DATA AND CHOICES
Privacy notice.
This notice explains how MAR&PET uses data submitted through forms and, only with permission, measures clicks on commercial contact links.Version: 6 September 2026 · contact analytics 2026.09Controller and contact
The request is handled by MAR&PET GRUP. Privacy requests may be sent to partener@marpet.ro.
What we collect and why
We process the contact details, project description, page and campaign attribution, and—when used—the validated Vision 3D technical snapshot you submit. The purpose is to review your request, contact you, prepare a quotation, maintain a reliable Lead ID audit trail and measure platform-originated opportunities. We do not use a request as a marketing subscription without separate consent.
Lead ID and returning-visitor key
Each accepted request receives a unique Lead ID. A first-party, HTTP-only pseudonymous cookie is retained for up to 24 months so a returning request can be attributed consistently. The database stores only a one-way fingerprint of that cookie, not its raw value.
Who receives the data
Operational notifications are sent to the approved MAR&PET and PXP500 recipients responsible for commercial follow-up and reporting. Infrastructure providers include Supabase for the lead register and authentication, Cloudflare for network delivery, Hetzner for application hosting, and Resend for transactional email.
International processing
The lead database must be provisioned in Supabase’s Frankfurt region before capture is enabled. Transactional notifications sent through Resend include the lead’s contact and request content as well as delivery metadata; Resend may process this information in the United States under its contractual transfer safeguards. Strict EU-only processing is therefore not claimed for the current notification path.
Optional measurement of commercial contact clicks
Only if you accept optional analytics, we record activation of an explicitly marked commercial email or telephone link. The event contains the channel, selected MAR&PET contact, link placement, pathname, language, limited UTM values and time. It does not contain your email address or telephone number, message or call content, full URL, referrer, raw IP address, User-Agent or the cookie key used for leads. A separate one-way rate-limit token derived from the network address is retained for no more than 48 hours and is never shown in the report. A click indicates contact intent only: it does not prove that a message was sent or a call was made and does not create a Lead ID, commercial alert or marketing subscription. Detailed events are deleted automatically after 90 days. You may decline or withdraw permission at any time from Analytics settings without affecting contact links.
Retention
The attribution cookie is kept for no more than 24 months. Lead records are retained only while needed for attribution and commercial follow-up, or for an active quotation, contract, dispute, accounting or another legal obligation. The controller must approve and publish the concrete deletion or anonymisation schedule before capture is enabled; no automatic retention job is active yet.
Your choices and rights
You may request access, correction, deletion, restriction or objection, and may withdraw consent where consent is the applicable basis. You may also complain to the competent data-protection authority. Withdrawing consent does not affect processing already performed lawfully.
Security and data minimisation
Access to the lead register is restricted to five approved identities with role-based permissions and an immutable event trail. Vision 3D submissions store a reduced technical snapshot; locally selected photographs and raw editor history are not included in the lead record.