Privacy Policy
Version in force from 13 October 2026.
1. Who processes your data
The data controller is ALBINI PRASSA SRL, Str. Belgrad nr. 10-12, Sector 1, Bucharest, Romania, VAT/registration code RO31985610, Trade Register no. J40/8615/2013. Contact for any data question: andrei@albiniprassa.com, phone +40 723 408 480.
2. What data we process
– Order data: name, delivery and billing address, email, phone, products ordered, order and return history. Card details are collected directly by the payment processor; we neither see nor store them.
– Customer account data: name, email, password (encrypted), saved addresses.
– Newsletter: email address and, where applicable, your interactions with our emails (opens, clicks).
– Contact form: name, email, phone and the message you send.
– Technical and browsing data: IP address, device and browser type, pages visited, products viewed or added to cart, traffic source, cookie identifiers.
3. Why we process it and on what legal basis
– Processing, delivering and returning orders, communication about orders, warranty and service: performance of a contract (Art. 6(1)(b) GDPR).
– Invoicing and accounting records: legal obligation (Art. 6(1)(c) GDPR).
– Customer account: performance of a contract, at your request.
– Replying to messages sent through the contact form, by email or by phone: steps prior to entering into a contract or our legitimate interest in answering customers (Art. 6(1)(b) and (f) GDPR).
– Newsletter and email offers: your consent (Art. 6(1)(a) GDPR). The sign-up box is never pre-ticked; you can unsubscribe at any time using the link in every email.
– Traffic statistics (Google Analytics) and personalised advertising (Google Ads, Meta): consent given through the cookie banner (Art. 6(1)(a) GDPR).
– Website security and fraud prevention: legitimate interest (Art. 6(1)(f) GDPR).
We do not take decisions based solely on automated processing that produce legal effects concerning you.
4. Who receives your data
We use the following providers, who receive data only as far as needed for the service they provide to us:
– Shopify International Limited (Ireland): online store platform, hosting of order and account data, card payment processing through Shopify Payments. Details: https://www.shopify.com/legal/privacy.
– Klaviyo, Inc. (USA): newsletter and marketing emails; receives store customer and order data, subscribers' email addresses and, with consent given through the cookie banner, their activity on the site. Details: https://www.klaviyo.com/legal/privacy.
– Google Ireland Limited (Ireland): Google Tag Manager, Google Analytics 4 (statistics) and Google Ads (ad measurement and personalisation), only with your consent; Google Maps, for the map showing the store location. Details: https://policies.google.com/privacy.
– Meta Platforms Ireland Limited (Ireland): Meta Pixel and Conversions API, for measuring and personalising ads on Facebook and Instagram, only with your consent. Through the Conversions API, information about visits and orders is sent directly from the store's server, and identifiers (such as email or phone) are sent in hashed form. For the collection of this data, Meta and we are joint controllers; further processing is Meta's responsibility. Details: https://www.facebook.com/privacy/policy.
– Covet.pics (Space Squirrel): the app that displays our Instagram photo gallery on the site; receives visitors' technical data (such as IP address) when the gallery loads.
– Courier companies, for delivery and returns; accounting and invoicing service providers; public authorities, where required by law.
5. Transfers outside the European Economic Area
Some providers (Shopify, Klaviyo, Google, Meta) may transfer data to the USA or Canada. Transfers are based on European Commission adequacy decisions (including the EU-US Data Privacy Framework, for certified companies) or on standard contractual clauses approved by the Commission.
6. How long we keep data
– Orders and invoices: for the period required by Romanian accounting law (Law no. 82/1991).
– Customer account: until you ask us to delete it.
– Newsletter: until you unsubscribe.
– Contact form messages: until the request is resolved and at most 3 years afterwards.
– Cookies: as listed in section 7.
7. Cookies
On your first visit, the cookie banner lets you accept or refuse cookies that are not strictly necessary. You can change your choice at any time by deleting the site's cookies in your browser; the banner will then appear again.
– Strictly necessary (no consent needed): shopping cart, login, security, remembering your cookie choice. Examples: cart (2 weeks), _shopify_y (1 year), _tracking_consent (1 year).
– Analytics (with consent): Google Analytics, e.g. _ga (2 years).
– Marketing (with consent): Google Ads, e.g. _gcl_au (90 days); Meta Pixel, e.g. _fbp (90 days); Klaviyo, e.g. __kla_id (2 years).
Durations are set by the providers and may be changed by them.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability, objection, and the right to withdraw your consent at any time, without affecting processing carried out before withdrawal. Write to andrei@albiniprassa.com; we reply within one month. You may lodge a complaint with the Romanian data protection authority (ANSPDCP), www.dataprotection.ro.
9. Changes
We may update this policy when we change providers or the way we process data. The current version and its date are published on this page.