1. Who we are
BOX2M Engineering S.R.L. ("BOX2M", "we") is the controller of the personal data described here. Registered office: Str. Ale. Slt. Adrian Cârstea nr. 3, Sector 3, 031839 Bucharest, Romania. Trade register: J2016014125400 (J40/14125/2016). VAT: RO36678072.
For anything about your data, write to [email protected]. We have not appointed a data protection officer, as our activity does not require one; we answer these requests directly.
2. What this policy covers
This policy covers visitors to box2m.com, people who contact us, the people we work with at customers, partners and suppliers, and business contacts we reach out to. Data inside BOX2M OS is covered by the customer's contract; see section 9. We process personal data under Regulation (EU) 2016/679 (GDPR) and Romanian Law 190/2018.
3. What we collect and why
We collect only what we need for each purpose, and we don't sell personal data or use it for advertising.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Answer your request | Name, company, work email, phone, country, role, your message and anything you send us | Steps you ask for before a contract, and our legitimate interest in answering business enquiries (GDPR art. 6(1)(b) and (f)) | Up to 3 years after our last exchange, unless it leads to a contract |
| Work with customers, partners and suppliers | Contact details of the people we work with, correspondence, contracts, invoices | Contract (art. 6(1)(b)) and legal obligations such as accounting and tax (art. 6(1)(c)) | For the contract, then as long as Romanian accounting and tax law requires |
| Tell companies about BOX2M | Business contact data that companies or public registers publish: name, job title, company, work email or phone | Our legitimate interest in presenting our services to businesses (art. 6(1)(f)). Reply to any of our emails, or write to us, and we stop. | Until you object, or 3 years without any interaction |
| Keep the website secure and working | IP address, browser, pages requested and time, in server logs | Legitimate interest in security and reliability (art. 6(1)(f)) | 30 days |
We don't run visitor statistics or tracking on box2m.com, we don't make decisions about you by automated means alone, and we don't build profiles for advertising.
4. Where the data comes from
Mostly from you: the contact form, emails, calls and meetings. For business contacts we reach out to, from the company's own website, public company registers and professional networks such as LinkedIn. If we contacted you, you can ask us at any time where we found your details, and we stop whenever you ask.
5. Who we share it with
- Service providers working for us under a written contract: email and web hosting, the infrastructure that runs our website and BOX2M OS, IT support and accounting. They may use the data only on our instructions.
- Partners, only when you ask us to put you in touch, or for a joint project you have agreed to.
- Authorities, when the law requires it.
We don't use advertising networks, social-media plugins or third-party trackers on box2m.com.
6. Outside the EU
We keep personal data in the European Union. If a provider ever needs to process it outside the European Economic Area, we use only countries with an EU adequacy decision or the European Commission's standard contractual clauses.
7. Your rights
Under the GDPR you can ask us to:
- give you a copy of your data (access) or send it to you in a portable format;
- correct it, or delete it where we no longer need it;
- restrict how we use it;
- stop using it for our legitimate interests, including for telling you about BOX2M (objection); we always stop contacting you when you ask;
- withdraw your consent at any time, where we rely on it, without affecting what happened before.
Write to [email protected]. We answer within one month; for complex requests we may extend this by two months and will tell you why. If you think we got it wrong, you can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal): B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest · [email protected] · +40 318 059 211 · www.dataprotection.ro.
8. How we protect it
Connections to box2m.com and BOX2M OS are encrypted (HTTPS and TLS). Access to personal data is limited to the people who need it, with individual accounts. BOX2M OS adds multi-factor authentication, per-user rights and an audit trail.
9. BOX2M OS customers
When a customer uses BOX2M OS, the customer decides what data the platform processes, and BOX2M processes it on the customer's behalf under the service contract and its data processing terms. Meter and sensor readings are usually not personal data. They can become personal data when they can be linked to a person, for example a tenant who is an individual. User accounts hold a name, work email, the phone number used for alarms, and login and activity logs. Customers' users should read their employer's privacy notice and can contact us through their employer or at [email protected].
10. Changes
We update this policy when what we do changes, and show the date of the latest version here. Version: September 2026.