Privacy policy

1. Who processes the data

The controller is MOBILA FLAT STUDIO SRL, CUI 27576510, Trade Register No. J22/1413/2010, registered office mun. Iași, str. Mușatini 53, bl. P1, sc. A, ap. 4, cod 700599, România, which sells Flat Studio (flät) furniture in Romania. Warehouse and pickup point: Depozit Iași, loc. Tomești, str. Victoriei 4, jud. Iași.

The furniture is made in the Chișinău factory, Republic of Moldova, of our partner company S.R.L. „BosmoImpex”. So part of the team that answers you and prepares your order works in Chișinău; see “Transfers outside the European Union” below.

For any question about your data, write to office@rabatabil.ro, call +40 747 202 000 or visit the warehouse. We have not appointed a data protection officer, as the GDPR does not require one of us; the company’s management handles these questions directly.

2. What we process, why, and on what basis

Projects saved in the configurator hold only the configuration (model, size, decors, cabinets) and a code — no name or phone. They are linked to you only if you send the project with a request; we delete them on request.

Name and phone are needed so we can call you: a request cannot be sent without them. The other fields are optional. We do not ask for your personal numeric code (CNP) or a copy of your identity card.

We do not use the data from requests and orders (name, phone, address) for advertising, sell it, pass it to other companies for marketing, or send it to Google or Meta. We make no automated decisions about you.

Statistics and marketing cookies are optional: the site works the same without them. If you accept marketing cookies, Meta may use your visit to show you our ads on Facebook and Instagram and tell us how well they do. For the Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR) for collecting the data on the site and passing it to Meta; what Meta does with it afterwards Meta decides, under its own privacy policy.

3. Who can access the data

• Our staff who handle your request or order (managers, the delivery and installation team), each with a personal account and only as far as needed.
• S.R.L. „BosmoImpex” (Chișinău, Republic of Moldova) — the furniture’s manufacturer; its managers may take up your request, prepare the quote and make the order, under an agreement with us.
• The contractor who builds and runs our site and platform, under a data processing agreement.
• Vercel Inc. (USA) — hosts the site; the servers that receive the forms run in Frankfurt, Germany (EU).
• Railway Corporation (USA) — hosts the platform and the database where requests are kept; servers in the Netherlands (EU).
• Our e-mail service provider, for messages sent to office@rabatabil.ro.
• Postmark (ActiveCampaign, LLC, USA) — sending the platform’s automatic e-mails: the notice of a new request to our mailbox and the invitations for staff.
• The transport company, if a carrier makes the delivery — only the name, phone and delivery address.
• Google Ireland Limited (Ireland, EU) and Google LLC (USA) — Google Analytics, visit statistics, only with your consent.
• Meta Platforms Ireland Limited (Ireland, EU) — Meta Pixel, our ads on Facebook and Instagram and their measurement, only with your consent.
• Public authorities, for example ANAF for invoices — only when the law requires it.

These providers process the data only on our behalf and on our instructions, under data processing agreements (Art. 28 GDPR); Meta on the terms described above.

4. Transfers outside the European Union

The Republic of Moldova has no adequacy decision from the European Commission. The data from your request or order reaches the Chișinău team of S.R.L. „BosmoImpex” only because it is needed to answer you, make your quote and build the furniture you asked for: the basis is Art. 49(1)(b) GDPR (a transfer necessary for pre-contractual steps taken at your request and for performing the contract). The Chișinău team works in the same platform, with personal accounts, and gets only the data the order needs.

The platform and the database are on servers in the European Union (Germany and the Netherlands). Vercel, Railway and Postmark are US companies; transfers to them rely on the standard contractual clauses approved by the European Commission (Art. 46 GDPR), included in their data processing agreements. Data collected with your consent through Google Analytics and the Meta Pixel may be transferred to the USA; Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

5. Your rights

• to know whether we process your data and get a copy (access);
• to have inaccurate or incomplete data corrected;
• to have your data erased;
• to have processing restricted;
• to receive your data in a structured format and pass it to another controller (portability);
• to object to processing based on our legitimate interest;
• not to be subject to a decision based solely on automated processing — we make no such decisions;
• to withdraw consent at any time where processing relies on it, without affecting processing before then.

These rights are set out in Articles 15–22 GDPR. Send your request to office@rabatabil.ro, by phone at +40 747 202 000 or at the warehouse. We answer free of charge within one month of receiving it; for a complex request this may be extended by two more months, and we tell you so within the first month. To protect your data we may ask you to confirm the request is yours, for example from the phone number in the request.

6. Complaints

If you believe we process your data unlawfully, you can complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, cod 010336, tel. +40 318 059 211, anspdcp@dataprotection.ro, dataprotection.ro. Please write to us first: we usually sort it out faster together. You may also go to court.

7. How we protect the data

The site works only over an encrypted connection (HTTPS). Requests are kept in our internal platform, which only staff with a personal account and sign-in can open. We collect only what is needed, keep backups and review our security measures regularly.

If an incident puts your data at risk, we notify the ANSPDCP within 72 hours of becoming aware of it, and you too if the risk to you is high.

8. Children

The site is meant for adults buying furniture. We do not knowingly collect data about children; if we learn a request came from a minor, we delete it.

9. Cookies

The cookies the site uses are described in the cookie policy.

10. Changes to this policy

We update this policy when the way we process data or the law changes. The version in force is published on this page with its date. With your request we also keep the version of the policy you read.