Privacy policy
Last updated: 2026-04-22
Who we are
Oldtimer Studio (7 Agromec Str., Moara Vlăsiei, Ilfov 077130, RO) is the data controller for information collected through this website.
Contact: office@oldtimer.ro · +40 744 381 792
What we collect
- Contact & enquiry form submissions — the name, email address, phone number, subject, and message you voluntarily provide, together with your IP address and a timestamp.
- Part-enquiry submissions — the same fields plus the identifier of the part you enquired about.
- Server logs — standard web-server access logs (IP, user-agent, request URL, timestamp) retained for 30 days for security and abuse prevention.
- Cookies — see our Cookie policy for the full list. We do not use third-party advertising cookies.
We do not collect payment information through this site. Stripe is not currently active; if and when it is, Stripe becomes the payment-data controller under its own policy.
Why we process your data
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiries, quoting, and fulfilling any contract | GDPR Art. 6(1)(b) — performance of a contract / pre-contractual steps |
| Keeping records for tax, warranty, and accounting | GDPR Art. 6(1)(c) — legal obligation |
| Preventing abuse, fraud, and attacks | GDPR Art. 6(1)(f) — legitimate interest |
| Optional marketing (newsletter, if you subscribe) | GDPR Art. 6(1)(a) — consent, withdrawable at any time |
How long we keep it
- Contact form submissions: up to 5 years after the last interaction, or shorter if you ask us to delete them.
- Customer project records (restoration tracker, invoices, warranty): for the duration of the warranty period plus the statutory retention period required by Romanian tax law.
- Server logs: 30 days.
Who we share it with
We share data only with processors who help us run the business and have signed a data-processing agreement with us:
- Supabase (database + file storage hosting — EU region)
- Vercel (application hosting — EU region)
- Resend (transactional email delivery)
- Meta / Instagram (only when you explicitly click social links; we never send your personal data to them from our server)
We do not sell personal data. We do not transfer it outside the EEA except to these listed processors under Standard Contractual Clauses.
Your rights
Under GDPR you can:
- Access a copy of your data
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Restrict or object to processing
- Port your data to another controller
- Withdraw consent for anything you consented to
- Complain to the Romanian supervisory authority — ANSPDCP (anspdcp.ro)
To exercise any of these rights, email office@oldtimer.ro. We respond within 30 days.
Children
This site is not directed at children under 16 and we do not knowingly collect data from them.
Changes
We may update this policy. Material changes will be flagged on the site. This version was last updated on 2026-04-22.