section 01
Who handles your data
The controller of your data is Zori Prăjitorie (demo), Str. Exemplului 12, Cluj-Napoca, tax ID RO00000000, J12/0000/2026. For any question about your data, write to salut@zori.demo with the subject “Personal data”.
We process data under Regulation (EU) 2016/679 (“GDPR”) and Romanian Law no. 190/2018. We have not appointed a data protection officer, as our activity does not require one, but a named person on the team handles these requests.
section 02
What we collect
- Identity and contact details: first name, last name, email, phone.
- Your address for delivery and, where relevant, invoicing.
- Order details: products, value, delivery and payment method, order history.
- Account details, if you create one, and your subscription preferences.
- Payment details: you enter these directly with the payment processor. We only receive confirmation of the transaction, never your card details.
- Messages you send us and our replies.
- Technical data: IP address, browser and device type, recorded automatically in server logs.
section 03
Purposes, legal bases and retention
Every purpose has a legal basis under Article 6(1) GDPR and a period after which we delete or anonymise the data.
| Purpose | Legal basis | How long we keep it |
|---|---|---|
| Taking, delivering and tracking your order | Performance of a contract, art. 6(1)(b) | The life of the contract, plus 3 years (the general limitation period) |
| Invoicing and accounting records | Legal obligation, art. 6(1)(c) (Accounting Law no. 82/1991) | 5 years from the end of the financial year |
| Your account and subscription | Performance of a contract, art. 6(1)(b) | Until you close the account or subscription |
| Answering messages and complaints | Legitimate interest, art. 6(1)(f) | Until resolved, then up to 1 year |
| Newsletter | Consent, art. 6(1)(a) | Until you unsubscribe |
| Usage statistics (analytics cookies) | Consent, art. 6(1)(a), and Law no. 506/2004 | Up to 13 months |
| Site security and fraud prevention | Legitimate interest, art. 6(1)(f) | 30 days for technical logs |
Purpose: Taking, delivering and tracking your order
- Legal basis
- Performance of a contract, art. 6(1)(b)
- How long we keep it
- The life of the contract, plus 3 years (the general limitation period)
Purpose: Invoicing and accounting records
- Legal basis
- Legal obligation, art. 6(1)(c) (Accounting Law no. 82/1991)
- How long we keep it
- 5 years from the end of the financial year
Purpose: Your account and subscription
- Legal basis
- Performance of a contract, art. 6(1)(b)
- How long we keep it
- Until you close the account or subscription
Purpose: Answering messages and complaints
- Legal basis
- Legitimate interest, art. 6(1)(f)
- How long we keep it
- Until resolved, then up to 1 year
Purpose: Newsletter
- Legal basis
- Consent, art. 6(1)(a)
- How long we keep it
- Until you unsubscribe
Purpose: Usage statistics (analytics cookies)
- Legal basis
- Consent, art. 6(1)(a), and Law no. 506/2004
- How long we keep it
- Up to 13 months
Purpose: Site security and fraud prevention
- Legal basis
- Legitimate interest, art. 6(1)(f)
- How long we keep it
- 30 days for technical logs
section 04
Who we share it with
We never sell or rent your data. We only share what each purpose needs:
- The courier or locker operator: name, phone and delivery address.
- The payment processor: what it needs to authorise a card payment.
- Our technical suppliers (hosting, email, accounting), who process data only on our instructions under a contract that meets Article 28 GDPR.
- Public authorities, only where the law requires it.
If a supplier processes data outside the European Economic Area, the transfer only happens with the safeguards set out in Article 46 GDPR, such as standard contractual clauses.
section 05
Your rights
Under Articles 15–22 GDPR, you have the right:
- to know what data we hold about you and to receive a copy (access);
- to have inaccurate data corrected (rectification);
- to have your data erased when we no longer have grounds to keep it;
- to ask us to restrict processing;
- to receive your data in a structured format or have it sent to another controller (portability);
- to object to processing based on our legitimate interest;
- to withdraw your consent at any time, without affecting processing carried out before;
- not to be subject to a decision based solely on automated processing. We make no such decisions.
Write to salut@zori.demo and we will reply within one month. For complex requests this can be extended by two further months, and we will tell you why.
section 06
Complaints to ANSPDCP
You can lodge a complaint at any time with Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28–30, sector 1, Bucharest, www.dataprotection.ro. We would love the chance to put things right first, though.
section 07
How we protect it
The site runs over an encrypted connection (HTTPS), only the colleagues who need your data can access it, and we choose our suppliers partly on their security standards. If an incident ever put your data at risk, we would tell you as required by Article 34 GDPR.
section 08
Children
The shop is meant for people aged 16 and over. We do not knowingly collect data about children younger than that.
section 10
Changes
When we change something important in this policy, we update the date at the top and, if you have an account, let you know by email.