Privacy Policy

1. Data Controller

2. What Data We Collect

We collect the following categories of personal data:

• Identity data: First name, last name
• Contact data: Email address, phone number, delivery address, billing address
• Transaction data: Order history, payment information (processed securely by third-party payment providers)
• Technical data: IP address, browser type, device information, pages visited
• Communication data: Emails and messages you send to us

3. Why We Collect Data

We process your personal data for the following purposes:

• Order processing: To fulfill your orders, process payments, and arrange delivery
• Communication: To send order confirmations, shipping updates, and respond to your inquiries
• Legal obligations: To comply with tax, accounting, and regulatory requirements
• Service improvement: To analyze website usage and improve our products and services
• Fraud prevention: To detect and prevent fraudulent transactions

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your data based on the following legal grounds:

5. Data Sharing

We may share your personal data with the following categories of third parties, solely for the purposes described above:

• Payment processors: To securely process your payments (e.g., PayPal, credit card processors)
• Shipping carriers: To deliver your orders
• IT service providers: Hosting and website maintenance

6. Data Retention

We retain your personal data only for as long as necessary:

• Account data: For the duration of your account, plus 3 years after last activity
• Order data: 10 years (as required by Romanian tax law)
• Marketing consent: Until you withdraw consent
• Website analytics: 26 months

7. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access — Request a copy of your personal data
• Right to rectification — Request correction of inaccurate data
• Right to erasure — Request deletion of your personal data ("right to be forgotten")
• Right to data portability — Request your data in a structured, machine-readable format
• Right to restrict processing — Request limitation of how we use your data
• Right to object — Object to processing based on legitimate interest or for direct marketing
• Right to withdraw consent — Withdraw previously given consent at any time

To exercise any of these rights, please email us at info@shoplydealkraft.shop. We will respond within 30 days.

8. Cookies

Our website uses cookies to improve your browsing experience. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include SSL encryption, secure payment processing, access controls, and regular security assessments.

10. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). If any data transfer outside the EEA is necessary (e.g., for payment processing), we ensure adequate protection through EU-approved Standard Contractual Clauses or adequacy decisions.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "last updated" date. We encourage you to review this page periodically. Significant changes will be communicated via email where possible.

12. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority. In Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP).