Legal information
Privacy notice and GDPR information
This notice explains which personal data we process through atgserv.ro, why we use it and how you can exercise your rights.
1. Data controller
The controller of personal data processed through this website and Mara is:
- legal name: ATG SERVICES S.R.L.;
- Romanian tax identification number: 50268922;
- Trade Register number: J40/12374/2024;
- registered office: 13 Intrarea Guliver, entrance 3, apartment 640, District 6, 060576 Bucharest, Romania;
- email: office@atgserv.ro;
- telephone: +40 737 337 227.
2. Data we process
Through the contact form we may receive your name, email address, telephone number, selected topic and message. Fields marked as required are necessary to identify and answer the enquiry; the telephone number is optional.
When the website is accessed, the technical infrastructure may generate logs containing an IP address, date and time, requested URL, HTTP method and status code, browser and device information, and data needed to prevent abuse and diagnose incidents.
3. Purposes and legal bases
- answering enquiries and taking pre-contractual steps requested by the data subject — Article 6(1)(b) GDPR;
- operating, securing, diagnosing and protecting the website and systems — our legitimate interests under Article 6(1)(f) GDPR;
- meeting legal, tax, accounting or public-authority obligations — Article 6(1)(c) GDPR;
- establishing, exercising or defending legal claims where necessary — legitimate interests.
We do not use contact-form data for newsletters or automated marketing without separate, specific consent that can be withdrawn easily.
4. Recipients and providers
Data may be accessed only by authorised personnel and providers strictly needed for hosting, security, maintenance and email, within their applicable roles and contractual duties. Data may be disclosed to authorities, advisers or courts where required by law or necessary to defend a right. We do not sell personal data.
5. International transfers
We aim to use providers that process data in the European Economic Area. If a provider involves a transfer outside the EEA, the transfer takes place only under an adequacy decision or GDPR-recognised safeguards, such as standard contractual clauses, together with necessary supplementary measures. You may request information about applicable safeguards using the contact details above.
6. Retention periods
- enquiries that do not lead to a contract: generally no longer than 24 months after the last interaction;
- data connected with contracts, invoicing or legal duties: for the relationship and afterwards under applicable statutory retention and limitation periods;
- technical and security logs: generally no longer than 30 days, unless needed for longer to investigate an incident or defend a right.
Data is deleted or anonymised when its purpose and retention obligations end.
7. Cookies and measurement
As of this update, the public website does not use advertising or behavioural analytics cookies and does not provide a newsletter. If we introduce non-essential technologies, we will update this notice and, where required, obtain consent before activation.
8. Your rights
Subject to the GDPR, you may request access, correction, deletion, restriction, portability and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.
To exercise your rights, email office@atgserv.ro. We may request reasonable information to verify identity. We normally respond within one month, subject to the extensions permitted by the GDPR.
You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing or the competent authority where you live or work.
9. Automated decisions and profiling
We do not use data submitted through the website for solely automated decisions producing legal or similarly significant effects, and we do not conduct commercial profiling through this website.
10. Security and user responsibility
We apply technical and organisational measures proportionate to the data. No internet transmission can be guaranteed to be completely risk-free. Do not include passwords, card details, special-category data or confidential information that is unnecessary for your enquiry.
11. Mara telephone assistant
Current status: internal testing pilot. The number is used by the test team and is not distributed for customer use. Incoming calls are not filtered by originating number. The contractual basis for the calendar held through a personal account must be clarified before customer launch.
Mara is ATG Services' artificial intelligence agent for information, appointment requests and messages. She identifies herself as AI at the start. Staff review requests; Mara is not used to assess people or make solely automated decisions with legal or similarly significant effects.
Speech and request data
Speech is processed and automatically transcribed to support the conversation. Depending on your request, we use your name, email, confirmed contact telephone, network-reported originating number, message and requested appointment time. Operational call/conversation identifiers and timestamps are also processed. Caller ID may be hidden or inaccurate and is not proof of identity.
Audio recording is not enabled in Mara's configuration, but the conversation provider may retain a transcript. Absence of a recording does not mean speech is not processed. Do not provide passwords, authentication codes, national identity numbers, card details or unnecessary medical information. The ElevenLabs workspace setting allowing model training on submitted data has been disabled; this does not promise retrospective removal of any earlier training use.
For saved appointments, the full transcript of the conversation with Mara is automatically copied into the appointment notes after the call, identifying caller and Mara turns. The local and calendar copies are retained for 14 days after the meeting ends and then erased with the appointment; the 14-day period after the call continues to apply to the conversation provider copy and telephony metadata. No audio recording is attached. If you object to this copying, tell Mara before saving and contact staff for human handling of the appointment.
Purpose, basis and human assistance
We process data to answer your enquiry and enable staff to handle an appointment or callback. Article 6(1)(b) GDPR applies to necessary steps you request in relation to a contract to which you are a party. For other communications, including company representatives, and reception operation/security, we assess the legitimate interest in managing communications and protecting the service under Article 6(1)(f), respecting necessity and callers' rights. Continuing a call is not treated as blanket GDPR consent. Mara data is not reused for marketing or profiling.
You can request general information without giving a name or email. Saving a request may require contact details; without them, we may be unable to follow up. If you do not want AI assistance, ask for a colleague or contact office@atgserv.ro or +40 737 337 227. Transfer depends on office hours and staff availability; leaving a message is optional.
Providers and transfers
The flow uses Twilio for telephony, ElevenLabs and its subprocessors for speech recognition, conversation and synthetic speech, Google for the calendar and ATG's application infrastructure. The backend is in Romania; provider configurations also involve processing outside the EEA, including the United States. We do not claim that the entire flow stays in the EU.
Transfers are subject to the GDPR safeguards applicable to recipients. Providers publish the Twilio DPA, ElevenLabs DPA and Google DPA, with mechanisms such as applicable adequacy decisions or standard contractual clauses. You may request information about recipients, safeguards and applicable limitations from our contact address. Availability of those documents does not mean every provider processes exclusively in the EU.
Separate retention for telephone requests
Mara requests and calendar entries have a retention period of 14 days after callback completion or the end of the meeting, separate from website enquiry retention in section 6. Project conversations and operational call metadata have a period of 14 days after the call. Future appointments and unresolved requests are not deleted just because 14 days have passed since the call; staff review them daily. Automated deletion runs periodically; failures remain for remediation.
ATG-controlled backups are encrypted, excluded from routine use and have a residual window of at most another 7 days after active deletion for disaster recovery. Restores remain isolated pending reconciliation with current erasure/completion history. Application/calendar deletion does not guarantee immediate physical erasure of all provider copies: for example, Google's deletion provisions allow up to 180 days in their specified circumstances. Provider residual periods and independent obligations are separate from ATG's backup window. Subsequent contract/tax records have separate rules.
Rights and corrections
Mara can misunderstand a name, email or date; correct it during confirmation or contact staff. The rights and process in section 8 also apply to this channel. Ask for human help or send requests to office@atgserv.ro; Mara does not autonomously execute GDPR requests or confirm erasure. This is the privacy contact and does not imply appointment of a DPO.
12. Updates
We may update this notice when the website, providers or legal requirements change. The current version is published on this page. Last updated: 2 November 2026.