Skip to content

Privacy Policy

Last updated: August 20, 2026

Who we are

Endurance Lift Solutions International SRL ("ELSI", "we", "our", or "us") is the data controller for personal data processed through this website (endurancelift.ro). Our registered office is at Sat Negoiești, comuna Brazi, str. Piatra Craiului nr. 7, Hala 9, Zona Industrială DIBO, județul Prahova, România. Full company registration details are listed in our Legal Notice.

What personal data we collect

We collect personal data you provide to us directly, a small amount of information that our administrators enter about colleagues in order to run the employee portal, and minimal technical information needed to operate the website. Specifically:

  • Contact-form submissions: full name, email address, company name (optional), phone number (optional), inquiry type, and the message you write.
  • Email correspondence: anything you choose to send to elsi.contact@endurancelift.com or any other email address published on this site.
  • Job applications: your CV and cover letter and everything you choose to put in them — contact details, education, employment history, technical skills, certifications, and any referee details you include.
  • Employee portal (invite-only sign-in, internal users only): work email, full name, department, job title, work telephone number, your reporting line (who your manager is, as shown in the org chart), your role in the portal (employee or administrator), and an avatar where one is set. It also stores the content you create in the portal — announcements you author, comments you post, and emoji reactions you leave — with your name against it. Your profile card, your telephone number, and your position in the org chart are visible to every other signed-in colleague. Your name, department, job title, manager, and role are maintained by ELSI administrators and are not editable by you; your telephone number is yours to change.
  • Org-chart entries created by ELSI administrators: so that the org chart is complete, an administrator may create a directory entry about a colleague before that colleague has a portal account. Such an entry contains name, work email, department, job title, work telephone number, and reporting line, and is obtained from ELSI's internal HR and management records rather than from the person it describes. If an entry about you was created this way, this section is your notice under Article 14 GDPR: the source is ELSI's own records, the lawful basis is Article 6(1)(f) (our legitimate interest in maintaining an accurate internal directory and org chart), and the entry is visible to all signed-in colleagues. You can ask us to correct or remove it at any time using the contact details below.
  • Technical request logs: IP address, user agent, requested URL, and timestamp are temporarily recorded by our hosting provider for security and abuse-prevention purposes; we do not use these logs for marketing or analytics.

We do not use cookies, pixels, or scripts for advertising, profiling, behavioural tracking, or third-party analytics on the public website. See our Cookie Policy for the full cookie inventory.

Why we process it (lawful basis)

Under the EU General Data Protection Regulation (GDPR), every processing purpose requires a lawful basis. Ours are:

  • Responding to inquiries (contact form, email): Article 6(1)(b) — pre-contractual measures taken at your request — when your message relates to a quote or potential order; otherwise Article 6(1)(f) — our legitimate interest in answering inbound questions from prospective customers, partners, and candidates.
  • Job applications sent to any published careers email address: Article 6(1)(b) — pre-contractual measures.
  • Employee portal: Article 6(1)(b) — necessary to perform your employment or contractor agreement — for your account and your position in the org chart; and Article 6(1)(f) for the internal-communication features, namely our legitimate interest in keeping employees informed of company announcements and in maintaining an accurate internal directory and org chart so colleagues can reach the right person. We have documented the balancing test for that legitimate interest and will send it to you on request.
  • Security logging and abuse prevention: Article 6(1)(f) — our legitimate interest in keeping the website available and protecting it from spam, automated abuse, and attack.
  • Compliance with Romanian or EU legal obligations (e.g. responding to a lawful authority request): Article 6(1)(c).

Providing your data is never a statutory obligation. For the contact form, the name, email address, inquiry type, and message are needed for us to reply — without them we cannot answer you; the company and phone fields are optional and leaving them blank has no consequence. For a job application, the data in your CV is needed for us to assess you for the role. For the employee portal, an account is necessary for you to carry out your role. We do not make any decision about you by automated means, and we do not carry out profiling.

Who we share it with

We do not sell personal data and do not share it for third-party marketing. Personal data is disclosed to the following recipients, each acting as our processor under a written data-processing agreement meeting the requirements of Article 28 GDPR, except where stated otherwise:

  • Supabase Pte. Ltd (Singapore) and its affiliates, trading as Supabase — hosts our employee portal database and authentication service. Processor. Data is stored in and may be accessed from Singapore and the United States. Neither country benefits from an EU adequacy decision for this transfer, so it is made under the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 (Module 2, controller to processor), incorporated in Supabase's Data Processing Addendum, together with the transfer impact assessment Supabase publishes.
  • Vercel, Inc. (United States) — hosts and delivers this website. Processor. Vercel is certified under the EU-US Data Privacy Framework (Commission adequacy decision (EU) 2023/1795), so transfers to Vercel rely on that adequacy decision.
  • Plus Five Five, Inc., trading as Resend (United States) — delivers transactional emails (contact-form notifications, portal invitations, password resets). Processor. Resend is certified under the EU-US Data Privacy Framework and its UK Extension, so transfers to Resend rely on that adequacy decision.
  • Google LLC — only if you choose to open our address using an 'Open in Google Maps' link. We do not embed Google Maps on the page itself, and Google acts as an independent controller once you leave our site.
  • Romanian and EU public authorities — only where we are legally required to disclose (for example a court order or a regulator request).

You can obtain a copy of the Standard Contractual Clauses we rely on, and of the related transfer impact assessment, free of charge by emailing elsi.contact@endurancelift.com with "Transfer safeguards" in the subject line.

How long we keep it

We retain personal data only as long as needed for the purpose it was collected for:

  • Contact-form messages: up to 24 months from receipt, unless the inquiry results in a commercial relationship — in which case it is retained for the duration of that relationship and for as long as required by Romanian commercial and tax law (typically 10 years for accounting records).
  • Job applications: up to 12 months from submission, unless you ask us to keep them longer for future openings.
  • Employee portal: your account, profile, telephone number, org-chart position, comments, and reactions are deleted within 30 days of the end of your working relationship with ELSI. Your statutory personnel file is held separately by our HR department under Romanian labour and archiving law and is not part of the portal.
  • Org-chart entries for colleagues who do not yet have a portal account: kept for no longer than 12 months from creation, then deleted if they have not been converted into an account.
  • Technical request logs: rotated automatically by our hosting provider, typically within 30 days.

Your rights

Under the GDPR, you have the right to:

  • Object — you have the right to object at any time, on grounds relating to your particular situation, to any processing we base on our legitimate interest (Article 21 GDPR). If you object, we must stop unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. Where we ever process for direct marketing, you can object at any time and we must stop without exception.
  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — ask us to delete your data, subject to legal retention obligations.
  • Restriction — ask us to limit how we use your data in certain situations.
  • Portability — receive your data in a structured, machine-readable format.
  • Withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, email us at elsi.contact@endurancelift.com. We will respond within one month, as required by the GDPR. If you are unhappy with our response, you have the right to lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania, email anspdcp@dataprotection.ro, web https://www.dataprotection.ro.

Security

We use HTTPS for all traffic, store portal data in a managed PostgreSQL database protected by row-level security, restrict administrative access to a small number of authenticated staff, and follow industry-standard practices for secret management. No internet-facing system can guarantee absolute security; if we ever become aware of a personal-data breach that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and inform affected individuals where the GDPR requires it.

Children

This website is aimed at business audiences (oil & gas operators, partners, suppliers, job candidates) and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our processors, or applicable law. The 'Last updated' date at the top of the page indicates the most recent revision. Material changes will be highlighted on the website.

Contact us

For any questions about this Privacy Policy or our processing of your personal data, contact us at elsi.contact@endurancelift.com or write to Endurance Lift Solutions International SRL, Sat Negoiești, comuna Brazi, str. Piatra Craiului nr. 7, Hala 9, Zona Industrială DIBO, județul Prahova, România.