Privacy Policy

This English translation is provided for convenience. In case of any discrepancy, the Romanian version prevails.

This policy explains what personal data we process when you visit our website or contact us, why we do so, how long we keep it and what rights you have, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and Romanian Law no. 190/2018.

1. Who is the data controller

The controller is Roland Arms, with its registered office at Aleea Arubium nr. 46–48, Sector 2, 022944 București. For any question or request regarding your data, you can write to us at contact@roland-arms.com, call us on +40 784 371 171 or send us a letter at Aleea Arubium nr. 46–48, Sector 2, 022944 București.

2. What data we process

• Contact form and quote requests: name, email address, telephone number (optional), the subject and content of your message, the products for which you request a quote (including those sent from the basket) and the quantities.
• Quote request basket: the list of products you add to the basket is stored only in your browser (local storage), not on our server, and is not linked to your identity. It reaches us only if you send the quote request. You can delete it at any time by emptying the basket or clearing the site data in your browser.
• Correspondence and calls: the information you provide to us by email, by telephone or in the showroom.
• Purchase of regulated products: identification data, details of your firearms licence and purchase authorisation and the other information required by Law no. 295/2004 on the regime of weapons and ammunition. We collect this directly from you, only when you buy such a product.
• Invoicing: the data needed to issue tax documents.
• Technical data: the server hosting the website automatically logs, for a short period, data such as your IP address, browser type and the pages accessed, for the security and operation of the website. We do not use this data to identify you or for advertising.
• Abuse protection: when you submit a form or when someone tries to log in to the administration panel, we keep, for no more than 24 hours, a cryptographic fingerprint (hash) of the IP address, from which the address cannot be read, in order to limit automated submissions and password-guessing attempts.

• Usage statistics (only with your consent): if you accept statistics in the cookie banner, PostHog records the pages visited, interactions with the website, the type of device and browser, the approximate country and a random browser identifier. We do not link this data to your name or email address.

We do not use marketing cookies and we do not create advertising profiles. Details are available in the Cookie Policy.

Are you obliged to provide us with your data? For messages and quote requests, your name and email address are required so that we can reply to you; without them we cannot act on your request. For the purchase of regulated products, providing your identification data and documents is a legal obligation (Law no. 295/2004), and without them the sale cannot take place.

3. Why we process data and on what legal basis

• To reply to your messages and quote requests (including those sent from the basket) and to confirm receipt by email – Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and point (f) (our legitimate interest in responding to enquiries).
• To sell products and perform the contract, including the warranty and returns – Art. 6(1)(b) GDPR.
• To comply with legal obligations: recording and reporting firearms and ammunition transactions to the competent authorities (Law no. 295/2004), and tax and accounting obligations – Art. 6(1)(c) GDPR.
• For the security of the website, fraud prevention and the defence of our rights – Art. 6(1)(f) GDPR.
• For usage statistics (PostHog), to understand which content is useful and to improve the website – Art. 6(1)(a) GDPR and Art. 4(5) of Law no. 506/2004 (your consent). You can withdraw it at any time via “Cookie settings” in the website footer.

We do not send newsletters or commercial messages. If we do so in future, we will first ask for your consent, which you will be able to withdraw at any time. We do not take decisions based solely on automated processing of data.

4. How long we keep data

• Messages and quote requests sent through the forms: no more than 2 years from receipt; after this period they are deleted automatically, except for those that formed the basis of a contract.
• Basket contents: remain only in your browser until you empty the basket, send the quote request or clear the site data.
• Data relating to the sale of firearms and ammunition: for the period required by the legislation on the regime of weapons and ammunition.
• Financial and accounting documents: for the period required by financial and accounting legislation.
• Technical server logs: the limited period set by the hosting provider.
• Data needed to establish, exercise or defend a legal claim: until the statutory limitation period expires.
• IP address fingerprints used for abuse protection: no more than 24 hours.
• Statistics data (PostHog): no more than 12 months, or until you withdraw your consent to cookies in your browser.

5. Who we share data with

• Providers who help us operate the website (processors, Art. 28 GDPR): hosting, database and image storage, the email service and, only if you accept statistics, PostHog Inc., USA (usage analytics; the data is stored on servers in the EU, in Frankfurt). They process the data only in accordance with our instructions.
• Public authorities (for example the Romanian Police or ANAF (National Agency for Fiscal Administration)), where the law requires us to do so.
• Our advisers (accountant, lawyer), who are bound by a duty of confidentiality.

We do not sell or rent your data.

6. Transfers outside the European Economic Area

Some technical providers may have their registered office or infrastructure outside the EEA, including in the USA. In such cases, the transfer takes place only on the basis of an adequacy decision of the European Commission (for example the EU-U.S. Data Privacy Framework) or of standard contractual clauses approved by the Commission, in accordance with Chapter V of the GDPR.

7. Your rights

• the right of access to your data (Art. 15 GDPR);
• the right to rectification of inaccurate data (Art. 16);
• the right to erasure of data (Art. 17), within the limits of our legal retention obligations;
• the right to restriction of processing (Art. 18);
• the right to data portability (Art. 20);
• the right to object to processing based on our legitimate interest (Art. 21);
• the right to withdraw your consent at any time, where processing is based on consent.

To exercise your rights, write to us at contact@roland-arms.com. We will reply without undue delay and in any event within one month of receiving your request; this period may be extended by two further months for complex requests, in which case we will inform you. We may ask for additional information to confirm your identity.

You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro.

8. Data security

The website uses encrypted connections (HTTPS) only. Access to messages and to the administration panel is password-protected, passwords are stored in encrypted form, and our providers apply appropriate technical and organisational measures.

9. Minors

The website is not intended for persons under 18. Regulated products are sold only to persons who meet the legal requirements.

10. Changes

We may update this policy when the legislation or the way we process data changes. The date of the last update is shown below.