Privacy policy and data security (GDPR)

Version of 18 October 2026. This policy explains which personal data we process when you use be-loud.eu, why, on what legal basis, how long we keep it, who receives it and what your rights are, under Regulation (EU) 2016/679 (GDPR), Romanian Law 190/2018 and Law 506/2004 (electronic communications).

1. Data controller and contact

MT SOFTWARE CONSULTING SRL
Tax ID (CUI): RO17416776
Trade Register no.: J2005005824404
Share capital: 45500 RON
Registered office: București, Al. Emil Botta 6, Ap. 2, sector 3, România
Working point (returns): București, Șos. Vitan-Bârzești 9A, corp E, sector 4, România
Phone: 0788 315 434
WhatsApp: 0727 392 703
E-mail: contact@be-loud.eu

For any question or request about personal data write to contact@be-loud.eu. We have not appointed a data protection officer (the law does not require one for our activity); our data protection contact is dpo@be-loud.eu (gdpr@be-loud.eu reaches the same team), and the general address above also works.

2. What data we process

Identification and contact data: name, e-mail address, phone, delivery and billing address; for companies: company name and VAT number.
Order data: products, prices, delivery and payment method, order history, returns and withdrawals, correspondence and complaints.
Payment data: status and reference of the payment. Card details are entered directly on the payment processor's page and never reach us.
Account data: e-mail address, password (stored only as an irreversible cryptographic hash), preferences (language, country, saved vehicle), wish list and stock or price alerts.
Technical data: IP address, browser type, pages visited, security logs, and the cookies and similar technologies in the Cookie policy.
Browsing data for statistics and recommendations (products viewed, searches, behaviour on the cart), under the conditions in sections 3b and 3c.
Your cookie choice: a random identifier, the choice, the date and the version of the policy, kept as proof of consent.
Virtual assistant: the messages you write and, if you are signed in, the link to your account (section 7a).
Requests and reports: what you send through the contact form, the report form or by e-mail (including name, e-mail address and, optionally, phone and an order number).
Workshop bookings: name, phone, vehicle and remarks (section 3f).
Gift cards: the recipient's e-mail address and the message, if you fill them in (section 3g).

3. Why we process data and on what legal basis

Purpose	Legal basis (Art. 6 GDPR)
Taking, paying, delivering the order; returns, withdrawal, guarantee, cancellation	performance of the contract — (b)
Issuing the invoice, accounting and tax records, e-invoicing to the tax authority	legal obligation — (c)
Customer account (an account is created with your first order)	performance of the contract — (b)
Contacting you, by our staff, about an unfinished checkout, to help you complete the order	steps before the contract at your request — (b). We do not send automatic cart-recovery e-mails.
Answering questions, messages and complaints; handling reports of illegal content and unsafe products; product safety and recalls	contract / legal obligation / legitimate interest — (b), (c), (f)
Fraud prevention, abuse limits (for example a daily-rotated, one-way code derived from the IP address) and site security	legitimate interest — (f)
Proof of your cookie and marketing choices	legal obligation to demonstrate consent (Art. 7(1)) — (c) / (f)
Own browsing statistics with a visit identifier	consent — (a), withdrawable at any time
Personalised recommendations and offers	consent — (a), withdrawable at any time
The "notify me when orders open" message and marketing messages	consent — (a); the notify list is double opt-in: we write to you only after you confirmed the address by e-mail
The virtual assistant	legitimate interest in answering your request — (f), and steps you ask for — (b)
The contact form and the answer to your request	your consent given by the box you tick in the form — (a); for an existing order, also performance of the contract — (b)
Workshop bookings	performance of the contract or steps you ask for — (b)
Wish list, stock and price alerts, vehicle saved in the account	functions you ask for in your account — (b)

The data marked as required at checkout is needed to conclude the contract; without it we cannot deliver the order. Automated decisions: we take no decision based solely on automated processing that produces legal effects for you. On the cart and checkout pages an offer (for example free delivery or a discount) can be chosen automatically from your cart and, if you allowed personalisation, your behaviour; it affects only the offer you see, you can ignore it, and it is explained on the page How we rank and recommend.

3a. Own statistics: what they are and are not

We measure the use of the site only with our own system, on our own servers. We use no analytics or advertising script of a third party and no device fingerprinting, and for statistics we store neither the IP address nor the browser identification string. The purpose is to improve the shop: which pages, panels and searches work. The legal basis for statistics with a visit identifier is your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Law 506/2004); you can withdraw it at any time in the cookie settings, effective from the next page.

If you have not chosen statistics, have rejected everything, have not yet made a choice, or your browser sends the Global Privacy Control signal, we record only daily totals of page views and clicks, per page, product, category, brand or panel, per language, delivery country, traffic source of that request (for example search, social, direct) and device type (mobile, tablet, desktop). The totals contain no identifier, no cookie is set or read for them, and they cannot be linked to a person.

If you accept the "Statistics" category, besides the totals we record browsing events tied to a pseudonymous visit key: the pages and products viewed, clicks on homepage panels, product cards and brand logos, searches (e-mail addresses and phone numbers in search terms are masked), the checkout steps reached, whether you chose a car and, if you are signed in, your account number. The visit key changes every day: it is a code derived from the session identifier and from a random secret of the day, and the secret of the day is deleted after one day, so that not even we can link the stored key to a session. A visit that crosses midnight counts as two visits. We keep these events for 90 days and then delete them; the totals derived from them, without personal data, are kept.

One cookie belongs to this category: bl_seen, valid 12 months, which holds only the date of your previous visit, to count returning visitors. If you withdraw consent for statistics the cookie is deleted. If you also chose the "Personalisation" category, browsing events are, as before, also passed to our offers engine (section 3d).

3d. Personalisation and the Global Privacy Control signal

If you accept the "Personalisation" category, the cookie bl_recent (12 months) remembers the last three product categories you viewed, so that we can show the "Picked for you" row and shortcuts to those categories on the home page; for signed-in customers the recommendations also use the wish list, past orders and the saved vehicle. We do not use this data for decisions with legal effects and never change the price of a displayed product. With both categories, "Statistics" and "Personalisation", the offers on the cart can also take your behaviour on the site into account (for example the time spent on the cart), through our offers engine; without consent the offer is chosen only from the contents of the cart.

We respect the Global Privacy Control (GPC) signal, sent by the browser as the header Sec-GPC: 1: we treat it as the absence of consent for statistics, so section 3b applies and behaviour-based offers are switched off. Personalisation you asked for expressly through the "Personalisation" category is not switched off by GPC, because GPC is a signal about statistics and data sharing.

3e. Protection against abuse

Request limiting uses a key derived one-way from the IP address (a cryptographic hash), kept for at most 70 seconds in the request-limiting counter; it is not used for statistics. Basis: our legitimate interest in protecting the service (Art. 6(1)(f)).

3f. The contact form and requests; workshop bookings

Through the form on the Contact page you send us your name, e-mail address, subject and message and, optionally, a phone number and an order number. You tick a box agreeing that your data may be used to answer the message. The message becomes a ticket in our support system, answered by support staff by e-mail, and is also sent to our contact mailbox. We keep the date of the ticked box and a code derived one-way from the IP address (not the IP address), to recognise abuse. The form has a decoy field and a limit of five submissions per ten minutes. Basis: your consent given by the ticked box (Art. 6(1)(a)); for a request about an existing order, also performance of the contract (point (b)).

Workshop bookings are made by phone, e-mail, WhatsApp or through the virtual assistant. For a booking we keep the name, phone, vehicle, requested work and remarks; the assistant can register a booking request only after your explicit confirmation in the conversation. Basis: performance of the workshop contract or steps you asked for.

3g. Wish list, alerts, saved vehicle, gift cards

In your account you can keep a wish list, "back in stock" or "price drop" alerts and a saved vehicle; they are tied to your account, only you see them, and they are erased at once when you delete your account. If you use a gift card we keep the code, the balance, the transactions and, if you filled them in, the recipient's e-mail address and the message; the remaining balance stays usable, and a card may have an expiry date. Vouchers contain no personal data; their use is tied to the order.

Each time you make a cookie choice we keep, in a register, a random identifier of the choice, the categories accepted, the version of the policy, the date, the source (banner or account) and, if you are signed in, the account number; we do not keep the IP address. Basis: the duty to be able to demonstrate consent (Art. 7(1) GDPR).

3i. The "notify me when orders open" list

If you sign up we keep the e-mail address, the language, the country, the product page you signed up from, the text of the consent and a code derived one-way from the IP address. We send you a confirmation e-mail; the sign-up counts only after you open the link in the e-mail (double opt-in). You receive from us a single message, when orders open, with an unsubscribe link that you can use at any time. Basis: your consent.

3j. Buying through agent platforms (UCP)

If an agent platform (an assistant or marketplace that buys on your behalf) is connected to be-loud.eu through our UCP interface, the platform sends us your e-mail address, name, phone and delivery address to prepare the order. We keep this data in the order created; you pay on our secure payment page, to which the platform sends you. For this kind of order we record no marketing or statistics choice, and the customer account is created or matched by e-mail address, as for any ordinary order. The platform receives back the state of the order (products, delivery, tracking, refunds, delivery address), without your e-mail address. Basis: performance of the contract.

4. Who receives the data

Courier and parcel companies: Cargus, GLS and Packeta (and their delivery partners, for example Sameday or FAN Courier for some Packeta parcels): name, address, phone, e-mail, for delivery and returns. When you choose a Packeta pick-up point, the map widget is loaded from Packeta's servers, which then see your IP address.
Payment processors: Stripe for card payments (NETOPIA Payments remains our payment partner for Romanian lei where offered): the data the payment needs. Each is an independent controller for its own legal duties (anti-money-laundering, card scheme rules) and a processor for the rest.
Partner sellers, only for orders with products they sell: the data needed for delivery and for their invoice; they are independent controllers for the invoice, the guarantee and returns of those products.
Hosting: the site's servers are hosted in Romania, with the provider [•], under a contract (Art. 28 GDPR).
E-mail sending: the e-mail service provider [•], which transmits our transactional messages (order confirmations, answers to requests); it acts on our instructions.
Invoicing and records software: our invoicing system and ERP, which receive the order and invoice data.
Cloud language-model providers (Google, through AI Studio, and OpenRouter): they receive only catalogue text meant for translation (names and descriptions of products and categories, labels, texts of promotions, pages and interface). They receive no customer messages and no account, order or contact data.
Virtual assistant: runs on our own servers with language models hosted by us; each conversation request is sent to our router with the restriction "local models only"; the messages are not sent to external AI providers.
Public authorities, when the law requires it (for example the tax authority ANAF for e-invoicing, consumer protection and market surveillance authorities).

We do not sell your data and do not pass it to other companies for their marketing.

4a. Transfers outside the European Economic Area

Our own systems and the assistant are in the EU. Stripe may transfer data to the United States under the EU-US Data Privacy Framework or standard contractual clauses. Courier and payment partners in other EU countries are inside the EEA. We do not otherwise transfer personal data to third countries.

5. How long we keep data

Data	Kept
Invoices and accounting documents, with the order data they rely on	10 years from the end of the year of issue (Romanian Law 82/1991)
Other order data (correspondence, returns, complaints)	[•]
Customer account	while it is active; erased or anonymised on your request, except data we must keep by law (see below); inactive accounts: [•]
Contact data of an unfinished checkout (never converted into an order)	anonymised after 90 days
Daily statistics totals, without identifier	no limit, they contain no personal data
Statistics events with a visit key (only with your consent)	90 days
Browsing events passed to the offers engine (only with your consent to statistics and personalisation)	7 days on the site; in the offers engine [•]
The cookies `bl_seen` and `bl_recent`	12 months or until you withdraw consent
Proof of your cookie choice	3 years (the period in which a claim could still be made)
Virtual assistant conversations	30 days from the last message, then deleted automatically; you can delete them at any time
Contact form tickets	[•]
Workshop bookings	[•]
Reports of illegal content or unsafe products, and our decisions	[•]
The "notify me when orders open" list	until you withdraw consent; [•] after orders open
Gift cards (including the recipient's e-mail)	[•]
Technical security logs	[•]

5a. Contacts from the old shop

The contact data in the database of the old shop was not imported into be-loud.eu: we do not use it to send you messages and we have not linked it to accounts on the new site.

6. Your rights

You have the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection (including to processing based on legitimate interest), and the right to withdraw consent at any time without affecting earlier processing. In your account, section "My data (GDPR)", you can download your data as a structured JSON file and delete your account: your profile, addresses, wish list, alerts and the contact data of your carts are erased or anonymised at once; orders and invoices stay for the legal retention period without a link to an active account, and reviews or questions you wrote stay without your name. The export also includes the statistics events linked to your account, and erasure removes their link to the account. For the other requests (for example contact form tickets, bookings, conversations with the assistant) write to contact@be-loud.eu; we may ask for information to verify your identity. We answer within one month. You can change your cookie choice at any time in the cookie settings.

You may lodge a complaint with the Romanian data protection authority (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., Bucharest, www.dataprotection.ro, or with the data protection authority of your country of residence.

7. Security of personal data

We protect data with technical and organisational measures appropriate to the risk (Art. 32 GDPR):

all communication with the site is encrypted (HTTPS/TLS);
passwords are stored only as a cryptographic hash; nobody, including our staff, can read them;
card data is processed only by the PCI DSS certified payment processor; be-loud.eu never receives or stores the card number;
staff access to data is limited by role, with two-step authentication and IP restriction for administration; administrative actions are logged;
servers are hosted in the European Union; database access is allowed only from authorised addresses; daily backups are kept with restricted access;
forms are protected against abuse (rate limits, anti-spam protection).

If a personal data breach that puts you at risk occurs, we notify ANSPDCP within 72 hours and inform you without undue delay, where the law requires it.

7a. Virtual assistant (artificial intelligence)

The assistant on be-loud.eu is an artificial intelligence system, not a person, and says so at the start of every conversation. The messages you write (including a name, phone number or e-mail if you choose to send them) are processed to answer you, to check stock, prices, compatibility and workshop slots and, if you ask, to pass your request to our team, who then answer as people. The conversation runs on our own servers with language models hosted locally; it is not sent to external AI providers. If you are signed in, the conversation is tied to your account number so that the assistant can show you your own orders; a visitor who is not signed in appears as a visitor, with no IP address and no identifier other than the conversation code.

The transcript is kept for 30 days from the last message and then deleted automatically; you can delete it at any time with the "Clear conversation" button. Our authorised staff (the support and administration roles) can read conversations in the administration panel, to correct the assistant, check errors and answer requests passed on; access is logged and the transcript is not copied into the audit log. Booking or contact requests sent through the assistant are kept separately, like any request you address to us. We do not use the conversation for advertising. Legal basis: our legitimate interest in answering your request and improving our service and, for contact details you send on request, taking the steps you asked for. Answers can contain mistakes: check important details; an answer of the assistant is information, not an offer.

8. Minors

The site is not aimed at people under 16; we do not knowingly collect their data.

9. Changes

We may update this policy; the current version is always published on this page with its date.