Legal information

Privacy policy

How we process the personal data of visitors to bidli.tech and of people who contact us. Short and factual: this website uses no tracking cookies and no third-party tools.

Effective from October 15, 2026

01Who is the controller

The controller of your personal data is BIDLI TECHNOLOGY S.R.L., 40–44 Banul Antonache St., Office MRSF 40, 1st floor, Sector 1, Bucharest, Romania, Unique Registration Code (CUI) 54919365, Trade Register No. J2026039173007.

For any data-protection matter, write to romania@bidli.tech or by post to our registered office.

We have not appointed a data protection officer, as Article 37 GDPR does not require us to.

Processing is governed by Regulation (EU) 2016/679 (GDPR) and by Romanian Law No. 190/2018.

02What we process and why

PurposeDataLegal basisRetention

Handling your enquiry and preparing an offer (form, e-mail, phone)Dataname, company, e-mail, phone, area of interest, message, selected country and language, time sentLegal basisArt. 6(1)(b) GDPR — steps taken at your request before entering into a contract; for company representatives Art. 6(1)(f) — legitimate interest in communicating with business partnersRetentionwhile the enquiry is handled, at most 24 months after our last contact; if we sign a contract, for its duration and statutory archiving periods

Solar configurator and address suggestionsDataaddress of the property (street, number, postcode, town, country) and its coordinates; aerial image of the building with the panel layout; your device’s location — only if you click “Use my location” and your browser allows it; your choices in the configuratorLegal basisArt. 6(1)(b) GDPR — steps taken at your request before entering into a contractRetentionthe text you type into the address field is only passed on to look up suggestions and is not stored; coordinates and the aerial image with the layout are deleted after 48 hours; a submitted enquiry (including the image we e-mail to you) is kept as above

Secure operation of the websiteDataIP address, date and time, page requested, browser type (server logs)Legal basisArt. 6(1)(f) GDPR — legitimate interest in security and preventing abuseRetentionbriefly, only as long as needed for security; then deleted automatically

Remembering your country and languageDatacountry and language code (e.g. “gr.en”) — no personal dataLegal basisstorage strictly necessary for a service you requested (Art. 5(3) Directive 2002/58/EC); no consent neededRetention12 months, or until you delete it in your browser

Defending legal claimsDataenquiry data and our correspondenceLegal basisArt. 6(1)(f) GDPR — legitimate interestRetentionfor the limitation period, if a dispute is reasonably likely

We do not use your data to send advertising. If you would like news from us, we will ask you separately.

03Who receives your data

We do not sell your data or share it with other companies for their marketing. Only authorised staff and processors bound by a contract under Article 28 GDPR have access:

ACTIVE 24, s.r.o., Prague (Czech Republic) — web hosting and @bidli.tech mailboxes: runs the website, sends the form, receives e-mail
Microsoft Ireland Operations Limited, Dublin (Ireland) — Microsoft 365, the @bidli.cz mailboxes where enquiries are delivered
BIDLI technologie, a.s., Prague (Czech Republic) — a BIDLI group company that helps handle enquiries and provides IT
Seznam.cz, a.s., Prague (Czech Republic) — the Mapy.com service: address suggestions in the solar configurator. Requests go through our server, so Seznam.cz only receives the address text you type (or coordinates if you use your location) — not your name, contact details or IP address
Google Ireland Limited, Dublin (Ireland) — Google Solar API and Maps Static API: aerial image of the building and roof panel layout in the Solar Planner. Requests go through our server, so Google only receives the coordinates of the address — not your name, contact details or IP address
public authorities, only where the law requires it

We store data in the European Union. In limited cases (e.g. technical support) Microsoft may make data accessible to its affiliates in the USA; such transfers rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework, Art. 45 GDPR) and standard contractual clauses (Art. 46 GDPR). Likewise, Google may process the address coordinates in its companies in the USA (EU–US Data Privacy Framework, Art. 45 GDPR). No other transfers outside the European Economic Area take place.

04Cookies and browser storage

This website uses no analytics, advertising or other tracking cookies and loads no third-party content — fonts, map and graphics are served from our own server. That is why we do not ask for cookie consent.

When you choose a country and language in the header, we store your choice so it applies next time:

bidli-pref — a cookie and local browser storage holding only the country and language code, valid for 12 months

You can delete it at any time in your browser settings. The Facebook, Instagram and LinkedIn icons are plain links: nothing is sent to these networks unless you click them.

05How we protect your data

The connection to the website is encrypted (HTTPS), the form is protected against automated submissions, and access to enquiries is limited to the people who handle them. The enquiry backup is stored outside the public part of the server and is deleted automatically when the retention period ends.

06Your rights

You have the right to:

access your data and obtain a copy (Art. 15 GDPR)
have inaccurate data corrected (Art. 16)
erasure (Art. 17)
restriction of processing (Art. 18)
data portability (Art. 20)
object to processing based on legitimate interest (Art. 21)

Just write to romania@bidli.tech. We will reply without undue delay, within one month at the latest, free of charge. To avoid disclosing data to the wrong person, we may ask you to verify your identity.

07Complaints to a supervisory authority

If you believe we handle your data unlawfully, you may lodge a complaint with a supervisory authority, in particular in the country where you live, work or where the alleged infringement took place (Art. 77 GDPR). We would be glad to resolve it with you directly first.

National Supervisory Authority for Personal Data Processing (ANSPDCP)B-dul G-ral Gheorghe Magheru 28-30, sector 1, 010336 București
Website: www.dataprotection.ro · E-mail: anspdcp@dataprotection.ro

08Further information

Providing your data is voluntary, but without your name, e-mail and a description of your enquiry we cannot reply. We do not make automated decisions or create profiles (Art. 22 GDPR).

The website is intended for businesses, investors and adults. We do not knowingly process data of children under 16.

We update this policy when our processing or the law changes. The current version is always on this page.