Privacy policy

Last updated: October 2026.

1. Who we are

The controller of your personal data is CROWD CONTROL SRL, registered office at Str. 1 Decembrie 1918 nr. 124 ap. 2, sat Roșu, com. Chiajna, Ilfov county, Romania, VAT/company ID 40453728, trade register no. J23/219/2019, which runs the online shop cusutcuataroz.ro (hereinafter “we”).

You can contact us with any question about your data at cusutcuataroz@gmail.com or by phone on +40 729 555 677.

2. What data we collect

Identification and contact details: first name, last name, email address, phone number.
Billing and delivery details: address, city/town, county, postcode; for companies: company name, VAT/company ID, trade register number.
Order data: the products ordered, the order value, the payment and delivery method, the order history.
Account data: if you create an account, your email address and password (stored only in encrypted, irreversible form).
Messages: the content of messages sent through the contact form.
Technical data: IP address and browser type, used for security (preventing fraud and abuse).
Browsing data: only with your consent, through analytics and marketing cookies (see the Cookie policy).

We do not collect or store your card details. Card payments are processed directly by Stripe, on its secure page.

3. Why we use your data and on what legal basis

Entering into and performing the contract (Art. 6(1)(b) GDPR): processing your order, delivery, order communications, handling returns and managing your account.
Legal obligations (Art. 6(1)(c) GDPR): issuing invoices and keeping financial and accounting records, handling complaints under consumer protection law.
Our legitimate interest (Art. 6(1)(f) GDPR): website security, fraud prevention, replying to messages sent through the contact form.
Your consent (Art. 6(1)(a) GDPR): analytics cookies (Google Analytics) and marketing cookies (Meta Pixel). You can withdraw your consent at any time via the “Cookie settings” link in the website footer.

We share data only to the extent strictly necessary, with:

Stripe Payments Europe Ltd. – card payment processing;
the courier company DPD România – delivering your order;
our web hosting provider (Romarg SRL, Romania) and our email provider – running the website and sending order emails;
accounting – issuing and recording invoices;
Google Ireland Ltd. and Meta Platforms Ireland Ltd. – only if you have accepted analytics or marketing cookies, respectively;
public authorities – when required by law.

Some of these providers may transfer data outside the European Economic Area; in such cases, transfers are based on the safeguards provided by the GDPR (adequacy decisions or standard contractual clauses).

5. How long we keep your data

order data and invoices – for the period required by financial and accounting legislation;
account data – until you delete your account or ask us to delete it;
contact messages – for up to 2 years from the last correspondence;
technical security data (IP address, login attempts) – for up to 30 days;
cookies – for the periods listed in the Cookie policy.

6. Your rights

You have the right of access, rectification, erasure (“the right to be forgotten”), restriction of processing, data portability, objection and the right to withdraw your consent at any time, without affecting the lawfulness of prior processing. To exercise your rights, write to us at cusutcuataroz@gmail.com. We will reply within one month at most.

If you believe your data is not being processed lawfully, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP, B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, Romania, www.dataprotection.ro).

7. Security

We use an encrypted connection (HTTPS), passwords stored only in encrypted form, restricted access to the administration panel and limits on login attempts. Card payments are processed entirely by Stripe, which is certified to PCI DSS Level 1.