Privacy Policy

1. Controllers and contact

VILON CROMER S.R.L. (tax ID 37907760, registration J2017001014156) and TOKAIDO CONSULT S.R.L. (tax ID 41110671, registration J15/970/2019) jointly determine processing for the administration of this portal and management of enquiries, acting as joint controllers. VILON CROMER S.R.L.: Str. Tineretului no. 1, Aninoasa, Dâmbovița County, Romania. TOKAIDO CONSULT S.R.L.: Str. Pandurilor no. 8, Târgoviște, Dâmbovița County, Romania.

You may contact either controller at contact@vilonmedia.ro or contact@tokaido.ro for information or to exercise your rights. Both companies are responsible for jointly determined processing and must coordinate responses to requests. The company identified in the agreement manages the contractual relationship and its invoicing obligations; joint portal and CRM administration does not limit your rights against either controller.

2. Information and sources

We receive information entered in forms or sent by email: name, telephone, email, county, locality, subject, message and choices about contact or newsletters. Subscriptions also involve representative, business, contractual, invoicing and access-period information.

Presentations may include professional names, contact details, logos, wording, photographs and location provided by customers. Some professional information may come from a business’s public pages or public registers; where it contains personal data we assess the legal basis, necessity and Article 14 GDPR information duties. A public source does not mean unrestricted permission to reuse information.

Systems may process IP addresses, timestamps, browser information, technical logs, cookie choices and, depending on the feature used, authentication data or QR scanning statistics. Do not publish information about guests or children or submit sensitive categories of information without a justified need and an appropriate legal basis.

A customer supplying or designating materials showing identifiable people must verify image rights, the legal basis for processing and necessary permissions, including those relating to minors where applicable. A photographer’s permission and the GDPR legal basis are separate matters. VilonMedia processes the materials, approvals and evidence strictly necessary for the agreed publication, handling notices and defending rights, under the legal bases and retention criteria described in this policy. The customer’s declaration is not the consent of people photographed and does not remove their rights or the controllers’ legal obligations.

3. Purposes and legal bases

• Answering enquiries and preparing offers: steps requested before a contract under Article 6(1)(b) where the individual is a party; for business representatives and professional correspondence, the legitimate interest in responding and managing the relationship under Article 6(1)(f).
• Subscriptions, CV access and agreed services: performance of a contract where the individual is a party, and legitimate interests for relationships with representatives; invoicing and mandatory records: legal obligations under Article 6(1)(c).
• Disclosing a service enquiry to a relevant business: separate optional consent under Article 6(1)(a), within the enquiry’s scope and with information about the recipient or relevant category. This does not authorise that business’s marketing.
• Security, preventing abuse, correcting errors and defending rights: legitimate interests, subject to necessity and impact assessment; requests from authorities: legal obligations where applicable.
• Newsletters and statistics requiring permission: separate, specific and withdrawable consent under Article 6(1)(a), together with Romanian Law 506/2004 requirements. Refusing marketing does not prevent a response or subscription.

4. Recipients

Access is limited to authorised personnel of the two companies and providers involved in hosting, technical administration, CRM, email, invoicing, accounting or other necessary services. Depending on the operation, these parties act as processors or controllers with their own obligations; the relationships must be documented appropriately.

For service enquiries, the name, telephone, email, locality and message may be passed to a business relevant to the request, including a nearby area where indicated. Promotion quotations, complaints and GDPR requests are not placed into partners’ marketing workflows.

For contracted facilities, the necessary business information and materials are used in cv.vilonmedia.ro; information required for checks and a certificate may be processed in the certificatincredere.ro register and on the certificate’s public page under its conditions. Public records do not unnecessarily include private personal information.

5. Google, external content and transfers

Forms use Google reCAPTCHA to prevent abuse. Pages may use Google Analytics and external content such as maps or social modules. These services may receive technical information including IP addresses, browser details and feature usage. Access to an external service is also subject to its privacy information.

Some services, including Google services, may involve processing outside the European Economic Area. A transfer must rely on an applicable Chapter V GDPR mechanism and necessary assessments, not on mere acceptance of this policy. You may ask the controllers for details of recipients, countries and applicable safeguards. See also Google’s privacy information: https://policies.google.com/privacy.

6. Cookies and choices

Necessary cookies support operation and security. For non-essential statistics we request your choice through the preferences mechanism. You may return to “Cookie preferences” to change your choice. Cookie choices are separate from requesting a response and choosing a newsletter.

Some pages include maps or social modules which may communicate technical information to their external provider when loaded. Activation must satisfy Law 506/2004 requirements for the relevant purposes. You may request information or submit an enquiry directly by email if you prefer not to use the reCAPTCHA form. Browser settings may restrict cookies but do not automatically prevent all communication with external services.

7. Retention

Retention depends on the purpose and applicable obligations: enquiries and correspondence for as long as needed to resolve and follow up the relationship; account and service information as required for the agreement; accounting records for the statutory period; complaint or dispute information as necessary to protect rights. One period is not automatically applied to every category.

Marketing lists are used until withdrawal or a justified end of purpose; a minimal record of an objection may be retained to respect the choice. Technical logs and backups must have limited cycles separate from contractual archives. Criteria include the relationship’s duration, the need to document a response, limitation periods and legal obligations. When purposes and applicable periods end, deletion or anonymisation is required; you may ask the controllers for the category and period applicable to your information.

8. Your rights

Under the GDPR conditions, you may request access, a copy, rectification, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests. You may object to direct marketing at any time without giving a reason. Consent may be withdrawn for the future without affecting earlier lawful processing.

We respond without undue delay and, in principle, within one calendar month of receiving a request. Where the law permits an extension, we inform you within the first month of the reasons and additional period, which may be up to two further months. Only proportionate information may be requested to verify identity.

You may complain to ANSPDCP at www.dataprotection.ro or the competent supervisory authority and seek judicial remedies. Completing an internal process first is not mandatory and accepting marketing is not a condition of exercising your rights.

9. Automation and required information

The CRM may organise enquiries, suggest a relevant partner and send operational replies. The site-check report is automated and indicative, and its findings can be discussed with a person. In the reviewed workflows we have not identified solely automated decisions producing legal or similarly significant effects on individuals; any such feature would need separate information and assessment.

Required fields are indicated in the interface; without necessary information it may not be possible to handle a request through that form. Newsletters are optional. Complaints and data-rights requests may also be sent by email; unrelated commercial information is not required.

10. Security and limitations

We apply technical and organisational measures proportionate to risk, including access restrictions and protection of transmission. Internet transmission cannot be described as absolutely secure. Incidents are assessed and notified to the authority and affected people where legally required.

Do not use the form for passwords, complete copies of identity documents or sensitive information about other people. For materials showing identifiable people, image-use rights and the legal basis for processing must be established before publication.

11. Versions and other services

We update this notice when processing changes and identify its version. A significant change of purpose or recipients requires appropriate information and, where necessary, fresh permission before the new operation. Publishing a policy does not retrospectively authorise processing lacking a legal basis.

This policy concerns the portal and its forms. CV services, the certificate register and the site-check tool may provide separate notices for their features. The English version is intended to convey the same information as the Romanian version.