Privacy & cookies
What data we take, why, who gets it and how long we keep it. Cookies are at the end.
Last updated: 23 September 2026
1. Who we are
The controller of your data is GGAFFAIRS S.R.L. (VAT ID RO52994476, Trade Reg. J2025091976005), Str. Mioriței, Nr. 59, Ap. 1, Târgu Mureș, Mureș County, Romania. For anything about your data: ggaffairsro@gmail.com or 0721 805 840.
2. What data, why, on what basis
| Purpose | Data | Legal basis (GDPR art. 6(1)) |
|---|---|---|
| Placing and delivering the order, order status messages (email/SMS) | name, email, phone, delivery address, products ordered | Contract (b) |
| Invoices and accounting records | name, address, email, order details | Legal obligation (c) |
| Card payment | card data goes straight to Stripe, never to us | Contract (b) |
| Answering questions and complaints | what you write to us, contact details | Legitimate interest (f) |
| Proof of your cookie choice and of withdrawal requests | date, choice/request, IP address, browser | Legal obligation (c) — we must be able to prove them |
| Fraud prevention and order checks (section 3) | IP address, device/browser, order history | Legitimate interest (f) |
| One SMS or call after delivery asking for a review (section 3) | name, phone, order | Legitimate interest (f); art. 12(2) Law 506/2004 — existing customers |
| Running the site, picking the language | IP address, browser type (collected automatically); the IP is checked locally for the language and does not leave our server | Legitimate interest (f) |
| Usage statistics (Google Analytics 4) and ad measurement (Google Ads) | pseudonymous ID, pages viewed, cart/order events | Consent (a) — only if you accept, see Cookies |
Contact and delivery data are required to conclude the contract; without them we cannot deliver the order. We do not sell and do not rent your data to anyone.
3. Fraud check and review request
Fraud risk score. Each order gets an automatic risk score (IP address, device/browser, order history). The score never rejects an order on its own — a person looks at it and, if needed, calls you. We take no automated decisions with legal or similarly significant effects on you.
Review request. After delivery we may send one SMS or make one call asking you to review the product. You can object free of charge at any time: reply STOP to the SMS or email us.
You can object to both (right to object, art. 21 GDPR) by writing to the address in section 1.
4. Who receives the data
- Delivery: EuroParcel (waybill platform) and couriers Sameday, FAN Courier, DPD — name, address, phone. For the Walking Pad only: our logistics partner in Germany that ships the parcel.
- Payments: Stripe (card payments) — Stripe policy.
- Invoices: Oblio.eu — name, address, email.
- SMS: Newsman — order SMS and the review request.
- Google: Gmail (the mailbox where orders and messages arrive); Google Fonts (the site font loads from Google servers, which see your IP address); Google Analytics 4 and Google Ads (only with your consent).
- Hosting: Datahost.ro — servers in Romania.
- Public authorities (ANAF etc.), when the law requires it.
5. Transfers outside the EEA
Google LLC and Stripe Inc. may transfer data to the USA. Both are certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision); Standard Contractual Clauses apply additionally where needed. You can ask us for a copy of these safeguards by email.
6. How long we keep it
- Orders and invoices: 5 years (tax law), together with the anti-fraud data attached to the order (IP address, device).
- Proof of cookie choices and withdrawal requests (date, IP address, browser): as long as needed to prove the consent or the request.
- Cookies and browser storage: the durations in the cookie table (Google Analytics up to 2 years, only with consent).
7. Your rights
You can ask us for: access to your data (a copy), rectification, erasure, restriction of processing, portability (a structured format). You can object at any time to processing based on legitimate interest (the anti-fraud check, the review request) and to direct marketing, and you can withdraw consent at any time, without affecting what was done before. Write to ggaffairsro@gmail.com.
If you think your rights were breached, you can complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP): www.dataprotection.ro, anspdcp@dataprotection.ro, B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest.
8. Security
HTTPS everywhere, access to data restricted to the people who need it, periodic backups. Card data never reaches our servers.
9. Changes
We update this page when something changes; the date at the top shows the last update.