This policy describes how BOS FOREST S.R.L. processes personal data in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) and applicable Romanian law, including Law no. 190/2018.
In short: we only use your data to answer your requests and to carry out the transport services agreed with you. We do not sell it or use it for advertising, and this website uses no cookies or analytics tools.
1. Who we are
The controller of your personal data is:
- BOS FOREST S.R.L.
- Registered office: Str. Principală nr. 64, sat Soci, com. Borca, Neamț County, Romania
- Tax ID (CUI): 15329339; Trade Register no.: J27/467/31.03.2003
- Email: bosforestsrl@gmail.com
- Phone: +40 761 411 441
We have not appointed a Data Protection Officer (DPO), as our activities do not require one under Article 37 GDPR. For any question about your data, please email us at the address above.
2. What personal data we process
2.1. When you contact us by phone or email
We process the data you send us: your name, company and position, phone number, email address and the content of the communication, including the details of the shipment requested (for example loading and unloading places, type of goods, preferred dates).
2.2. When we work together
To conclude and perform transport contracts we process the contact details of the people designated by our clients and partners, as well as the data appearing in transport documents (including the CMR consignment note) and accounting documents (for example names, signatures, phone numbers, vehicle registration numbers).
2.3. When you visit the website
This website has no forms and uses no cookies, analytics tools, tracking pixels or embedded third-party content (maps, videos, social media). Fonts and images are hosted on the same server as the website. Like any web server, our hosting provider’s server may automatically record technical logs containing data such as your IP address, the date and time of access, the page requested and your browser type. This data is needed to deliver the pages and keep the website secure, and is not used to identify or profile you.
3. Why we process data and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering requests received by phone or email and sending price quotes | Art. 6(1)(b) – steps taken at your request before entering into a contract; Art. 6(1)(f) – our legitimate interest in replying to the messages we receive |
| Concluding and performing transport contracts | Art. 6(1)(b) – performance of a contract; Art. 6(1)(f) – for contact persons of clients and partners |
| Meeting legal obligations (accounting, tax, transport documents) | Art. 6(1)(c) – legal obligation |
| Operating and securing the website (technical server logs) | Art. 6(1)(f) – our legitimate interest in running the website securely |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) – legitimate interest |
We do not use your data for direct marketing, we do not make decisions based solely on automated processing and we do not create profiles.
4. How long we keep data
- Correspondence and offers not followed by a contract: no longer than 1 year after the last contact.
- Data in contracts, transport documents and accounting records: for the duration of the contract and afterwards for the periods required by accounting and tax law (currently, as a rule, 5 years for supporting documents and 10 years for accounting registers).
- Technical server logs: for the short period set by the hosting provider, strictly as needed to run and secure the website.
When these periods expire, the data is deleted or anonymised.
5. Who we share data with
We do not sell or rent your data. We may share it, only to the extent necessary, with:
- our website hosting provider (Google Firebase Hosting) and our email service provider (Gmail, provided by Google);
- the firm or person who keeps our accounts;
- partners involved in carrying out a shipment (shippers, consignees, loading and unloading sites, any subcontracted carriers);
- insurers, in the event of incidents covered by insurance;
- legal advisers, courts and public authorities, where required by law or to defend our rights.
Providers that process data on our behalf do so under a contract, only on our instructions and with appropriate security measures.
6. Transfers outside the European Economic Area
Some of our IT service providers, in particular Google (website hosting and email), may process data outside the European Economic Area (EEA), including in the United States. In that case the transfer only takes place with the safeguards required by the GDPR: a European Commission adequacy decision (for example the EU-U.S. Data Privacy Framework) or standard contractual clauses approved by the Commission (Articles 45 – 46 GDPR).
7. Your rights
Regarding your personal data, you have the following rights:
- right of access – to find out whether we process data about you and receive a copy (Art. 15);
- right to rectification – to have inaccurate data corrected or incomplete data completed (Art. 16);
- right to erasure – to have your data deleted, under the conditions set by law (Art. 17);
- right to restriction of processing (Art. 18);
- right to data portability – to receive your data in a structured format or have it sent to another controller (Art. 20);
- right to object – to processing based on our legitimate interest (Art. 21);
- right not to be subject to a decision based solely on automated processing (Art. 22).
To exercise your rights, write to us at bosforestsrl@gmail.com. We will reply without undue delay and within one month of receiving your request. This period may be extended by two further months for complex or numerous requests, in which case we will let you know. Exercising your rights is free of charge. We may ask for additional information to confirm your identity.
8. Right to lodge a complaint
If you believe we process your data unlawfully, please contact us first so we can clarify the situation. You always have the right to lodge a complaint with the supervisory authority:
National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru nr. 28 – 30, Sector 1, postal code 010336, Bucharest, Romania
Email: anspdcp@dataprotection.ro
Web: www.dataprotection.ro
You may also lodge a complaint with the supervisory authority of the EU member state where you live, work or where the alleged infringement took place.
9. Cookies
This website uses no cookies or other browser storage technologies (such as local storage) to track you or remember your preferences. That is why we do not show a cookie banner. See our Cookie Policy for details.
10. How we protect data
We use appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction: an encrypted connection (HTTPS) for the website, access to data limited to the people who need it, and protected passwords and accounts.
11. Changes to this policy
We may update this policy when the way we process data or the law changes. The version in force is always the one published on this page, with the date of the last update shown above.
See also our Cookie Policy and our Terms & Conditions for using the website.