GDPR Policy

This statement describes how BOOST PRODUCTION SRL applies Regulation (EU) 2016/679 (GDPR). It complements our Privacy Policy and Cookie Policy.

1. Controller

BOOST PRODUCTION SRL, J40/11931/2020, CUI 43072019, Str. Jules Michelet 15–17, Et. 1, Ap. 6, Sector 1, București 010462, Romania. Contact: service@boostproduction.ro.

2. Principles applied

• Lawfulness, fairness and transparency.
• Purpose limitation — data is used only for the purposes declared in our Privacy Policy.
• Data minimisation — we collect only what we need to deliver the Service or comply with the law.
• Accuracy — you can correct your account data at any time.
• Storage limitation — retention periods are defined in our Privacy Policy.
• Integrity & confidentiality — encryption in transit, role-based access, audit logs.

3. Your rights as a data subject

• Right of access (Art. 15).
• Right to rectification (Art. 16).
• Right to erasure / "right to be forgotten" (Art. 17), subject to fiscal retention obligations.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20).
• Right to object (Art. 21), including to direct marketing.
• Right not to be subject to a decision based solely on automated processing producing legal effects (Art. 22). We do not carry out such automated decisions.
• Right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with ANSPDCP (www.dataprotection.ro).

4. How to exercise your rights

Send a written request from the email address registered with your account to service@boostproduction.ro. We respond within 30 days, extendable by a further 60 days for complex requests, as permitted by Art. 12(3) GDPR. We may ask for reasonable proof of identity to prevent unauthorised disclosure.

5. Data Protection Officer

We are not legally required to appoint a DPO. Data protection requests are handled by the Company's management at the address above.

6. Breach notification

Where a personal-data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with Art. 34 GDPR. Notification to ANSPDCP will be made within 72 hours where applicable. This commitment does not create any contractual liability beyond what is required by the GDPR itself, and our general limitation of liability set out in our Terms applies.

7. International transfers

See Section 6 of our Privacy Policy.