The controller of the personal data described here is Razvan Toma (Dragos Razvan Toma), trading as EPR EU Rep, Madrid, Spain. This policy covers epreurep.com and the services we contract through it and our country sites. Questions and requests: hello@eprfrancerep.com. Our services are for businesses; the personal data we process is mostly that of your contact persons and signatories.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, work email, company, country and message from the contact form or your emails | Answering your enquiry and preparing a quote | Steps at your request before a contract, Art. 6(1)(b); our legitimate interest in answering business enquiries, Art. 6(1)(f) |
| Company details, VAT and tax numbers, signatories' names, positions, contact details and ID documents; packaging and product quantities | Performing the service: mandates, registrations, scheme membership, declarations, client portal | Performance of the contract, Art. 6(1)(b); legal obligations under EPR law, Art. 6(1)(c) |
| Billing details and payment information (card data is handled by Stripe, not stored by us) | Payments, invoices, renewals | Contract, Art. 6(1)(b); tax and accounting law, Art. 6(1)(c) |
| Technical data needed to deliver the website (IP address in server logs) | Security and operation of the site | Legitimate interest, Art. 6(1)(f) |
We do not use your data for advertising, do not sell it and do not make automated decisions about you.
Some of these providers are based in, or use systems in, the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
Enquiries that do not lead to a contract: up to 12 months. Client and contract data: for the duration of the service and then for 6 years, as Spanish commercial law requires for business records (Código de Comercio, art. 30), or longer where EPR or tax law requires declarations to be kept for longer. Invoices and accounting records: as long as tax law requires.
You can ask for access to, rectification or erasure of your personal data, restriction of or objection to its processing, and data portability, by emailing hello@eprfrancerep.com. We answer within one month. Some data we must keep by law, even if you ask for erasure. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or the authority where you live or work.
This website sets no cookies and uses no advertising or tracking tools. The client portals use a session cookie only to keep you signed in.
We update this policy when our processing changes. The version date is at the top.