Privacy notice.

Controller and contact

The controller for this website is MAR & PET GRUP S.R.L., fiscal ID 15455744, trade-register number J2004001290293, EUID ROONRC.J2004001290293. Its registered office is 41 Școlii Street, Drăgănești village, Drăgănești commune, 107210, Prahova, Romania. Privacy requests may be sent to partener@marpet.ro. See company information.

What we collect and why

We process the contact details, project description, page and campaign attribution, and—when used—the validated Vision 3D technical snapshot you submit. The purpose is to review your request, contact you, prepare a quotation, maintain a reliable Lead ID audit trail and measure platform-originated opportunities. When Google Analytics 4 is available and you accept optional analytics, we use it to understand how the website is used (pages viewed, traffic sources, language, device type and approximate location) and which pages lead to a contact request, so that we can improve content and assess our channels. We do not use this data for advertising or to profile individuals. We do not use a request as a marketing subscription without separate consent.

Legal bases and required information

For an individual asking about a potential contract, we use information supplied in an enquiry to take steps at that person’s request (GDPR Article 6(1)(b)); without contact details and a description we cannot respond. For business representatives and limited security, abuse-prevention and lead-audit data, we rely on the legitimate interest in answering enquiries and protecting the service (Article 6(1)(f)), subject to your rights. Optional product and contact-click analytics and Google Analytics 4 website statistics, including the storage of Google Analytics cookies on your device, use your separate consent (Article 6(1)(a) GDPR and the national rules implementing the ePrivacy Directive), which you may refuse or withdraw. Contractual, accounting or legal records are processed where a legal obligation applies (Article 6(1)(c)). Romanian Law 190/2018 supplements the GDPR where applicable; it does not replace these grounds. There is no solely automated decision with legal or similarly significant effect: Mara and Vision 3D do not approve offers, prices or technical feasibility.

Lead ID and returning-visitor key

Each accepted request receives a unique Lead ID whether or not optional analytics is accepted. Only after optional consent, a first-party, HTTP-only pseudonymous cookie may be retained for up to 24 months to link later enquiries. After refusal, the enquiry still works without this cookie. The database stores only a one-way fingerprint, not its raw value.

Who receives the data

Operational notifications are sent to the approved MAR&PET and PXP500 recipients responsible for commercial follow-up and reporting. Infrastructure providers include Supabase for the lead register and authentication, Cloudflare for network delivery, Hetzner for application hosting, and Resend for transactional email. When Google Analytics 4 is available and you accept optional analytics, Google Ireland Limited (with Google LLC) provides Google Analytics 4 and acts as our processor for the measurement data, under Google’s data processing terms. Google receives measurement data only after you accept.

International processing

The lead database is hosted by Supabase. Transactional notifications sent through Resend include the lead’s contact and request content as well as delivery metadata; Resend may process this information in the United States under its contractual transfer safeguards. Strict EU-only processing is therefore not claimed for the current notification path, nor for Google Analytics 4 when it is enabled: Google may process measurement data in the European Economic Area and in other countries, including the United States. Transfers rely on the adequacy decision for the EU–US Data Privacy Framework where the recipient is certified and, where needed, on the Standard Contractual Clauses in Google’s data processing terms.

Optional analytics: product journeys, commercial contact clicks and Google Analytics 4

Only if you accept optional analytics, content-free lifecycle events record the product, language, an allowlisted step and a random first-party browser UUID. The UUID contains no account or contact data, stays in localStorage for no more than 30 days, and is then rotated; the server stores only a separately domain-separated HMAC. Reports count active pseudonymous browser clients, sessions and sessions per client. These are not people or accounts: one person can be counted on several browsers or devices, several people can share a browser profile, and clearing storage creates a new client. We may also record activation of an explicitly marked commercial email or telephone link. That event contains the channel, selected MAR&PET contact, link placement, pathname, language, limited UTM values and time. Neither telemetry path contains your message or call content, email address, telephone number, full URL, referrer, raw IP address, User-Agent or the cookie key used for leads. A separate one-way rate-limit token derived from the network address is retained for no more than 48 hours and is never shown in the report. A click indicates contact intent only: it does not prove that a message was sent or a call was made and does not create a Lead ID, commercial alert or marketing subscription. Contact-click events and content-free product telemetry have an approved 90-day retention period. The statements in this section about content-free telemetry (for example, that no User-Agent or raw network address is included) describe our own measurement only. Google Analytics 4 is described separately below. You may decline or withdraw permission at any time from Analytics settings without affecting product use or contact links.

Google Analytics 4. If you choose Accept in the analytics banner or settings, we load Google Analytics 4 (Google tag). We do not load the Google tag before you accept or after you decline. Withdrawal stops measurement and removes Google Analytics cookies.

What is measured: page addresses limited to the site origin and path, the fixed title MAR&PET Systems, the referring site origin only, language, browser and device type, approximate location at country or region level derived from the network address, session and engagement data, and a small set of events: sending a contact, quotation or partner form (without its content), clicks on telephone and e-mail links, downloads of technical documents and quotation requests made from Vision 3D. We do not send URL query parameters, fragments or UTM values to Google. The page title does not include visitor content, and the referrer excludes its path and query. Measurement excludes your name, e-mail address, telephone number and message text.

Identifiers: Google Analytics sets two first-party cookies, _ga and _ga_<ID>, which hold a randomly generated identifier so that visits from the same browser can be recognised. Details are in our cookie policy.

Network address: Google Analytics 4 does not log or store individual IP addresses. Collection of city-level location and granular device data is disabled for this property.

No advertising use: Google signals and advertising features are turned off; the consent signals for advertising storage, advertising data and ad personalisation remain denied. We do not use Google Analytics for remarketing.

Google Analytics retention: The property retains event-level and user-level data for 14 months. With each new event, the retention period for the user identifier resets to 14 months from that activity. These retention controls do not limit standard aggregated reports. Browser cookie lifetimes are separate and are explained in the cookie policy.

Your choice: you can decline or withdraw at any time from Analytics settings (footer link). When you withdraw, measurement stops and the Google Analytics cookies are removed from your browser. Product use and contact links work the same either way.

Retention

The attribution cookie is kept for no more than 24 months. Prospect lead records with personal data have an approved retention period of 365 days from their latest recorded activity. Converted or won customers follow the separately applicable contract, dispute, accounting and legal-obligation periods. When Google Analytics 4 is enabled, its cookies last up to two years from your last visit unless you delete them earlier or withdraw your consent. The separate retention controls for Google Analytics data are described above when the service is enabled.

Your choices and rights

You may request access, correction, deletion, restriction, portability where applicable, or object to legitimate-interest processing, and may withdraw consent where it is the applicable basis. You may complain to the Romanian supervisory authority, ANSPDCP, or another competent authority. Withdrawing consent does not affect processing already performed lawfully. Our cookie policy explains browser storage and how to change analytics consent. Withdrawing consent in Analytics settings also stops Google Analytics 4 measurement. For Google Analytics you may additionally use Google’s opt-out browser add-on. Requests about measurement data may be sent to partener@marpet.ro. To honour a refusal even when saving it to the server fails, functional localStorage entry marpet:analytics-refused records the refusal on this browser. It is removed when you accept again successfully or clear browser storage.

Security and data minimisation

Access to the lead register is restricted to five approved identities with role-based permissions and an immutable event trail. Vision 3D submissions store a reduced technical snapshot; locally selected photographs and raw editor history are not included in the lead record.

Your conversation with Mara

Mara keeps no more than 24 messages locally, separately for each language and browser tab. The session expires and is deleted automatically within 24 hours; “New conversation” deletes it immediately.

Only when server AI is enabled may the message and recent history be sent to OpenAI. Before moderation and generation, detectable patterns for a declared name, email, phone number, address and postal code are replaced automatically. Redaction is an additional safeguard and cannot guarantee de-identification of arbitrary free text, so do not enter personal data. Requests use store: false. For abuse prevention, the network address is immediately converted to an ephemeral process-specific HMAC and deleted within 60 seconds; the raw address is not stored.

Before generation, the message and recent client-provided conversation history may be checked by OpenAI’s moderation service. Flagged lines are removed from the context sent for generation. For safety controls, a first-party HttpOnly cookie contains a random UUID, is limited to /api/mara and is kept for no more than 30 days; OpenAI receives only a derived HMAC, never the raw UUID, visitor network address or browser User-Agent. When the internal measurement service is enabled, content-free telemetry includes session lifecycle, language and an allowlisted step and, for AI calls, operation, status, model, prompt version, exact latency and token counts. Cost is shown only when a versioned rate is configured; otherwise it is “neinstrumentat”. The session identifier is HMACed, without message or conversation-history content. With optional analytics consent, a random first-party browser UUID is kept in localStorage and rotated within 30 days; the server retains only a separately domain-separated HMAC. It measures active pseudonymous browser clients and sessions per client, not people or accounts, and one person may appear more than once across devices. The approved policy retains content-free telemetry for 90 days.

Contact details from the quote form are not copied into the conversation automatically. Page context sent for analysis includes only an allowed public path, without URL query parameters or the fragment after #.

The Vision 3D natural-language field is interpreted locally first. Only when optional AI refinement is enabled may the redacted request and a reduced technical configuration be sent to OpenAI with store: false; contact details and images are excluded, and the model cannot impose authoritative technical values.