Privacy Policy

Your privacy matters to us. This Privacy Policy explains how Instal Electroclima SRL (trading as SmartKNX) collects, uses, stores, and protects your personal data when you visit smartknx.eu, create an account, place an order, or contact us. We are committed to processing your personal data in full compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Romanian data-protection law.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

Instal Electroclima SRL (trading as SmartKNX)
Str. Vulturului nr. 8, lot 1, Constanța, Romania
Company registration number (CUI): RO38603327
Trade Register number: J13/3922/2017
E-mail: office@smartknx.eu
Telephone: +40 723 637 077
Website: www.smartknx.eu

For any question or request relating to your personal data, please contact us using the details above. We will respond without undue delay and, in any event, within one calendar month of receiving your request.

2. What Personal Data We Collect and Why

We collect only the personal data that is necessary for the specific purpose for which it is processed. The table below summarises each processing activity, the categories of data involved, the legal basis, and the retention period.

2.1 Account Registration (B2B Shop Login)

When you create an account on our online shop, we collect:

  • Full name and company name
  • Business e-mail address
  • Billing and, if different, delivery address
  • Telephone number
  • VAT identification number (where applicable)
  • Encrypted account password

Purpose: To create and manage your B2B account, provide access to login-protected pricing, process your orders, and communicate order-related information with you.

Legal basis: Article 6(1)(b) GDPR — processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract.

Retention: Account data is kept for as long as your account remains active. If you request account deletion and have no outstanding contractual obligations, your account data will be erased within 30 days, except where longer retention is required by law (see Section 7).

2.2 Orders and Contract Fulfilment

When you place an order for KNX hardware through our online shop, or engage us for integration services (design, ETS programming, installation, commissioning, or support), we collect and process:

  • Name and company details
  • Billing address and delivery address
  • Contact telephone number and e-mail address
  • Order contents, quantities, and agreed prices
  • Payment records (bank transfer confirmation reference; we do not store bank account or card numbers)
  • Project details, site address, and technical requirements (for service contracts)
  • Delivery tracking information

Purpose: To fulfil your order or service contract, arrange delivery via tracked EU courier services, issue invoices, process advance payments, manage returns within the 14-day statutory withdrawal period, and provide after-sales support.

Legal basis: Article 6(1)(b) GDPR — performance of a contract; and Article 6(1)(c) GDPR — compliance with legal obligations (e.g., Romanian accounting and invoicing requirements).

Retention: Order data and invoices are retained for 10 years from the date of the transaction, in accordance with Romanian accounting legislation (Legea Contabilității nr. 82/1991 and associated regulations). Delivery and logistics records are kept for the duration necessary to resolve any shipping dispute, and no longer than 3 years thereafter.

2.3 Contact and Quote Request Forms

When you submit a contact form or request a project quotation on our website, we collect:

  • Name and, if provided, company name
  • E-mail address
  • Telephone number (if provided)
  • Project location or site address (if provided)
  • The content of your message or enquiry

Purpose: To respond to your enquiry, prepare a technical or commercial proposal, and communicate with you about potential or ongoing projects.

Legal basis: Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract; or, where no contract follows, Article 6(1)(f) GDPR — our legitimate interest in responding to business enquiries in a professional and timely manner.

Retention: Enquiry and quotation data is retained for 3 years from the date of last correspondence, unless the enquiry develops into a contract (in which case order retention periods apply), or you ask us to delete it sooner.

2.4 Cookies and Website Analytics

Our website uses cookies and similar technologies. Cookies are small text files placed on your device that allow us to recognise your browser and improve your experience.

Strictly necessary cookies are essential for the website and shop to function (e.g., maintaining your session and shopping basket). These cookies do not require your consent and cannot be disabled without affecting core website functionality.

Analytics cookies (Google Analytics) — We plan to use Google Analytics to understand how visitors interact with our website (e.g., pages visited, session duration, geographic region at country level). Google Analytics sets cookies on your device and transmits anonymised usage data to Google’s servers.

Legal basis for analytics cookies: Article 6(1)(a) GDPR — your freely given, specific, informed, and unambiguous consent, obtained via our cookie-consent banner before any analytics cookies are placed. You may withdraw your consent at any time by adjusting your preferences through our cookie settings tool or by clearing your browser cookies.

We use Google Analytics with IP anonymisation enabled, meaning your IP address is truncated before any processing takes place. We do not use Google Analytics audience features, cross-site tracking, or any advertising or remarketing functions.

No other tracking technologies are used. We do not use advertising networks, affiliate networks, product-rating services, price-comparison services, or any third-party marketing cookies on this website.

Retention: Analytics data is retained within Google Analytics for 14 months, after which it is automatically deleted. Cookie consent records are kept for 3 years as evidence of your consent.

3. Legal Bases for Processing — Summary

Under the GDPR, we must have a valid legal basis for every processing activity. The legal bases we rely on are:

  • Article 6(1)(a) — Consent: Analytics cookies and any other optional processing for which we ask your explicit agreement.
  • Article 6(1)(b) — Contract performance: Processing necessary to fulfil your order, deliver goods or services, manage your account, or take pre-contractual steps at your request.
  • Article 6(1)(c) — Legal obligation: Processing required by Romanian or EU law, including the retention of accounting records, invoices, and tax documents.
  • Article 6(1)(f) — Legitimate interests: Responding to unsolicited business enquiries, ensuring website security, and fraud prevention — provided these interests are not overridden by your rights and freedoms.

4. Payment Processing

All payments are made exclusively by bank transfer. We do not operate an integrated online payment gateway, and we do not collect, process, or store any credit card, debit card, or other payment instrument details on our systems.

For online shop orders, full payment (100% advance) is required before goods are dispatched. For contracted services (design, installation, commissioning, and support), a 50% advance is required at contract signature, with the balance due upon project completion or as agreed in the contract.

Bank transfer instructions are provided on our invoices and order confirmations. The processing of your payment within the banking system is governed by your own bank’s privacy policy, over which we have no control.

5. Who We Share Your Personal Data With

We do not sell, rent, or trade your personal data. We share your data only to the extent strictly necessary to deliver our products and services, and only with the following categories of recipients:

5.1 Website Hosting Provider

Our website and shop are hosted by a third-party hosting provider, whose servers store website data, account information, and order records on our behalf. This provider acts as a data processor under a Data Processing Agreement and is contractually bound to process your data only on our instructions and to implement appropriate technical and organisational security measures.

5.2 Shipping and Courier Services

To fulfil and deliver your orders, we share your name, delivery address, telephone number, and e-mail address with our contracted courier partners (DPD, GLS, and/or DHL), depending on the service selected. These details are necessary to arrange collection, transit, and delivery of your parcel, and to provide you with a tracking reference. Each courier operates as an independent data controller for the data it processes in connection with delivery; please refer to their respective privacy policies for further information.

5.3 Google Analytics

Subject to your consent, anonymised usage data collected via Google Analytics cookies is transmitted to Google LLC. Please see Section 2.4 and Section 6 (International Transfers) for further details.

5.4 Legal and Regulatory Disclosure

We may disclose your personal data to public authorities, courts, or regulatory bodies where we are required to do so by applicable Romanian or EU law, or where such disclosure is necessary to establish, exercise, or defend legal claims.

We do not share your data with advertising networks, affiliate networks, product-rating platforms, price-comparison services, or any other third parties not listed above.

5.5 Quote Handling — CRM and Project Workspace

When you submit a quote request (see Section 2.3), we use a small set of internal and third-party tools to handle it professionally and securely:

  • Internal CRM: your enquiry — name, contact details, project information and any documents you attach — is recorded in our own customer-relationship-management system, hosted on our own infrastructure, so our team can prepare your quote and manage the project.
  • Automated draft: shortly after your request, an automated email sends you a clearly marked, non-binding draft outline of the collaboration framework, generated from the details you provided. It has no contractual value until reviewed and signed.
  • Attached documents (plans, schematics, KNX/ETS specifications and similar) are stored securely, restricted from public access, and used solely to assess and quote your project.

Legal basis: your consent, given when you tick the consent box and submit the form, together with our legitimate interest in responding to your enquiry. You may withdraw your consent or request deletion of this data at any time (see Section 8, Your Rights). The records of your request and consent (including the date and time) are retained only as long as necessary to handle your enquiry and any resulting business relationship.

6. International Data Transfers

Our business operations and hosting infrastructure are based within the European Union. We do not intentionally transfer your personal data to countries outside the European Economic Area (EEA).

However, if you have consented to analytics cookies, usage data processed by Google Analytics may be transferred to servers operated by Google LLC, which is headquartered in the United States. Google LLC participates in the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), which provides an adequate level of protection for personal data transferred from the EU to certified US organisations. Accordingly, any such transfer is carried out on the basis of an adequacy decision pursuant to Article 45 GDPR.

If you do not consent to analytics cookies, no transfer of your personal data to Google will occur.

7. Retention Periods

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The principal retention periods are as follows:

  • Account data: For the duration your account is active, plus 30 days following a deletion request (subject to outstanding legal obligations).
  • Order data and invoices: 10 years from the transaction date, in accordance with Romanian accounting law.
  • Service contracts and project records: 10 years from completion or termination of the contract.
  • Contact and quotation enquiries: 3 years from the date of last correspondence, unless converted into a contract.
  • Delivery and logistics records: 3 years from the date of delivery or resolution of any dispute.
  • Cookie consent records: 3 years from the date consent was given or last updated.
  • Analytics data (Google Analytics): 14 months, automatically deleted by Google Analytics thereafter.
  • Returns and withdrawal records: 3 years from the date of the return, unless a legal dispute requires longer retention.

When the applicable retention period expires, personal data is securely deleted or anonymised so that it can no longer be associated with you.

8. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights in relation to your personal data. You may exercise any of these rights by contacting us at office@smartknx.eu or by post at our registered address. We will respond within one calendar month; in complex cases, this period may be extended by a further two months, and we will inform you if this is the case.

  • Right of access (Article 15 GDPR): You have the right to request a copy of the personal data we hold about you, along with information about how we use it.
  • Right to rectification (Article 16 GDPR): You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
  • Right to erasure (Article 17 GDPR): You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you have withdrawn consent and there is no other legal basis for processing, or where the data has been processed unlawfully. This right does not apply where processing is necessary for compliance with a legal obligation or for the establishment, exercise, or defence of legal claims.
  • Right to restriction of processing (Article 18 GDPR): You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while the accuracy of the data is contested, or where you object to processing and we are assessing whether our legitimate grounds override yours.
  • Right to data portability (Article 20 GDPR): Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller.
  • Right to object (Article 21 GDPR): You have the right to object at any time to processing based on our legitimate interests (Article 6(1)(f) GDPR). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defence of legal claims.
  • Right to withdraw consent (Article 7(3) GDPR): Where processing is based on your consent (e.g., analytics cookies), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You may withdraw cookie consent via our cookie settings tool at any time.
  • Right not to be subject to automated decision-making (Article 22 GDPR): We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you.

There is no charge for exercising your rights. We may ask you to verify your identity before acting on a request, to protect the security of your personal data.

9. Right to Lodge a Complaint with the Supervisory Authority

If you believe that our processing of your personal data infringes the GDPR or applicable Romanian data-protection law, you have the right to lodge a complaint with the competent supervisory authority. In Romania, this is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
Bd. G-ral. Gheorghe Magheru nr. 28–30, Sector 1, 010336 București, Romania
Telephone: +40 318 059 211
E-mail: anspdcp@dataprotection.ro
Website: www.dataprotection.ro

We would, however, appreciate the opportunity to address your concerns before you contact the supervisory authority, and we encourage you to contact us in the first instance at office@smartknx.eu.

If you are located in another EU or EEA member state, you may also have the right to lodge a complaint with the supervisory authority in your country of habitual residence or place of work.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encrypted communication (HTTPS/TLS), access controls, secure password hashing, and regular security reviews.

Notwithstanding our efforts, no method of electronic transmission or storage is entirely secure. If you become aware of any security vulnerability or incident relating to our website, please notify us promptly at office@smartknx.eu.

11. Children’s Privacy

Our website and services are directed exclusively at business customers and are not intended for children under the age of 16. We do not knowingly collect personal data from individuals under 16. If you believe that a child has provided us with personal data, please contact us and we will take prompt steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, legal requirements, or business practices. When we make material changes, we will update the “Last updated” date at the bottom of this page and, where appropriate, notify registered account holders by e-mail. We encourage you to review this policy periodically. Continued use of our website or services following any update constitutes your acknowledgement of the revised policy.

13. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data, please contact us:

Instal Electroclima SRL (trading as SmartKNX)
Str. Vulturului nr. 8, lot 1, Constanța, Romania
E-mail: office@smartknx.eu
Telephone: +40 723 637 077
Website: www.smartknx.eu

Last updated: 15 October 2026