In short
- We use your data only to deliver and invoice your orders, handle returns and the guarantee, and answer your messages.
- We send no advertising e-mails, sell no data and use no statistics or advertising cookies. We count visits to the shop without cookies, to see what customers look for.
- The shop is hosted by Vindesto, which works with the data only on our behalf. Vindesto is responsible for the account you sign in with.
- You can find out at any time what data we hold about you, correct it or ask us to delete it. Write to us at hello@marketimpex.ro.
1. Who is responsible for your data
We, the seller, are responsible for the data we collect in this shop. Regulation (EU) 2016/679 (the “GDPR”) calls this role the “controller”:
[company name]
- Shop: Market Impex Demo
- Registered office: [registered office]
- Trade Register number: [Trade Register number]
- Tax ID (CUI): [tax ID (CUI)]
- E-mail: hello@marketimpex.ro
- Phone: [phone]
The shop runs on the Vindesto platform, operated by [company name]. Vindesto hosts our shop and works with order data only on our behalf and on our instructions, under a data processing agreement. The GDPR calls this role the “processor” (Article 28).
The account you sign in with is a Vindesto account, which you can also use in other shops on the platform. Vindesto is responsible for the account's data (your e-mail, name, address book, signing in) and explains what it does with it in the Vindesto privacy policy. From your account we see only what concerns our shop: your orders, returns, favourites and last sign-in here.
2. What data we use, why and for how long
| What data | Why | Legal basis (GDPR Art. 6) | How long |
|---|---|---|---|
| The order: e-mail, name, phone, delivery address, billing details (yours or your company's: name, tax ID, Trade Register number), the products, prices, your notes, the order's status, the parcel's tracking number and our internal notes. | To confirm, deliver and invoice the order, and to handle returns and the guarantee. | The contract of sale with you (Art. 6(1)(b)); the law, which obliges us to invoice and keep accounts (Art. 6(1)(c)). | As long as we need them for the guarantee, returns and any disagreements, and as the law requires. Accounting documents, 10 years (Romanian Accounting Law 82/1991). |
| Returns: name, the order, the products and pieces returned, the date and time of the request, your reason (if you give one), the bank account (IBAN) and its holder, what we received, refunded or kept and why. | To handle the return, pay you back and be able to show that we followed the law. | The law, which obliges us to take the return and pay you back (Art. 6(1)(c); Romanian GEO 34/2014); for the transfer of the money, the contract (Art. 6(1)(b)). | As long as we keep the order. The accounting documents of the refund, 10 years (Romanian Accounting Law 82/1991). |
| The cart: products, quantities and the addresses chosen at checkout. For a cart without an account, a code kept in the session cookie. | To keep your products until you order. | Steps before a contract, taken at your request (Art. 6(1)(b)). | The cart is deleted after 90 days in which you did not use it. |
| Favourites: the products you save. | So you can find them easily. | The contract (Art. 6(1)(b)). | Until you remove them from your favourites or delete your account. |
| Your customer status: when you last signed in to the shop and whether we have blocked your orders. | To know our customers and stop fake orders. | Our legitimate interest in preventing fraud (Art. 6(1)(f)). | Until we take you off our customer list or you delete your account. |
| Contact-form messages: name, e-mail, subject and message. The IP address you write from, only to stop messages sent in bulk by programs. | To answer you. | Our legitimate interest in answering customers (Art. 6(1)(f)). | The platform does not keep them: they reach us by e-mail and we keep them as long as needed to answer, at most 3 years. The IP limit clears after an hour. |
| Visits to the shop, counted without cookies: when the visit began, the pages and products opened, the products put in the cart, whether you started or placed an order, the site you came from and the campaign in the link, the device type, the browser and the country. The country is found from the shortened IP address in a database kept on the platform's server. The same shortened address and the browser give a code, so we can tell when someone comes back. The IP address itself is not kept. | To see how many people visit the shop, where they come from, what they look for and what they buy, and to make the shop better. | Our legitimate interest in knowing how the shop is used (Art. 6(1)(f)). We build no profile of you and do not use visits for advertising. | 12 months, then deleted. |
Without a name, phone and address we cannot deliver the order, and without an e-mail you cannot have an account. We do not ask for your personal identification number (CNP): not even an invoice for an individual needs it. The words you search for in the shop are kept without any link to you, so we can see what customers look for.
Visits carry neither your name nor your account. When you place an order, the order keeps the visit it came from, so we can see which sources bring orders; the link goes with the visit, after 12 months. We do not count visits by the shop's team while they are signed in, nor by automated programs such as search engines' crawlers.
3. Who receives it
- The courier company bringing your parcel: your name, phone and delivery address, and, for payment on delivery, the amount to collect.
- Those who keep our accounts and issue our invoices: the billing details and amounts.
- Our bank, when we pay you back for a return: the account holder's name, the IBAN and the amount.
- Vindesto, the platform hosting our shop, and its providers, only as processors:
| Provider | What it does | Where | Transfer safeguards |
|---|---|---|---|
|
DA International Group Ltd. (AlphaVPS) [server provider's address] |
The server the application, its database and its search engine run on | Bulgaria (European Union) | Not applicable (European Union) |
|
Cloudflare, Inc. 101 Townsend St., San Francisco, CA 94107 |
The delivery and protection network vindesto.ro pages pass through; storage of uploaded files (Cloudflare R2) | Global network; files in [region where files are kept (Cloudflare R2)] | The EU-US Data Privacy Framework (Cloudflare is certified) and the European Commission's standard contractual clauses |
|
Sendinblue SAS (Brevo) 106 boulevard Haussmann, 75008 Paris |
Sending e-mails (sign-in codes, orders, invitations, contact messages) | European Union (France) | Not applicable (European Union) |
- Authorities (for example, the tax authority ANAF or the consumer authority ANPC), only when the law obliges us.
We do not sell or rent data to anyone.
4. Transfers outside the European Union
The shop's pages on vindesto.ro addresses and uploaded files, such as photos, pass through the network of Cloudflare, Inc., a company in the United States. The transfer has the safeguards the law requires: the EU-US Data Privacy Framework (Decision (EU) 2023/1795) and the European Commission's standard contractual clauses. The other data stays in the European Union.
5. Your rights
You have the right:
- to know what data we hold about you and get a copy of it (GDPR Article 15);
- to correct it (Article 16);
- to ask us to delete it (Article 17), if we no longer need it or have no legal reason to keep it;
- to ask us to stop using it for a while, for example while we check whether it is correct (restriction, Article 18);
- to receive it in a file you can give to someone else (portability, Article 20);
- not to be subject to a decision made only by a program, without a person (Article 22). We make no such decisions and do not profile you.
Your right to object
You can object at any time, on grounds relating to your situation, to the use of data based on our legitimate interest (GDPR Article 21). We then stop, unless we have legitimate grounds that outweigh your interests or need the data to defend a legal claim in court.
For any of these rights, write to us at hello@marketimpex.ro. We answer free of charge within one month. If the request is complicated, we may extend this by two more months, and then we tell you why. Some data, such as invoices, we must keep as long as the law requires, even if you ask us to delete it. You can delete your Vindesto account at any time from My account; for your address book and the account's other data, also write to Vindesto at contact@vindesto.ro.
You can also complain to Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru 28-30, sector 1, postcode 010336, Bucharest; anspdcp@dataprotection.ro; phone +40.318.059.211 or +40.318.059.212; www.dataprotection.ro.
6. The messages you get from us
We write only about your orders: that we received the order, confirmed it, sent it or cancelled it, and about returns, plus sign-in codes. We send no advertising or offers by e-mail.
7. Security
The data is protected by the Vindesto platform's measures: encrypted connections (HTTPS), password-free sign-in with one-time codes, access only for the people on our team who need it, and a log showing who changed what. There is more in the Vindesto policy.
8. Children
The shop is not aimed at children under 16.
9. Cookies
What we keep in your browser is explained in the cookie policy.
10. Changes
When we change this policy, we update the date at the top. If the change matters to you, we tell you beforehand.