Privacyand personal data

1. Who processes your data

The data controller is the company identified in the block below. We have not appointed a Data Protection Officer (DPO) as our activity does not meet the criteria in Art. 37 GDPR. For any request regarding your data, contact us directly at the addresses shown.

2. What data we collect

When you visit the site we collect: IP address (anonymized), browser type, pages visited, viewing times. When you start WhatsApp conversations, contact details you share (name, phone) are processed by Meta per their policies. For the admin account we collect email and an encrypted password through Supabase.

3. Legal basis for each data category

Browsing data (IP, browser, pages visited) — legitimate interest (Art. 6(1)(f) GDPR) for traffic analysis and site security. Contact data shared via WhatsApp (name, phone, messages) — performance of contract or pre-contractual measures (Art. 6(1)(b) GDPR). Contractual and identification data (national ID, address, IBAN, ID copy) — contract performance (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c) — invoicing, AML). Fiscal and customs data — legal obligation (Art. 6(1)(c) GDPR; Romanian Tax Code; Union Customs Code). Analytics and marketing cookies — consent (Art. 6(1)(a) GDPR; Law 506/2004). Admin account data (email, encrypted password) — contract performance (Art. 6(1)(b)).

4. Cookies and similar technologies

We use necessary cookies (session, language), analytics (Google Analytics), marketing (Google Ads, Meta Pixel — optional, opt-in), and influencer tracking (unique links with ?ref= parameter). Full details on the /cookies page.

5. Who we share data with and international transfers

Supabase (database hosting — Frankfurt, EU; no external transfers for customer data). Vercel (site hosting — EU; occasional transfers to the US covered by EU Standard Contractual Clauses / SCC). Google (Analytics + Ads, if you consented) — transfer under the EU-US Data Privacy Framework, with Google certified under that framework. Meta (WhatsApp Business, Pixel) — transfer under the EU-US Data Privacy Framework. Carfax / AutoDNA receive only the vehicle VIN, with no customer personal data. Romanian authorities (ANAF, RAR) — on legal request.

6. How long we keep data

Analytics data: 26 months (Google Analytics limit). Transaction data: 10 years (fiscal obligation). Admin account data: until the account is closed. Influencer data: 36 months from last activity. Marketing cookies: max 13 months.

7. Your rights

Access — request a copy of your data. Rectification — correction of incorrect data. Erasure — "right to be forgotten" for non-fiscal data. Restriction — limit processing. Portability — receive data in a machine-readable format. Objection — to processing based on legitimate interest. Withdrawal of consent — anytime, for cookies and marketing.

8. How to exercise your rights

Send an email to salut@americanelite.eu with your request. We respond within 30 days, free of charge. For repeated or manifestly unfounded requests, we may charge a reasonable fee.

9. Complaints

You have the right to lodge a complaint with a data protection supervisory authority. In our case the lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — https://www.dataprotection.ro, Bd. G-ral. Gheorghe Magheru 28-30, sector 1, Bucharest. Under Article 77 GDPR, you may also lodge the complaint with the supervisory authority in your member state of residence. List of European data protection authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

10. Automated decisions and profiling

We do not use exclusively automated decision-making processes that produce legal effects on you. All material decisions (accepting an order, payment terms, approving a shipment) are made by our team.

11. Minors

Our services are not directed at persons under 18 and we do not knowingly collect personal data from minors. If a parent or guardian believes a minor has provided us with data, they can contact us to have it deleted.

12. Mandatory nature of providing data

To enter into an import contract, certain data (full name, national ID, address, payment details) are mandatory by law and for contract performance. Refusing to provide them makes contracting impossible. Browsing data and non-essential cookies are optional and do not condition use of the site.

13. Policy changes

This policy may be updated. Major changes will be announced on the homepage at least 14 days before taking effect.