We protect the customer, the order and the factory.

Identity and contact

Name, phone, email (optional), locality, company, role and contact person.

Enquiry and order

Products, measurements, sketches, photographs, site or delivery address, quotation, order, documents, communications and confirmed instructions. Our team keeps short notes of calls, visits and messages with you and the day agreed for the next contact.

Delivery

The name of the person receiving the goods, a typed signature, a delivery photograph and the driver's note, as proof of handover.

Commercial and financial

Accepted prices and terms, deposit, balance and payment status. No card data is collected through the site.

Technical and security

For visitors: a cryptographic pseudonym of the IP address (not the address itself), a short browser label, timestamps and abuse limits. For Europrofill staff: the IP address, device and browser used to sign in.

Your request and contract · (b)

To respond, calculate, prepare a quotation, perform the order, collect payment, manufacture, deliver and communicate about the same relationship. The name and phone number are needed to contact you; without them we cannot answer the request. The other fields are optional.

Legal obligations · (c)

For accounting and tax records, warranty, archiving and responses to authorities or courts.

Legitimate interests · (f)

Security of the site, systems and factory; prevention of abuse and fraud (logs, usage limits); proof of delivery; business contact with companies that apply to become partners; establishing, exercising or defending rights. You may object at any time (art. 21); we review the request and stop if our interest does not prevail.

Consent · (a)

Separately for our own statistics and for advertising tools (Meta, Google, TikTok); for WhatsApp notifications about an order or quotation, only if you asked for them. You can withdraw it at any time from “Cookie settings” in the site footer or by writing to us.

No unsolicited marketing

We do not send advertising by SMS, email or WhatsApp without separate consent, and we do not add enquiry data to marketing lists.

• the data is accurate, current and sufficient for the requested purpose, and you will tell us about relevant changes;
• you have the right to send the data, photographs, drawings and documents and, if they concern another person, you have the required authority and have informed them where the law requires it;
• you do not submit sensitive data, another party’s trade secrets, passwords, card details, identity-document copies or data about minors; our services are not directed at children under 14 (art. 8);
• you keep secure links, tracking codes, passwords and access to the email account or device used for the order confidential, and notify us immediately if you suspect compromise;
• you check the quotation, measurements, colour, quantity, address and other written confirmations before ordering or production.

We may ask for clarification and remove content that is unnecessary, unlawful or unsafe. Inaccurate or incomplete data may delay or prevent quotation, production, payment or delivery.

ep_public_locale12 months

Strictly necessary. Keeps the language you selected.

ep_order_tracking_visitor30 days

Strictly necessary. Anonymously separates search limits on the order-verification route and prevents guessing of order numbers.

ep_roofing_assistant_visitor30 days

Strictly necessary, set only when you use the adviser. Applies usage limits and protects the adviser against abuse.

Roof summarythis tab, up to 24 hours

Keeps only the selected profile, purpose and dimensions. Conversation and contact details are not stored in the browser. You can clear the summary in the adviser.

europrofillConsentV312 months

Strictly necessary. Keeps your per-category choice and a random choice identifier in the browser. After 12 months we ask again.

Proof of choice36 months

The server keeps the random choice identifier, the categories chosen, the language and the date — no IP address or contact data — so we can demonstrate consent (art. 7(1)).

ep_analytics_consentup to 12 months

Only with statistics consent. Tells the server that consent was given and is removed when you refuse or withdraw.

ep_analytics_collector15 min

Only with statistics consent. A signed token that prevents false data from being sent to our statistics.

europrofillAnalyticsVisitorV1

Only with statistics consent. A random identifier in the browser; the server keeps only its hash. It is removed from the browser when you refuse or withdraw consent.

europrofillAnalyticsSessionV130 min

Only with statistics consent. Separates a browsing session and is removed when consent is withdrawn.

Own statistics90 / 400 days

Consent only. We measure public pages, labelled interactions, normalised click positions, active time, scrolling, language, device class, referring domain and UTM parameters. When a form is submitted, the session may be linked to the enquiry's internal reference to evaluate campaigns. We do not keep the name, phone, form values, IP address or user agent.

Meta · Google · TikTok

Only with advertising consent. They receive the page visited, campaign parameters, the enquiry event, source and an estimated value, plus technical data set by the platform, and may set the cookies _fbp, _fbc, _ga, _gid, _gcl_*, _gac_*, _ttp and ttclid. Meta pixel automatic configuration is switched off; we do not send the name, phone, email or form text. When you refuse or withdraw consent, we delete these cookies from our domain.

Session storage

Strictly functional: the intro animation state, the calculator configuration and the adviser's technical choices. It holds no contact data and disappears when the tab is closed.

Advertising platforms apply their own retention periods. Withdrawing consent stops future events; data a platform has already received is governed by its policy. You can change your choice at any time from “Cookie settings” in the site footer.

• authorised Europrofill staff, by role, in Sales, Management, Production, Accounting, Security and Delivery;
• providers working for Europrofill as processors under a contract (art. 28), listed below;
• banks, accountants, carriers, lawyers, auditors, insurers, authorities and courts, to the extent needed for the operation, the law or the defence of a right;
• a successor in a reorganisation or asset transfer, only with data minimisation and in compliance with the law.

Providers and platforms

Transfers to European Economic Area states need no additional safeguards (art. 44(2)). To other states, including the USA (for example Meta, Google, TikTok, Kie.ai and, where applicable, hosting), we transfer data only where the NCPDP has recognised an adequate level of protection or under standard clauses approved by the NCPDP or adopted by the European Commission (arts. 45–46). You may request a copy of the applicable safeguards at the email address in this policy. NCPDP standard contractual clauses (opens in a new tab).

Site enquiries

Quotation, calculator, adviser and partnership requests: 12 months from the last activity, then erased.

Customers without orders

Customers who never ordered and quotations that did not become an order: 24 months from the last activity, then anonymised.

Contact log

Our team's notes of calls, visits and messages: 24 months from the note, then erased; erased at once when the customer record is anonymised.

Orders and payments

For the relationship and 6 years counted from 1 January of the year after the last order, for accounting records, then anonymised. If you ask for erasure before then, we keep only the buyer identity in the documents.

Proof of delivery

The photograph, typed signature, recipient name and note: 36 months from delivery (the general limitation period), then erased.

Technical projects

The customer's name, contact details and address in a roof project: 24 months from the last change.

Messages sent

The recipient and text of WhatsApp, SMS or email notifications: 6 months.

Security

Security and activity logs: 12 months. Staff sessions: 90 days after they end.

AI adviser

Filtered summary of an unanswered question: 30 days. Telemetry without identifiers: 13 months. At Kie.ai: two months, according to the provider.

Statistics

Events: 90 days. The hashed visitor record and sessions: 400 days without activity.

Consent

The choice in the browser: 12 months. Proof of the choice on the server: 36 months.

• We reply free of charge within one month of receiving the request. For complex requests the period may be extended by two more months; we tell you within the first month (art. 12).
• To avoid disclosing someone else’s data, we confirm identity through the contact details in our records; we do not ask for copies of identity documents.
• Erasure cannot remove data the law requires us to keep (for example accounting records); in that case we restrict it and tell you until when.
• If we refuse a request in full or in part, we explain why and how you can challenge the decision.

We do not use the AI adviser or statistics to make a solely automated decision that produces legal effects or significantly affects you. Quotations, orders and commercial exceptions are confirmed by authorised staff.