Legal · GDPR · Data Protection

Privacy Policy

Profispace SRL (Romania) operates henleypower.eu on behalf of Henley Power Limited, the commercial entity behind the Henley Power brand based in Dezhou City, Shandong Province, China. Profispace SRL is the sole data controller under GDPR Article 4(7) for personal data collected through this website. As an EU-incorporated entity, no separate GDPR Article 27 representative is required. We collect contact form submissions, bankability dossier requests, and standard server logs to respond to commercial enquiries and qualify project leads. Data is processed by Hostinger, Cloudflare, and Kommo CRM. Retention is 24 months for active enquiries and 7 years for compliance records. You hold full GDPR rights of access, rectification, erasure, portability, and objection.

Last updated: 10 May 2026 · Effective from publication date · Version 1.0

1. Data Controller

Profispace SRL

AFI Lakeview, etaj 5, Barbu Văcărescu 301-311, Sector 1, București, România, 020276

CUI: 50324496 · RC: J40/13149/2024

Email: sales@henleypower.eu

Profispace SRL is the sole data controller under GDPR Article 4(7) for personal data collected through henleypower.eu. Profispace SRL decides why and how this data is processed, retains it, selects sub-processors, and responds to data-subject requests. Profispace SRL is EU-incorporated (Romania), making a separate GDPR Article 27 EU representative unnecessary. Henley Power Limited (the commercial entity behind the Henley Power brand, based in Dezhou City, Shandong Province, China) is a third party to which qualifying commercial enquiry data may be transferred under GDPR Chapter V, as described in Section 6 below.

Where commercial enquiry data is forwarded to Henley Power Limited for project qualification, technical specification, or feasibility review, this is a controller-to-third-party transfer under GDPR Chapter V, not joint controllership. Profispace SRL remains the sole data controller and the contact point for all data-subject rights under this Privacy Policy. Equipment-specific data flows after contract signature are governed by the individual signed supply contract per project.

2. What We Collect

We collect personal data only when you actively provide it or when it is technically necessary to operate the site.

Information you submit

Contact form — name, company, email, phone (optional), country, project description.
Bankability dossier request — name, company, role, email, project location, capacity range.
Direct correspondence — anything you choose to send to sales@henleypower.eu.

Information collected automatically

Server logs — IP address, browser, referrer, pages visited, timestamps. Retained 30 days for security and abuse-prevention.
Essential cookies — see the Cookie Policy.

3. Why We Process It (Legal Basis)

We rely on the following GDPR Article 6 grounds:

Article 6(1)(b) — performance of a contract or pre-contractual steps at your request (responding to commercial enquiries, preparing quotations, exchanging technical specifications).
Article 6(1)(f) — legitimate interests in qualifying project leads, defending legal claims, and securing the website against abuse.
Article 6(1)(c) — legal obligations under tax, export-control, and consumer-law records.
Article 6(1)(a) — your consent, when given through a cookie banner choice or opt-in form.

4. Who Processes It (Sub-Processors)

We share data with the following sub-processors under written processing agreements:

Processor	Purpose	Location
Hostinger International Ltd	Website hosting	Lithuania (EU)
Cloudflare, Inc.	CDN, DDoS protection, bot management	USA (DPF-certified)
Kommo Inc.	CRM for sales enquiries	USA (DPF-certified)
Instantly.ai	Outbound email, only for commercial recipients	USA (DPF-certified)
Google LLC	Web fonts (no analytics)	USA (DPF-certified)

Sub-processors do not use your data for their own purposes. Contracts include the EU Standard Contractual Clauses where required.

5. International Transfers

Personal data is processed in Romania (controller establishment) and may be transferred to the United States via the sub-processors listed above. Limited categories of commercial enquiry data — name, company, project capacity and location — may be shared with Henley Power Limited (manufacturer and commercial counterparty) for technical specification, capacity confirmation, and project feasibility review. Safeguards used:

EU-US Data Privacy Framework certification (US sub-processors).
Standard Contractual Clauses where DPF does not apply.
Transfer to Henley Power Limited (manufacturer in Dezhou City, Shandong Province, China) limited to legitimate-interest basis (Article 6(1)(f)) for commercial enquiry handling and project qualification, under Article 49(1)(b) where applicable (transfer necessary for performance of pre-contractual steps at the data subject’s request).

6. Retention

Active commercial enquiries — 24 months from last contact.
Closed quotations and project files — 7 years (tax, export, contract evidence).
Server logs — 30 days.
Cookie consent records — 12 months.

After these periods, data is deleted or anonymised.

7. Your Rights

Under GDPR you have the right to:

Access the data we hold about you.
Request correction of inaccurate data.
Request erasure (“right to be forgotten”) where applicable.
Restrict or object to processing.
Receive your data in a portable, machine-readable format.
Withdraw consent at any time, without affecting prior processing.
Lodge a complaint with your national supervisory authority.

To exercise any of these rights, email sales@henleypower.eu with the subject line “GDPR request”. We respond within 30 days.

8. Cookies

Cookie usage is described in the separate Cookie Policy. henleypower.eu uses only essential cookies. We do not deploy advertising or tracking cookies.

9. Security

The site runs over TLS 1.3, behind Cloudflare DDoS and bot-management. Access to enquiry data is restricted to authorized personnel by individual login. We do not store payment information on this domain — invoicing happens through bank channels outside the website.

10. Children

henleypower.eu is a B2B site for utilities, EPCs, developers, and project finance teams. We do not knowingly collect data from anyone under 16. If you believe a minor has submitted data, contact us and we will delete it.

11. Changes to This Policy

Material changes are announced on this page with an updated version number and effective date. Continued use of the site after a change constitutes acceptance of the revised policy.

12. Contact

Privacy enquiries: sales@henleypower.eu

Subject line: “GDPR request” for fastest routing.

Postal: Profispace SRL, AFI Lakeview, etaj 5, Barbu Văcărescu 301-311, Sector 1, București, România, 020276.

EU residents may also lodge a complaint with their national data-protection authority. A directory is available at edpb.europa.eu.