Effective date: 03 Sep 2025

Scope: This Privacy Policy explains how Packmaster Ambalaj Ltd. Şti. (“Packmaster”, “we”, “us”, “our”) collects, uses, shares and protects personal data when you visit our corporate website (the “Site”). This Site does not offer user accounts, e-commerce, or sign-in features. We use cookies/analytics and process data provided voluntarily via contact/quote/sample request forms.

1) Data We Process & Purposes

a) Visit data (logs & analytics)

When you access the Site, we and our service providers (e.g., analytics vendors) may automatically collect limited technical information such as IP address, device/browser type, operating system, referring URL, pages viewed, timestamps and general usage metrics. We use this to operate, secure and improve the Site, diagnose issues and understand usage trends.

b) Cookies and similar technologies

We use cookies to run the Site, remember preferences and measure performance (e.g., Google Analytics). Where required, we obtain your consent via a cookie banner. You can withdraw consent at any time through the banner or your browser settings. Disabling cookies may limit some features.

Cookie categories:

• Strictly necessary: ensure core functionality.
• Performance/Analytics: understand usage and improve the Site (we enable IP masking/anonymisation where possible).
• Functional: remember choices such as language.

c) Forms (contact / quote / sample request)

If you choose to submit a form, we process the data you provide (e.g., name, business email, phone, company, message; and for sample shipments, a postal address) to respond to your enquiry, prepare quotations, send samples, manage customer relations, and—only if you opt in—send relevant updates.

2) Legal Bases (GDPR/UK GDPR, Art. 6)

Depending on the context, we process personal data on the following bases:

• Consent (Art. 6(1)(a)) for non-essential cookies/analytics and optional communications.
• Contractual necessity (Art. 6(1)(b)) to respond to your quote/sample requests and pre-contract interactions.
• Legitimate interests (Art. 6(1)(f)) to secure and improve the Site, prevent fraud/abuse, keep records of business communications, and support efficient operations—balanced against your rights.

Where local law requires consent (e.g., for analytics cookies), we rely on consent and offer easy opt-out.

3) Sharing & Recipients

We may share limited data with:

• Hosting, maintenance, analytics and security providers operating under data-processing agreements,
• Logistics/carriers for sample shipments,
• Authorities where legally required (e.g., court orders).

We do not sell personal data. We share only what is necessary for the stated purpose and require appropriate confidentiality and security from our processors.

4) International Transfers

Some providers (e.g., analytics/hosting) may process data outside your country, including outside the EEA/UK. When we transfer personal data internationally, we use lawful transfer tools such as:

• Adequacy decisions, where applicable, and/or
• Standard Contractual Clauses (SCCs) and additional safeguards.

Details of transfer mechanisms can be provided upon request.

5) Retention

We keep data only as long as needed for the purposes described:

• Logs/analytics: retained for a limited, proportionate period to maintain and improve the Site.
• Form submissions: retained for customer service, compliance and record-keeping, and no longer than necessary (e.g., applicable limitation periods).

Afterwards, data is deleted or anonymised in line with our policies.

6) Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or loss (e.g., access controls, encryption in transit, monitoring). No method of electronic transmission or storage is 100% secure; we cannot guarantee absolute security.

7) Third-Party Links

The Site may link to external sites. We are not responsible for the privacy practices of third parties. Please review their privacy policies when you visit them.

8) Your Rights (GDPR/UK GDPR)

If you are in the EEA or UK, you have the right to:

• Access your personal data and obtain a copy,
• Rectify inaccurate or incomplete data,
• Erase data in certain circumstances (“right to be forgotten”),
• Restrict processing in certain cases,
• Data portability where technically feasible,
• Object to processing based on legitimate interests (including profiling) and to direct marketing,
• Withdraw consent at any time (does not affect prior lawful processing),
• Lodge a complaint with your local supervisory authority (e.g., in the EEA, your national Data Protection Authority; in the UK, the ICO).

To exercise your rights, please use the contact options in the Contact section below. We may need to verify your identity and will respond within the timelines required by law.

9) Children’s Privacy

The Site is intended for business/general audiences and is not directed to children. We do not knowingly collect personal data from children.

10) Marketing Communications

We send updates only if you opt in. You may unsubscribe at any time via the link in our emails or by contacting us (see below).

11) Changes to this Policy

We may update this Policy periodically. The latest version (with effective date) will always be available on this page.

12) Controller & Contact

Controller: Packmaster Ambalaj Ltd. Şti.

Contact: Please use the contact methods on our Contact page (for privacy enquiries, rights requests, or complaints). If you prefer email, you can write to our privacy team at privacy@packmaster.com. We will respond as required by applicable law.

EEA/UK Addendum (GDPR/UK GDPR)

Controller identity & representative (if applicable): Packmaster Ambalaj Ltd. Şti. acts as the controller for Site processing. If we appoint an EU/UK representative, we will publish their details here.

Legal bases: See Section 2. We balance our legitimate interests against your rights (Art. 6(1)(f)). For cookies requiring consent, we rely on Art. 6(1)(a).

International transfers: See Section 4. Where SCCs are used, we assess local laws and apply supplementary measures as needed.

Supervisory authority: You may lodge a complaint with your local authority (e.g., ICO in the UK, or your national DPA in the EEA).

California Notice (CCPA/CPRA) — Summary

While our Site targets a global audience and does not sell personal data, California residents may have rights under the CCPA/CPRA (e.g., to know, delete, correct, and opt-out of “sale/share” for cross-context behavioural advertising). We do not sell personal information. To exercise California rights or to submit an authorised agent request, contact us via the Contact section. We will verify your request as required by law.