Privacy Policy

Last updated: 20 May 2026

1. Data Controller

The controller of personal data collected through this website is SUSTAINABILITY TODAY S.R.L., a Romanian company. For any data-protection request, contact [email protected].

2. Data We Collect

  • Contact data submitted via forms: company name, contact name, phone, email, message.
  • Technical data automatically collected: IP address, browser type, device, OS, pages visited, visit duration, traffic source (referrer, UTM parameters).
  • Advertising identifiers: cookies and pixels (Google Ads, Meta Pixel) used for campaign measurement and remarketing.
  • Communication data: email correspondence and phone calls with our team.

3. Legal Basis for Processing

  • Contract performance (Art. 6(1)(b) GDPR) — for COC certification services, EUDR support, and related activities.
  • Consent (Art. 6(1)(a) GDPR) — for newsletter, non-essential cookies, marketing communications.
  • Legitimate interest (Art. 6(1)(f) GDPR) — for handling quote requests, measuring website performance, fraud prevention.
  • Legal obligation (Art. 6(1)(c) GDPR) — for tax, accounting, regulatory reporting.

4. Purposes of Processing

  • Processing membership applications and issuing quotes
  • Managing the contractual relationship with certified members
  • Technical support and consulting during audit and compliance processes
  • Transactional communications (procedural updates, standard notifications)
  • Marketing and remarketing via Google Ads and Meta Ads (based on consent)
  • Internal analytics to improve our services

5. Data Recipients

  • Accredited certification body issuing FSC/PEFC certificates (third party necessary for our service)
  • IT and payment service providers (hosting, payment processing, transactional email) — under GDPR-compliant data processing agreements
  • Google LLC (Google Ads, Google Analytics) — for advertising measurement and web analytics
  • Meta Platforms, Inc. (Meta Pixel, Conversions API) — for Facebook/Instagram advertising measurement
  • Competent authorities — when legally required

6. International Transfers

Some providers (Google, Meta) process data in the US. These transfers rely on Standard Contractual Clauses approved by the European Commission and on the EU-US Data Privacy Framework certification.

7. Retention Period

  • Contact data for unqualified leads: 24 months from last interaction
  • Certified member data: contract duration + 10 years after (accounting obligations)
  • Cookie and pixel data: per your browser settings (typically 13 months)
  • Email correspondence: 5 years

8. Your Rights

Under GDPR you have the following rights:

  • Right of access to your data
  • Right to rectification of inaccurate or incomplete data
  • Right to erasure ("right to be forgotten")
  • Right to restriction of processing
  • Right to data portability
  • Right to object to processing based on legitimate interest
  • Right to withdraw consent at any time, without affecting the lawfulness of consent-based processing before withdrawal
  • Right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP) — www.dataprotection.ro

9. Data Deletion

To request deletion of your personal data, send a request to [email protected] with subject "Data Deletion Request". We will process the request within 30 days, per GDPR. Exceptions (data retained by legal obligation) will be clarified explicitly.

10. Cookies

For details about cookies used, see our Cookie Policy.

11. Security

We implement reasonable technical and organizational measures to protect data (TLS encryption, access control, periodic audits). No method of online transmission is 100% secure; we cannot guarantee absolute security.

12. Policy Changes

We may update this policy. The current version is available on this page with the last modification date. Material changes will be communicated via email or website notification.

13. Contact

For any question regarding data processing:
SUSTAINABILITY TODAY S.R.L.
Email: [email protected]
Phone: +40 701 543 735