This Data Protection Policy describes how Suran Recycling collects, uses, stores, and protects personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation — GDPR) and applicable Romanian data protection legislation.
1. Who We Are
Suran Recycling INTEGRAL BUSINESS CENTER, B-dul Pipera nr. 1-IA, Corp A, et. 7 Voluntari, Ilfov, Romania Phone: +40 768 724 055 Email: office@suranrecycling.com Website: www.suranrecycling.com
Suran Recycling is the data controller for personal data collected through this website and through our business operations.
2. What Personal Data We Collect
We may collect and process the following categories of personal data:
Through our website:
- Name and job title
- Company name and country
- Business email address and phone number
- Inquiry details submitted via the contact form
- Technical data collected automatically (IP address in anonymised form, browser type, pages visited, date and time of access)
Through our business operations:
- Contact details of corporate representatives (name, job title, business email, phone number)
- Company and transaction information relevant to precious metal purchase, toll refining, or service agreements
- Documentation required for regulatory compliance, including waste management and anti-money laundering obligations
We do not collect special categories of personal data (such as health data, political opinions, or biometric data) through our website or standard business operations.
3. Why We Collect Personal Data and the Legal Basis
We process personal data for the following purposes and on the following legal bases:
Responding to inquiries: Processing is necessary to respond to inquiries submitted via our contact form or by email. Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest in conducting our business).
Performance of a contract: Where personal data is processed in the context of a purchase agreement, toll refining contract, or other service arrangement, processing is necessary for the performance of that contract. Legal basis: Art. 6(1)(b) GDPR.
Compliance with legal obligations: We are required to retain certain records under Romanian and EU commercial, tax, waste management, and anti-money laundering legislation. Legal basis: Art. 6(1)(c) GDPR.
Website analytics: We use Google Analytics to analyse how our website is used, with IP anonymisation enabled. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our website).
Legitimate business interests: We may process personal data where necessary to protect our company from material or reputational damage, to improve our services, or to meet statutory compliance requirements. Legal basis: Art. 6(1)(f) GDPR.
4. How Long We Retain Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law:
- Contact form inquiries: Retained until the inquiry has been fully addressed and no further communication is expected, unless a contractual relationship follows.
- Contractual data: Retained for the duration of the contractual relationship and for the applicable statutory limitation period thereafter (generally 3 years under Romanian civil law, or longer where specific legislation requires it).
- Accounting and tax records: Retained for 10 years as required by Romanian fiscal legislation.
- Waste management records: Retained in accordance with applicable environmental and waste legislation.
- Website log files: Retained for a maximum of 30 days for security purposes, then deleted.
When personal data is no longer required, it is securely deleted or anonymised.
5. Who We Share Personal Data With
We do not sell personal data to third parties. We may share personal data in the following circumstances:
Service providers: We work with third-party providers who process data on our behalf — for example, IT hosting, website analytics (Google Analytics), and email services. These providers are bound by data processing agreements and are required to process data only on our instructions and in accordance with GDPR.
Certified refinery partners: Where required for the execution of a toll refining or purchase arrangement, relevant transaction data may be shared with our certified refinery partners. This sharing is limited to what is strictly necessary for the performance of the service.
Legal obligations: We may disclose personal data to competent authorities where required by applicable law — including tax authorities, waste management regulators, or anti-money laundering authorities.
International transfers: Where personal data is transferred outside the European Economic Area (for example, to Google servers in the context of analytics), such transfers are made on the basis of appropriate safeguards in accordance with Chapter V of the GDPR.
6. How We Protect Personal Data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
- Access controls limiting personal data to authorised personnel only
- Encrypted transmission of data via our website (HTTPS)
- Regular review of our data protection practices
- Staff awareness of data protection obligations
We are certified to ISO 27001 — Information Security Management, which provides a structured framework for managing information security risks.
7. Your Rights as a Data Subject
Under the GDPR, you have the following rights with respect to your personal data:
- Right of access (Art. 15 GDPR) — you may request confirmation of whether we process personal data about you and, if so, access to that data.
- Right to rectification (Art. 16 GDPR) — you may request correction of inaccurate personal data.
- Right to erasure (Art. 17 GDPR) — you may request deletion of your personal data where the conditions set out in Art. 17 are met.
- Right to restriction of processing (Art. 18 GDPR) — you may request that we restrict the processing of your personal data in certain circumstances.
- Right to data portability (Art. 20 GDPR) — you may request that personal data you have provided to us be transmitted to you or to another controller in a structured, commonly used format.
- Right to object (Art. 21 GDPR) — you may object to processing based on our legitimate interests at any time on grounds relating to your particular situation.
- Right to withdraw consent — where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at office@suranrecycling.com. We will respond within one month of receiving your request. We may ask you to verify your identity before processing your request.
8. Right to Lodge a Complaint
If you believe that our processing of your personal data does not comply with the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) Blvd. G-ral. Gheorghe Magheru nr. 28-30, Sector 1, 010336 București Phone: +40 318 059 211 Email: anspdcp@dataprotection.ro Website: www.dataprotection.ro
You also have the right to seek judicial remedy before a competent court if you consider that your rights under the GDPR have been violated.
9. Changes to This Policy
We may update this Data Protection Policy from time to time to reflect changes in our practices or in applicable legislation. The current version is always available on this page.
Last updated: April 2026
