1. Who we are
The data controller is SC ICA RESEARCH & DEVELOPMENT SRL, 202 Splaiul Independenței, ICECHIM Building, 4th floor, District 6, 060021 Bucharest, Romania, tax ID 25627251, Trade Register no. J2009006478404 (“ICA R&D”, “we”).
For questions or requests about the processing of personal data, write to [email protected] or to our registered address.
2. What data we process and why
The website does not require an account and uses no marketing or tracking cookies. We process personal data only when you send it to us through one of the forms:
| Form | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Contact | name, email, phone, company, message | answering your enquiry | Art. 6(1)(b) – steps prior to entering into a contract, or Art. 6(1)(f) – our legitimate interest in answering enquiries |
| Request a quote | name, company, email, phone, product, tests, number of samples | preparing and sending the quote | Art. 6(1)(b) |
| Company registration / recovery of portal access | name, company, tax ID, position, email, phone, message | creating or recovering client portal access for contracted clients | Art. 6(1)(b) |
| Send your CV | name, email, phone, position, the CV and the data in it, message | recruitment | Art. 6(1)(b); for keeping your CV for future openings – your consent, Art. 6(1)(a) |
Please do not include special-category data (for example health data) in your CV or messages unless necessary.
Form protection. To block automated spam, the forms use Cloudflare Turnstile, which analyses technical device data (for example IP address and browser characteristics) solely for this purpose. Legal basis: Art. 6(1)(f) – our legitimate interest in protecting the website.
Technical logs. On every visit, our server and the Cloudflare network through which the website is delivered automatically record technical data (IP address, date and time, page requested, browser type) for security and operation of the website. Legal basis: Art. 6(1)(f).
Visitor statistics. We use Cloudflare Web Analytics to see how often the pages of the website are visited. The service uses no cookies and does not identify you individually; for each visit it records technical data such as the page requested, the referring page, browser and device type and country, which we see only as aggregated statistics. Legal basis: Art. 6(1)(f) – our legitimate interest in knowing which information is useful to visitors and improving the website.
3. Client portal and laboratory data
The portal where clients track the status of their samples (intranet.ica-rd.ro) is a separate system available only to contracted clients. Test reports are not downloaded from the portal: we send them as PDF by e-mail. Processing of data in orders, in the portal and in reports is described in the service contract.
Information from laboratory activities (client data, samples and results) is confidential and treated as the client’s property. Samples move through the laboratory under codes only, and staff performing the tests have no access to client data. The full commitments are set out in the Impartiality and confidentiality statement.
4. How long we keep data
Personal data is kept only as long as needed for the purpose for which it was collected and as required by the laboratory’s legal and accreditation obligations:
- data in orders, contracts and test reports (name, position and contact details of contact persons): 5 years from the issue of the report, or longer where the law or the contract with the client sets a longer period;
- data in complaint correspondence: 4 years (1 year in the laboratory and 3 years in the archive);
- accounting documents (invoices, supporting documents): for the period set by accounting and tax law;
- messages sent through the contact form or by e-mail: copies of electronic correspondence may remain in the company’s backup systems for up to 20 years;
- CVs for a specific position: until the recruitment ends, then at most 6 months; if you tick the separate option in the form, at most 2 years for future openings (consent can be withdrawn at any time at [email protected]);
- the website’s technical logs: a few days on our server; at Cloudflare, according to its policy;
- visitor statistics: according to Cloudflare’s policy; we only see aggregated data.
When the period expires, the data is deleted on the basis of a record approved by the General Manager.
For questions or requests about the processing of personal data, write to [email protected].
5. Who receives the data
Data is accessed only by ICA R&D staff who need it for the purposes above (secretariat, sales, human resources). We use the following processors, under contract:
- Cloudflare, Inc. – the network through which the website is delivered (the website is hosted on an ICA R&D server), attack protection, Turnstile and visitor statistics (Web Analytics);
- Brevo (Sendinblue SAS, France) – the e-mail service that delivers form messages to our mailboxes.
For test orders, we also share data in the following cases:
- partner laboratories, for subcontracted tests, only with the client’s agreement given in the order; samples reach the partner under codes;
- competent authorities, where the law requires the laboratory to provide information, for example notification of results that are non-compliant or may endanger consumer health. The client is informed of this obligation when placing the order and, where the law allows, of each disclosure.
We do not sell personal data. Data collected in the course of the business relationship may be used for customer relationship management and for internal analysis (market research, satisfaction surveys, customer analysis and segmentation), on the basis of our legitimate interest in improving our services – Art. 6(1)(f) GDPR. You may object to this processing at any time by writing to [email protected].
Transfers outside the European Economic Area. Cloudflare may process data in the United States. Such transfers rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework and/or standard contractual clauses.
6. Cookies
The website sets no analytics, advertising or social-media cookies, which is why it does not ask for cookie consent. Visitor statistics (section 2) are collected without cookies. Fonts are self-hosted, so no requests are made to Google Fonts. Turnstile (section 2) may use technical mechanisms strictly necessary to protect the forms.
If we introduce tools using non-essential cookies in the future, we will ask for your consent before enabling them and update this page.
7. Your rights
Under Regulation (EU) 2016/679 (GDPR) you have the right of access, rectification, erasure, restriction of processing, data portability, the right to object (including to processing based on legitimate interest) and the right to withdraw consent at any time, without affecting the lawfulness of earlier processing.
To exercise your rights, write to [email protected] or to our registered address. We reply within one month of receiving your request.
You have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP, 28–30 G-ral. Gheorghe Magheru Blvd., District 1, Bucharest, www.dataprotection.ro.
8. Changes
We may update this policy when the way we process data changes. The date of the last update is shown below.
Last updated: 22 October 2026