Last updated: 27.10.2026
This Privacy Policy explains how GLOBIZ GROUP SRL collects, uses, stores and protects the personal data of its partners, their representatives and the visitors of the B2B platform www.carguard-b2b.com, as well as the rights you have in relation to that data.
1. Purpose and scope
This policy applies to all processing of personal data carried out through the www.carguard-b2b.com platform (the "Platform"), by e-mail, telephone, WhatsApp, the contact and registration forms and the lead forms of our advertising campaigns, in connection with the wholesale distribution of car accessories under the CARGUARD brand.
Processing is carried out in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data ("GDPR"), Romanian Law no. 190/2018 implementing the GDPR, Romanian Law no. 506/2004 on the processing of personal data and the protection of privacy in the electronic communications sector, and Romanian Law no. 365/2002 on electronic commerce.
The Platform is intended for professionals (legal entities, authorised self-employed persons and other entities carrying out an economic activity). The data we process mainly concern the contact persons and representatives of these entities.
2. Data controller and contact details
The controller of your personal data is:
- GLOBIZ GROUP SRL
- Registered office: Calea Borșului nr. 72, loc. Sântion, jud. Bihor, Romania
- Unique registration code (CUI): RO33163640
- Trade Register number: J20/1400/2014
- E-mail: iosif.budai@globiz.ro
- Telephone: +40 728 777 777 (Monday–Friday, 8:45–16:45, Romanian time)
Data Protection Officer (DPO): Budai József (Iosif Budai), e-mail: iosif.budai@globiz.ro. You may contact the Data Protection Officer with any question concerning the processing of your data and the exercise of your rights under the GDPR.
3. Definitions
- Personal data — any information relating to an identified or identifiable natural person (e.g. name, e-mail, telephone number, online identifier).
- Data subject — the natural person whose data are processed (e.g. the contact person of a partner).
- Controller — GLOBIZ GROUP SRL, which determines the purposes and means of the processing.
- Processor — a provider that processes data on behalf of and on the instructions of the controller.
- Partner — the business entity registered on the Platform in order to purchase products.
- Consent — a freely given, specific, informed and unambiguous indication of the data subject's wishes by which they agree to a given processing operation.
4. Categories of data we process
- Registration and account data: company name, tax identification/VAT number, trade register number, registered address, first and last name of the contact person, job title, e-mail address, telephone number, password (stored only in irreversibly encrypted form), preferred language, whether you run an online shop.
- Order and billing data: products ordered, delivery addresses, recipient name, order history, pro forma invoices and invoices, payments, payment terms, trade credit limit.
- Communication data: the content of messages sent by e-mail, WhatsApp, the contact form or the chat window, as well as notes made by our sales agents.
- Technical and browsing data: IP address (in server logs), browser and device type, pages visited, products viewed, searches made on the Platform, the source of the visit (e.g. the UTM parameters of a campaign), cookie identifiers (see the Cookie Policy).
- Data from advertising lead forms: the name, company, e-mail and telephone number you submit through the forms of our campaigns on Facebook/Instagram or through our landing pages.
- Public company data: public information about the company's activity (website, products sold, public social media profiles and their metrics), collected as described in chapter 8.
We do not process special categories of data (e.g. health data) and we ask you not to send us such data.
5. Purposes, legal bases and storage periods
| Purpose | Legal basis (Art. 6 GDPR) | Storage period |
|---|---|---|
| Creating, verifying and managing the partner account | Performance of a contract or pre-contractual steps (Art. 6(1)(b)) | For as long as the account exists; after it is closed, only the data needed to meet legal obligations |
| Checking the tax number in VIES and in the ANAF database | Legitimate interest in preventing fraud and applying the correct VAT treatment (f); legal obligation (c) | For as long as the account exists |
| Receiving, confirming, delivering and invoicing orders | Performance of a contract (b); legal obligation (c) | For the term of the contract, then according to the statutory archiving periods |
| Accounting records, electronic invoicing (RO e-Factura) | Legal obligation (c) — Romanian Accounting Law no. 82/1991, Fiscal Code | The periods laid down by financial and accounting legislation (usually 5–10 years) |
| Debt recovery, defence in legal proceedings | Legitimate interest (f) | Until the limitation period expires (usually 3 years) |
| Answering requests (contact, chat, WhatsApp, telephone) | Pre-contractual steps / contract (b); legitimate interest (f) | Until the request is resolved, then for the duration of the business relationship |
| Telephone contact of partners and prospective partners by our agents | Legitimate interest in developing B2B business relationships (f) | For the duration of the business relationship or until you object |
| Artificial intelligence assistance: public company profile, summaries of notes and conversations, suggestions for agents, replies in the chat window (chapter 8) | Legitimate interest in preparing and managing the B2B business relationship efficiently (f); for the chat: steps prior to entering into a contract (b) | Results are kept in the customer file for the duration of the business relationship; at the provider — only for the limited period set out in the data processing agreement |
| Newsletter and commercial communications by e-mail | Consent (a), confirmed by double opt-in | Until you unsubscribe |
| Welcome and information messages on WhatsApp | Consent (a) or pre-contractual steps (b) | Until consent is withdrawn |
| Monitoring visits to the Platform and follow-up tasks for agents | Consent (a) — via the cookie banner | Raw events: 90 days; visitor profile: 180 days |
| Measuring advertising campaigns (Meta Pixel, Conversions API) | Consent (a) — via the cookie banner | Until consent is withdrawn; data held by Meta — according to Meta's policy |
| Testing variants of the Platform (A/B) and measuring the registration funnel — aggregated statistics, random identifier, no personal data | Legitimate interest (f) | The cg_ab cookie: 30 days; events: 24 months |
| Platform security, server logs, abuse prevention | Legitimate interest (f) | The limited period necessary for security (logs are rotated periodically), except for incidents under investigation |
Where processing is based on legitimate interest, we have carried out an assessment to verify that this interest is not overridden by your rights and freedoms. You may request further information about this assessment from the Data Protection Officer.
Providing the data marked as mandatory in the registration and order forms is necessary to conclude and perform the contract; without these data we cannot create your account or deliver the products.
6. Sources of data
We mainly collect data directly from you (forms, orders, e-mail, telephone, WhatsApp). To verify companies, we retrieve public data from the European VIES system (European Commission) and from the public query service of the Romanian tax authority ANAF (name, address, registration number, VAT status). Data from Facebook/Instagram lead forms are transmitted to us by Meta Platforms Ireland Ltd. when you complete the form. Company contact details may also come from public sources (the company's website, public registers), in which case we inform you at the first contact. Public information about the company's activity may also be collected automatically from the internet with the help of the artificial intelligence assistant and the Apify service (see chapter 8).
7. Tax number verification and account approval
On registration we check the intra-Community VAT number in the VIES system. For Romanian companies without an intra-Community VAT number, we check the tax identification number in the public ANAF service; for companies from other countries without a VAT number, we check the format of the data and the final verification is carried out manually by an agent.
Every new account is created with the status "pending verification" and is activated only after approval by one of our employees. We do not take decisions based solely on automated processing that produce legal effects concerning you: the VIES/ANAF result is only a supporting element for a human decision. VAT exemption (reverse charge) applies only to a VAT number that is valid in VIES.
8. Use of artificial intelligence assistants
To work faster and better with our partners, we use the artificial intelligence assistant Claude, provided by Anthropic Ireland, Limited, acting as processor:
- Public company profile: when a new registration or enquiry arrives, the assistant searches the internet for public information about the company (website, activity, products sold, public social media profiles) and prepares a company sheet for our agent. For this search we transmit only public company data (company name, country, city, tax/VAT number, website or the domain of the e-mail address) — not the name, telephone number or e-mail address of the contact person. For the public social media pages found in this way, the Apify service (Apify Technologies s.r.o., Czech Republic) collects public metrics, for example the number of followers, the date of the last post and whether the company runs ads.
- Summaries and suggestions for agents: the assistant may summarise the agent's notes after a call, e-mail or chat conversations and the history of the relationship with the company, and may suggest replies to the agent during a conversation, based on the text entered by the agent.
- Chat window on the Platform: questions asked in the chat may receive a reply generated by the assistant; if the assistant cannot answer, the question is passed on to a colleague.
- Translation and internal search: translation of the Platform's texts (without personal data) and searching in our internal system.
Safeguards: before transmission, names, e-mail addresses, telephone numbers, IBANs and tax/VAT numbers are automatically replaced with temporary codes wherever this does not prevent the function concerned; confidential business data (for example purchase prices or credit limits) is not transmitted. The assistant's results are proposals checked by an employee and are not the basis of automated decisions producing legal effects concerning you (see chapter 7). Anthropic does not use our data to train its models and processes it only in accordance with the data processing agreement; processing may also take place in the USA, on the basis of the standard contractual clauses approved by the European Commission (see chapter 13). You may object to this processing at any time by writing to iosif.budai@globiz.ro or to the data protection officer.
9. Commercial communications: e-mail, newsletter and WhatsApp
- Account and order e-mails (confirmation of registration and of orders, pro forma invoices, invoices, notices of changes to the terms) are necessary for the performance of the contract and are not commercial communications.
- Newsletter: you subscribe by ticking the consent box and then confirming the subscription through the link received by e-mail (double opt-in). You may unsubscribe at any time through the link at the bottom of each message.
- Automatic information for online shops: if you indicate on registration that you run an online shop, we send you a short e-mail about the possibility of importing the catalogue via a data feed, without prices.
- WhatsApp: after you complete a form we may send you a welcome message in the language of your country via WhatsApp Business (provider: Meta Platforms Ireland Ltd.). You can stop these messages at any time by telling us on WhatsApp or through any other contact channel.
- Commercial communications by electronic means are sent in accordance with Article 12 of Romanian Law no. 506/2004; we do not buy or rent address lists.
10. Monitoring of visits to the Platform
The Platform records the pages visited, the products viewed, searches and cart actions on the basis of a random identifier stored in a first-party cookie (cg_vid), placed only after you have given your consent in the cookie banner. These events do not contain your e-mail address, telephone number or IP address.
If you are logged in to your partner account, visits are linked to your account so that our agents can see which products interest you and, after a period of inactivity of about 15 minutes, receive a task to call you and offer assistance. The purpose is the commercial support of partners, based on your consent (a) — via the cookie banner. You may withdraw this consent at any time from the cookie settings page; in that case we will no longer create call tasks based on your visits, and the cg_vid and cg_attr cookies will be deleted.
Raw events are deleted automatically after 90 days, and the visitor profile 180 days after the last visit.
11. Meta Pixel and Conversions API
Only if you have consented to marketing cookies, the Platform uses Meta Pixel and the Conversions API of Meta Platforms Ireland Ltd. to measure the effectiveness of our campaigns on Facebook and Instagram (pages visited, products viewed, searches, forms submitted). Events are sent to Meta both from the browser and directly from our server; the e-mail address and telephone number are only transmitted in irreversibly encrypted form (SHA-256 hash).
For the collection and transmission of these data, GLOBIZ GROUP SRL and Meta Platforms Ireland Ltd. are joint controllers (Art. 26 GDPR); any further processing by Meta is governed by Meta's privacy policy. Meta may transfer data to Meta Platforms, Inc. (USA) on the basis of the EU–US Data Privacy Framework and standard contractual clauses. You can withdraw your consent at any time on the Cookie Policy page.
12. Recipients of data and processors
Data are accessible only to those employees and agents of GLOBIZ GROUP SRL who need them to perform their duties. We do not sell personal data. We share data only with the following recipients, on a contractual basis and only to the extent necessary:
| Recipient | Role | Data / purpose |
|---|---|---|
| Hetzner Online GmbH (Germany) | Processor — server hosting | All Platform data |
| E-mail hosting provider | Processor — e-mail services | Correspondence, notifications, newsletter |
| GLS General Logistics Systems Romania SRL and, where applicable, other couriers (DPD, FAN Courier, Sameday) | Independent controllers / processors for delivery | Recipient name, address, telephone, parcel data |
| Meta Platforms Ireland Ltd. | Joint controller (Pixel/CAPI); provider of WhatsApp Business and lead forms | Browsing events, hashed data; WhatsApp messages; form data |
| Stripe Payments Europe Ltd. (Ireland) | Independent controller — card payment processing, only if this method is active | Payment data; card data never reach us |
| Anthropic Ireland, Limited (Ireland; processing also in the USA) | Processor — the artificial intelligence assistant Claude (chapter 8) | Public company data; notes, conversations and chat questions, with identifying data masked; texts for translation |
| Apify Technologies s.r.o. (Czech Republic) | Processor — collection of public metrics from companies' social media pages (chapter 8) | Public data of the company's pages |
| Accounting and invoicing software | Processor — accounting and invoicing | Billing data |
| ANAF, European Commission (VIES) | Public authorities | Tax number, for verification |
| Banks (Banca Transilvania, UniCredit Bank Hungary) | Independent controllers | Payment data |
| Public authorities, courts, lawyers, bailiffs | Recipients under a legal obligation or for the defence of a right | Only the data requested |
13. Transfers outside the European Economic Area
As a rule, we store data in the European Union. Where a provider processes data outside the European Economic Area (e.g. in the USA), the transfer takes place only on the basis of an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or of standard contractual clauses, together with supplementary safeguards where necessary. You may request a copy of the applicable safeguards.
14. Storage periods — general rules
We keep data only for as long as necessary for the purpose for which they were collected (see the table in chapter 5). Once the purpose has been achieved, the data are deleted or anonymised, except where the law requires us to keep them (e.g. financial and accounting documents under Romanian Law no. 82/1991) or where they are needed to establish, exercise or defend legal claims. Backups are overwritten periodically.
15. Your rights
As a data subject you have the following rights:
- right of access — to find out whether we process your data and to receive a copy of it (Art. 15 GDPR);
- right to rectification — to correct inaccurate or incomplete data; you can change some data directly in your partner account (Art. 16);
- right to erasure — in the cases provided for in Art. 17, except for data we are required by law to keep;
- right to restriction of processing (Art. 18);
- right to data portability — to receive the data you provided in a structured, commonly used format (Art. 20);
- right to object — to processing based on legitimate interest, including direct marketing, at any time and free of charge (Art. 21);
- right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- right not to be subject to a decision based solely on automated processing (Art. 22);
- right to lodge a complaint with the supervisory authority and the right to an effective judicial remedy.
16. How to exercise your rights. Complaints
Send your request by e-mail to iosif.budai@globiz.ro or to the Data Protection Officer, or by post to our registered office, stating which right you wish to exercise. To protect your data, we may ask you for additional identification information. We will reply free of charge within one month of receiving the request; this period may be extended by two further months for complex or numerous requests, in which case we will inform you.
If you believe your rights have been infringed, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, postal code 010336, Bucharest, Romania; tel. +40 318 059 211 / +40 318 059 212; e-mail: anspdcp@dataprotection.ro; www.dataprotection.ro. If you live or work in another Member State, you may also contact the supervisory authority of that State.
17. Data security
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction or alteration: encrypted connection (HTTPS), passwords stored only in irreversibly encrypted form, role-based access and authentication, access logging, backups and regular system updates. Processors are contractually bound to comply with the same standards of confidentiality and security.
In the event of a personal data breach that poses a risk to the rights of data subjects, we notify ANSPDCP within 72 hours of becoming aware of it and, where the risk is high, we inform the affected persons without undue delay.
18. User obligations. Third-party data. Minors
You are responsible for the accuracy of the data you provide and for keeping your account password confidential. If you provide us with data of other persons (e.g. colleagues added as users of the account or delivery recipients), you guarantee that you have informed them about this policy and that you have a legal basis for sharing the data. The Platform is not intended for persons under the age of 16 and we do not knowingly collect their data.
19. Changes to this policy
We may update this policy when our activity, the providers we use or the legislation change. The current version is permanently published on this page with the date of the last update. Significant changes are communicated to you by e-mail or by a message displayed on the Platform.
20. Related documents
Detailed information about cookies is available on the Cookie Policy page, and the terms of sale on the Terms and Conditions page. For any question about your data you can write to iosif.budai@globiz.ro.