy policies.
Representatives of Customers, Partners, and Suppliers. We process the contact details of individuals designated by the companies we collaborate with for the purpose of managing the commercial relationship. If your data was provided to us by the company you represent, this policy constitutes the notice provided under Article 14 of the GDPR.

7. To Whom We Disclose Data

Personal data is disclosed only to the extent necessary to achieve the above purposes, to the following categories of recipients:

service providers acting on our behalf as processors (e., website hosting and maintenance, IT services, email and cloud storage, accounting services), based on contracts complying with Article 28 of the GDPR;
partners involved in delivery, commissioning, service, and warranty (carriers, equipment manufacturers and suppliers, service centers), to the extent necessary for the performance of the contract;
banks and payment institutions, for collections and payments;
legal, tax consultants, and auditors, subject to a duty of confidentiality;
public authorities (e.g., ANAF, courts, law enforcement bodies), when required by law;
Google, as provider of the Google Analytics service, only with your consent for analytics cookies;
social media platforms where we hold pages, in connection with your interactions with them;
messaging application providers (e.g., WhatsApp), when you choose to communicate with us through these channels.

We do not sell personal data and do not make it available to third parties for targeted advertising purposes. In the event of a reorganization or business transfer, data may be transferred to a successor, subject to legal guarantees.

8. Transfers Outside the EEA

We aim to process data within the European Economic Area (EEA). If one of our providers processes data outside the EEA (for example, Google for the Google Analytics service, or Meta for WhatsApp and social networks), the transfer is carried out only with the guarantees provided by the GDPR: an adequacy decision by the European Commission (including, for certified entities, the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission, supplemented, where necessary, with additional measures. You may request information regarding the applied safeguards by writing to office@genereko.com.

9. Data Security

We protect data through technical and organizational measures proportionate to the risks, against unauthorized destruction, loss, alteration, access, or disclosure. These include: restricted access to personal data on a need-to-know basis; password-protected accounts; secure connection (HTTPS); backups; confidentiality obligations for our personnel and partners; evaluation of providers processing data on our behalf. We have an internal procedure in place for managing security incidents and we keep a record of them. In the event of an incident affecting personal data, we notify the ANSPDCP within 72 hours when required by law, and inform the affected individuals pursuant to Articles 33 and 34 of the GDPR.

10. Automated Decision-Making and Profiling

We do not make decisions that produce legal effects concerning you or similarly affect you, based solely on automated processing, including profiling. Traffic analysis tools may generate aggregated statistics regarding website usage, subject to the conditions of the Cookie Policy.

11. Your Rights

Under the terms of the GDPR, you have the following rights:

Right of access (Article 15) – to learn whether we process data concerning you and to obtain a copy thereof;
Right to rectification (Article 16) – to request the correction of inaccurate data or the completion of incomplete data;
Right to erasure (Article 17) – to request the erasure of your data when legal conditions are met;
Right to restriction of processing (Article 18);
Right to data portability (Article 20) – for data provided by you and processed by automated means based on consent or a contract;
Right to object (Article 21) – to object to processing based on our legitimate interest, as well as at any time to processing for direct marketing purposes;
Right to withdraw consent (Article 7(3)) – at any time, without affecting the lawfulness of processing carried out prior to its withdrawal;
Right not to be subject to a decision based solely on automated processing (Article 22).

12. How to Exercise Your Rights

Requests can be sent to office@genereko.com or by post to our registered office address, indicating your name, the right being exercised, and the information necessary to identify the request. We may ask for additional information to verify your identity to avoid disclosing data to an unauthorized person. We will respond within one month of receiving the request at the latest; this period may be extended by up to two months in the case of complex or numerous requests, in which case we will inform you. Exercising your rights is, in principle, free of charge; for manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse the request, as permitted by law. To unsubscribe from marketing communications, you can also use the unsubscribe link provided in the messages.

13. Right to Lodge a Complaint

If you consider that the processing of your personal data infringes applicable legislation, you have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28–30, Sector 1, postal code 010336, Bucharest, phone +40 318 059 211, www.dataprotection.ro, email anspdcp@dataprotection.ro, as well as to address the competent courts of law. We encourage you to contact us first so that we can attempt to resolve the situation amicably.

14. Cookies

The website uses cookies and similar technologies, including Google Analytics cookies, which are placed only with your consent given through the cookie banner. We use Google Analytics exclusively for website usage statistics, not for remarketing or ad personalization, and Analytics data is retained for 2 months. Details regarding the types of cookies, their purposes, and how you can manage or disable them can be found in the Cookie Policy: https://genereko.ro/cookie-policy/.

15. Minors

Our website and services are not directed to individuals under the age of 16, and we do not knowingly collect personal data from them. If we learn that we have received such data, we will delete it without delay.

16. Links to Other Websites

Our website may contain links to third-party websites. We do not control and are not responsible for their privacy policies; we recommend that you read them.

17. Changes to This Policy

This policy is reviewed periodically to reflect changes in legislation and our activities. The version in force is the one published on the website, and the date of entry into force is indicated at the beginning. We will inform you of substantial changes by appropriate means. The policy may also be made available in English; in case of any discrepancy, the Romanian version shall prevail.

18. Contact

For any questions regarding this policy or how we process your data, our team is available at:

Email: office@genereko.com
Post: GENEREKO POWER SYSTEMS S.L., Oraș Voluntari, Șos. Pipera-Tunari, Nr. 200A, Corp C, Etaj 1, Ap. 5, jud. Ilfov
Phone: +40 774 099 089; +40 720 412 522