ACME Laser Romania

GDPR — your data rights

Last updated: 25 October 2026

In the event of any discrepancy, the Romanian version prevails.

1. What is the GDPR?

The General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 — is the European law that governs how companies collect, use and protect the personal data of individuals in the European Union.

In Romania, the GDPR is supplemented by Law no. 190/2018 on measures implementing the Regulation. The authority that supervises its application is the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, the Romanian data protection authority).

ACME Laser Romania fully complies with the GDPR. This page explains what rights you have and how you can exercise them.

2. Who processes your data

Data controller: ACME Laser Romania SRL Registered office: Str. Giordano Bruno nr. 9, postcode 400243, Cluj-Napoca, Cluj County, Romania CUI: RO51729544 Reg. Com.: J2025031303003

GDPR contact person:

3. Your rights under the GDPR

a) Right of access (Art. 15)

You have the right to find out whether we process data about you and, if so, what data we process. On request, we will provide you with a copy of all your personal data in our possession, free of charge, within one month.

b) Right to rectification (Art. 16)

You have the right to ask us to correct inaccurate data or to complete incomplete data about you.

c) Right to erasure — “right to be forgotten” (Art. 17)

You have the right to request the erasure of your data if:

  • The data are no longer necessary for the purpose for which they were collected
  • You have withdrawn your consent and there is no other lawful basis
  • You object to the processing and we have no compelling legitimate grounds
  • The data have been processed unlawfully
  • Erasure is required by a legal obligation

Exception: we are required by law to retain some data (e.g. invoices — 5 years, counted from 1 July of the year following the end of the financial year, under Romanian Accounting Law no. 82/1991, Article 25). In these cases, we will tell you why we cannot erase them.

d) Right to restriction of processing (Art. 18)

You can ask for your data to be stored only, without being used, in situations such as: you contest the accuracy of the data, the processing is unlawful but you do not want the data erased, or you have objected to the processing and we are verifying whether our legitimate interests prevail.

e) Right to data portability (Art. 20)

You have the right to receive the data you have provided in a structured, commonly used and machine-readable format (e.g. CSV, JSON, XML) — and to transmit them to another controller. This applies only to data processed on the basis of consent or a contract, by automated means.

f) Right to object (Art. 21)

You can object to the processing of your data:

  • For direct marketing — your objection is absolute; we stop immediately
  • For processing based on legitimate interest — we assess the objection and stop if we cannot demonstrate compelling legitimate grounds

g) Right not to be subject to automated decision-making (Art. 22)

You will not be subject to decisions based solely on automated processing (including profiling) that produce legal effects concerning you or significantly affect you. ACME Laser Romania does not use automated decision-making.

Where we process data on the basis of your consent (e.g. for a newsletter), you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

i) Right to lodge a complaint (Art. 77)

If you consider that your rights have been infringed, you can lodge a complaint with the ANSPDCP directly:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal

You also have the right to bring proceedings before the competent courts.

4. How to exercise your rights — step by step

Step 1 — Send your request

Send a written request by email to office@acmelaser.ro or by post to Str. Giordano Bruno nr. 9, postcode 400243, Cluj-Napoca, Cluj County, Romania. The request must contain:

  • Your full name
  • The email address or phone number you used to interact with us
  • The right you are exercising (access, erasure, rectification, etc.)
  • Relevant details (which data, from which period, the reason)

Step 2 — Identity verification

For your protection, we may ask for reasonable proof of identity before processing the request (e.g. confirmation from the email address you used to interact with us). We never ask for a copy of your identity card — we only carry out proportionate checks.

Step 3 — Response

We reply within one month of receiving the request. In complex cases, this period may be extended by a further two months, and we will inform you of this in advance.

Step 4 — Cost

Processing your requests is free of charge. Exception: manifestly unfounded or excessive requests (e.g. frequently repeated ones), for which we may charge a reasonable fee or refuse to process them.

5. GDPR request form (template)

If you wish, you can use the following simple format:

To: ACME Laser Romania SRL
Subject: Request to exercise GDPR rights

I, [Full name] (email: [email] and/or
phone: [phone]), wish to exercise the following
right under the GDPR:

[ ] Access to personal data
[ ] Rectification of data
[ ] Erasure of data (“right to be forgotten”)
[ ] Restriction of processing
[ ] Data portability
[ ] Objection to processing
[ ] Withdrawal of consent

Additional details:
[description]

Date: [DATE]
Signature: [Full name]

6. Notification of personal data breaches

Under Articles 33–34 GDPR, if a personal data breach affects your data and poses a high risk to your rights, we will notify you without undue delay, by email or by other appropriate means.

We also notify the ANSPDCP within 72 hours of becoming aware of the breach.

7. Transfer of data outside the EU

Certain providers we work with (Google, cloud services) may process data outside the EU/EEA. In these cases, the transfer takes place on the basis of an adequacy decision of the European Commission (Article 45 GDPR) — for the USA, the EU-US Data Privacy Framework — or of standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR).

The full list of recipients can be found in the Privacy policy.

For a complete picture of how we process your data, please also see:

9. Contact us

For any GDPR question, please write to us:

Email: office@acmelaser.ro Phone: +40 774 501 662 Address: Str. Giordano Bruno nr. 9, postcode 400243, Cluj-Napoca, Cluj County, Romania Hours: Monday–Friday, 09:00–17:00

We reply to all requests within one month, in accordance with the GDPR.