1. Introduction

This Privacy Policy describes how ROMAY AG and its affiliated companies — ROMAY Sp. z o.o. and ROMAY Co., Ltd. — collect, use, and protect personal information when you visit our website or interact with us. We are committed to protecting your privacy and ensuring that all personal data is processed in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and relevant national legislation.

2. Data Controller

The entities responsible for processing your personal data are:

ROMAY AG
Gontenschwilerstr. 5, CH-5727 Oberkulm, Switzerland

ROMAY Sp. z o.o.
ul. Topolowa 8
55-200 Stanowice, Poland

ROMAY Co., Ltd. Qingdao
XinghaiZhi Road No. 2, Huanhai Economical & Technical Developing Zone, Chengyang, Qingdao, China

For privacy-related inquiries, please contact us at: info@romay.ch

3. Data We Collect

We may collect limited personal data when you interact with our website or communicate with us by email or other means. This may include:

Basic identification data (name, company name, position, business contact details)
Communication data (content of correspondence, email exchanges)
Technical information (IP address, browser type, operating system, date and time of access)

We do not intentionally collect sensitive personal information.

4. Purpose of Processing

We process your personal data only for the following legitimate business purposes:

Responding to business inquiries and maintaining professional communication
Managing ongoing or potential business relationships with clients, suppliers, and partners
Fulfilling contractual and legal obligations
Ensuring the proper operation, security, and performance of our website and IT systems

5. Legal Basis for Processing

We process your personal data based on one or more of the following legal grounds:

Performance of a contract or steps taken prior to entering into a contract
Compliance with a legal obligation
Legitimate interest in maintaining and developing our business relationships and protecting our assets
Consent, where expressly provided

6. Data Retention

We keep your personal data only for as long as necessary to fulfill the purposes described above or as required by applicable law. When data is no longer needed, it is securely deleted or anonymized.

7. Data Sharing

We do not sell or lease your personal information. However, we may share your data with:

Other ROMAY entities (Switzerland, Poland, China) for administrative and operational purposes
Service providers who support our business operations (e.g., IT, hosting, auditing)
Legal authorities if required by applicable law

All parties processing data on our behalf are contractually obliged to protect it and handle it in compliance with data protection regulations.

8. International Data Transfers

If your personal data is transferred outside the European Economic Area (EEA), we ensure that adequate safeguards are in place — such as Standard Contractual Clauses (SCCs) approved by the European Commission — to maintain an appropriate level of protection.

9. Your Rights

You have the right to:

Request access to your personal data
Request correction or deletion of inaccurate data
Object to the processing of your personal data
Withdraw consent at any time (where applicable)
Request data portability

To exercise these rights, please contact us at info@romay.ch. We will respond to your request in accordance with applicable legal requirements.

10. Security of Your Data

We apply appropriate technical and organizational measures to ensure that your personal data is protected against unauthorized access, alteration, loss, or destruction. Access to personal data is restricted to authorized personnel only and handled in accordance with our internal security policies.

11. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements or in our operations. The latest version will always be published on our website.

Last updated: October 2025

Extending IRIS Certification