Privacy Policy

Version in force from 7 October 2026.

This policy explains what personal data we process when you visit attotrafic.ro, place an order, write to us or call us, why we process it, how long we keep it, to whom we disclose it and what rights you have, under Regulation (EU) 2016/679 (“GDPR”) and Law no. 190/2018.

1. Data controller

ATTO REGAL S.R.L. (“Atto Trafic”, “we”), with its registered office at Str. Alexandru Ioan Cuza nr. 1, Corp C2, Tunari village, Tunari commune, Ilfov County, postcode 077180, J23/657/2011, tax identification number (CUI) RO11228633.

For any question or request concerning personal data: office@attotrafic.ro, phone +40 (724) 322 232 / +40 (727) 759 805 (Monday – Friday, 08:00 – 17:00). We are not legally required to appoint a data protection officer; requests are handled directly by the company's management.

2. What data we process, for what purpose and on what legal basis

2.1. Orders, delivery, invoicing and payment

Data: first name and surname, e-mail, phone, delivery and billing address; for companies: company name, CUI, registration number, registered office address and contact person; the products ordered, the order value, the payment method and payment status, and any comments on the order.

Purpose: registering and processing the order, communicating about the order, delivery, invoicing, collecting payment and keeping accounting records.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal accounting and tax obligations (Art. 6(1)(c) GDPR). Without this data we cannot take the order.

For companies, we may automatically fill in the company name and address from the public database of the National Agency for Fiscal Administration (ANAF), based on the CUI entered.

Bank card details are entered exclusively on the secure page of NETOPIA Payments; we do not receive or store them. We receive only the confirmation and status of the payment.

2.2. Customer account (optional)

Data: e-mail, password (stored only in irreversibly encrypted form), saved delivery and billing details, order history.

Legal basis: performance of the contract, at your request (Art. 6(1)(b) GDPR). You can also order without an account.

2.3. Returns, warranties and complaints

Data: the data in the return form or in your message (name, e-mail, phone, order number, the reason for and description of the problem, photographs if you send them to us) and the IBAN account for the refund.

Legal basis: legal obligations relating to the right of withdrawal and the guarantee of conformity (Art. 6(1)(c) GDPR) and performance of the contract (Art. 6(1)(b) GDPR).

2.4. Messages, requests for quotations and phone calls

Data: name, e-mail, phone, company (if you state it), the content of the message or request for quotation and the product you are asking about.

Purpose: to reply to you and, where applicable, to send you the quotation requested. When we receive a message, we send you an automatic confirmation e-mail.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to requests (Art. 6(1)(f) GDPR).

2.5. Dropshipping partners

Data: company details, contact person, e-mail, phone, address, the partner account password (encrypted) and the orders submitted.

Legal basis: conclusion and performance of the cooperation contract (Art. 6(1)(b) GDPR).

2.6. Operation and security of the website

Data: IP address, date and time of access, the page accessed, the page you came from (referrer), browser and device type, recorded automatically in the server logs; the session cookie and the cookie that stores your cookie choice.

Purpose: displaying the website correctly, the shopping cart, logging in, preventing and investigating attacks or fraud.

Legal basis: our legitimate interest in providing a secure and functional website (Art. 6(1)(f) GDPR).

2.7. Order source (how you reached us)

To know which adverts and which channels bring us orders, when an order is placed we associate the order with the source of the visit: a Google or Meta advert (through the parameters in the advert link), a search engine, another website or direct access. The information is taken from the browsing session, from the server logs and, if you have accepted statistics and marketing cookies, from Google Analytics and Google Ads. The result is used only internally, for reports and for managing the advertising budget; it is not used to contact you and is not disclosed to anyone else.

Legal basis: our legitimate interest in measuring the effectiveness of advertising (Art. 6(1)(f) GDPR). You may object at any time by writing to us at office@attotrafic.ro.

If you have accepted marketing cookies, we also keep the source of the visit for 30 days in the atto_src cookie, in case you place an order on a later visit.

2.8. Statistics and advertising (only with your consent)

Only if you accept them in the cookie banner, we use:

• Google Analytics 4 (via Google Tag Manager) – statistics about how the website is used;
• Google Ads – measuring the conversions (orders, calls, requests) generated by our Google adverts;
• Meta Pixel – measuring and optimising our adverts on Facebook and Instagram.

Legal basis: your consent (Art. 6(1)(a) GDPR and art. 4(5) of Law no. 506/2004), which you can withdraw at any time using the round cookie settings button in the bottom left-hand corner of the page. Until you give your consent, these tools operate in the “consent denied” mode of Google and Meta. The full list of cookies is in the Cookie Policy.

For data collected through Meta Pixel, Atto Trafic and Meta Platforms Ireland Ltd. are joint controllers with regard to the collection and transmission of the data to Meta; further processing is carried out by Meta as an independent controller.

2.9. Commercial communications

We do not send newsletters and we do not send you unsolicited offers. If we introduce a newsletter, we will ask for your express consent in advance.

2.10. Defending our rights

We may use the data above to establish, exercise or defend a right before the courts or the authorities (Art. 6(1)(f) GDPR).

3. How long we keep the data

4. To whom we disclose the data

We disclose data only to the extent necessary for the purposes above, to:

• NETOPIA Payments (NETOPIA Financial Services S.A., Romania) – processing card payments;
• the courier companies we use for delivery (mainly Dragon Star Curier) – name, address, phone, parcel weight and, for cash on delivery, the amount to be collected;
• the provider of the invoicing software (neoSys) – the data needed to issue the invoice;
• Hetzner Online GmbH (Germany) – hosting of the server on which our website and e-mail run;
• Google Ireland Ltd. and Meta Platforms Ireland Ltd. – only for the statistics and advertising tools you have accepted (point 2.8);
• ANAF and other public authorities – reporting invoices in the RO e-Factura system and other legal obligations, as well as at their lawful request;
• advisers (accountants, lawyers), under conditions of confidentiality.

Providers that process data on our behalf are contractually required to protect it and to use it only in accordance with our instructions. We do not sell or rent personal data.

5. Transfers outside the European Economic Area

The data is stored on servers in the European Union (Germany). Google and Meta may transfer data to the United States of America; these transfers are made on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework and, where applicable, the standard contractual clauses approved by the Commission.

6. Automated decisions

We do not take decisions based solely on automated processing which produce legal effects concerning you or affect you in a similar way.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, the right to object (including to processing based on legitimate interest) and the right to withdraw your consent at any time, without affecting the processing carried out before the withdrawal. How to exercise these rights and how quickly we reply: see the Personal data processing (GDPR) page.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, postcode 010336, Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro.

8. Data security

The website uses an encrypted connection (HTTPS). Passwords are stored only in irreversibly encrypted form, access to data is limited to the people who need it for their work, and the server is protected and updated regularly. If we become aware of a security breach that may affect you, we will inform you and the authority, as required by law.

9. Minors

The website is intended for persons over 18 and for companies. We do not knowingly collect data about minors; if we find out that we have received such data, we delete it.

10. Changes

We may update this policy when the way we process data or the legislation changes. The version in force is published on this page, with its date.