Privacy policy
In short
- We collect only what is needed for you to sign in, order and for the platform to be safe: your e-mail, name, delivery and billing addresses and some technical data.
- We do not sell data, show ads or follow what you do on other sites. We use no statistics or advertising cookies. We count visits to vindesto.ro without cookies.
- When you buy from a shop, the shop is responsible for your order's data; we host it on the shop's behalf.
- You can ask at any time to see, correct or delete your data by writing to contact@vindesto.ro.
1. Who is responsible for your data
The controller of the data described here is:
[company name]
- Registered office: [registered office]
- Trade Register number: [Trade Register number]
- Tax ID (CUI): [tax ID (CUI)]
- Share capital: [share capital]
- E-mail: contact@vindesto.ro
- Phone: [phone]
On the platform we act in two roles, depending on how Regulation (EU) 2016/679 (the “GDPR”) answers the question “who decides why and how the data is used”:
- Vindesto is the controller for vindesto.ro, for each person's Vindesto account (used in every shop), for your address book, for the platform's security and for our relationship with the shops that are our customers. These are described in this policy.
- Each shop is the controller for the orders, returns, carts, favourites and messages it receives, for its visit statistics and for its customer list. We work with this data only on the shop's behalf and on its instructions, as its processor, under the data processing agreement. What a shop does with your data is in that shop's privacy policy, linked in the footer of its pages.
We have not appointed a data protection officer, as our activity does not require one (GDPR Article 37). For any question about your data, write to us at contact@vindesto.ro.
2. What data we use, why and for how long
| What data | Why | Legal basis (GDPR Art. 6) | How long |
|---|---|---|---|
| Your visit: IP address, browser, the page requested and the time, in the technical logs of our server and of the Cloudflare network. | To keep the site working and safe, and to find errors or attacks. | Our legitimate interest in a safe, working platform (Art. 6(1)(f)). | The logs are overwritten automatically when they reach a fixed size, usually within days or weeks. |
| Visit statistics for vindesto.ro, counted without cookies: when the visit began, the pages opened, the site you came from and the campaign in the link, the device type, the browser and the country. The country is found from the shortened IP address in a database kept on our server. The same shortened address and the browser give a code, so we can tell when someone comes back. The IP address itself is not kept. Visits by our team and by automated programs are not counted. | To see how many people visit our site, where they come from and which pages they read, and to make it better. | Our legitimate interest in knowing how the site is used (Art. 6(1)(f)). We build no profiles and do not use visits for advertising. | 12 months, then deleted. |
| Vindesto account: e-mail, first and last name, profile photo if you upload one. | So you can sign in and the shops where you buy or work recognise you. | The contract (Art. 6(1)(b)), meaning the account's terms. | Until you delete the account, from My account: it is deleted after 30 days, in which you can change your mind. |
| Signing in: sign-in codes (the code, attempts, expiry), sessions (date, IP address, browser, the domain you signed in on) and the counters that limit repeated requests (per e-mail or per IP address). | To send your code, keep you signed in and stop attempts to guess codes. | The contract; our legitimate interest in protecting accounts (Art. 6(1)(b) and (f)). | Codes, at most a day after they expire (in 10 minutes) or are used; sessions, until you sign out or delete the account; counters, at most two weeks. |
| Address book: name, phone, address (county, town, street, number, building, entrance, floor, flat, postcode) and, for a company, its name, tax ID (CUI) and Trade Register number. | So you can pick them when ordering in any shop, without typing them again. | The contract (Art. 6(1)(b)). | Until you delete them. An address used for an order stays with that order for as long as the shop needs it. |
| Your shops: which shops you have signed in to, your last sign-in in each and, if you work in a shop, your role there. | So each shop can see its customers and its team. | The contract; the shop's legitimate interest (Art. 6(1)(b) and (f)). | Until the shop removes you or you delete your account. |
| A shop's team: invitations (e-mail, role, who invited and until when it is valid), the change log (who changed what and when) and notifications. | So the shop can manage its team and see who changed what. | The contract with the shop; our legitimate interest in tracking changes (Art. 6(1)(b) and (f)). | The log and notifications, 12 months (the clean-up runs monthly); invitations, until withdrawn or the shop is deleted. |
| Messages you send us: your name, e-mail and what you write. | To answer you and, if you wish, make you an offer for your shop. | Our legitimate interest in answering; steps before a contract (Art. 6(1)(f) and (b)). | As long as needed to answer and at most 3 years after the last message. |
| Shops that are our customers: company details, contact person, plan, invoices and correspondence. | The service contract, invoicing and support. | The contract; legal accounting and tax obligations (Art. 6(1)(b) and (c)). | For the contract and as long as the law requires; accounting documents, 10 years (Romanian Accounting Law 82/1991). |
An e-mail address is needed for the account, and a name and an address to place an order; without them we cannot create the account or send the order. The profile photo is optional. We do not ask for or keep personal identification numbers (CNP), health data or other sensitive data.
Data we process for shops
When you buy from or write to a shop, the shop decides what happens to the data, and we process it only to provide the platform to the shop: orders (products, prices, addresses, notes, status and tracking number), the cart (deleted after 90 days without activity), favourites, your customer status in that shop and returns, with the bank account given for the refund. We do not keep messages sent through a shop's contact form: we e-mail them to the shop, and you get the answer directly from it. Search terms typed in a shop are kept without any link to you. We count visits to a shop for the shop, without cookies: the pages and products seen, the cart and the order, the site and campaign you came from, the device, the browser and the country, found from the shortened IP address in a database on our server. We do not keep the IP address, and visits are deleted after 12 months. The details are in each shop's privacy policy.
3. Who receives it
We do not sell or rent data. Only these receive it:
- The shops you sign in to or buy from: your name, e-mail, your orders there and the addresses used for them, at your request, so they can sell to you. A shop does not see your address book or what you do in other shops.
- The providers that help us run the platform, as processors, under contracts that oblige them to keep the data safe and use it only for us:
| Provider | What it does | Where | Transfer safeguards |
|---|---|---|---|
|
DA International Group Ltd. (AlphaVPS) [server provider's address] |
The server the application, its database and its search engine run on | Bulgaria (European Union) | Not applicable (European Union) |
|
Cloudflare, Inc. 101 Townsend St., San Francisco, CA 94107 |
The delivery and protection network vindesto.ro pages pass through; storage of uploaded files (Cloudflare R2) | Global network; files in [region where files are kept (Cloudflare R2)] | The EU-US Data Privacy Framework (Cloudflare is certified) and the European Commission's standard contractual clauses |
|
Sendinblue SAS (Brevo) 106 boulevard Haussmann, 75008 Paris |
Sending e-mails (sign-in codes, orders, invitations, contact messages) | European Union (France) | Not applicable (European Union) |
- Authorities, only when the law obliges us (for example, at a court's request).
4. Transfers outside the European Union
Cloudflare, Inc. is based in the United States. The transfer relies on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), under which Cloudflare is certified, and, as a second safeguard, on the standard contractual clauses approved by the European Commission (Decision (EU) 2021/914). You can ask us for a copy of these safeguards at contact@vindesto.ro.
5. Your rights
You have the right:
- to know what data we hold about you and get a copy (GDPR Article 15);
- to correct it (Article 16): you change your name and photo any time in your account, and your addresses in your address book;
- to ask us to delete it (Article 17), if we no longer need it or have no legal reason to keep it;
- to ask us to stop using it for a while, for example while we check whether it is correct (restriction, Article 18);
- to receive the data you gave us in a file you can give to someone else (portability, Article 20);
- to withdraw your consent at any time, where we use data based on it; what was done until then stays valid (Article 7);
- not to be subject to a decision made only by a program, without a person (Article 22). We make no such decisions.
Your right to object
You can object at any time, on grounds relating to your situation, to the use of data based on our legitimate interest (GDPR Article 21). We then stop, unless we have legitimate grounds that outweigh your interests or need the data to defend a legal claim in court.
You can also delete your account yourself, at any time, from My account. For any of these rights, write to us at contact@vindesto.ro from your account's address. We answer free of charge within one month. If the request is complicated, we may extend this by two more months, and then we tell you why. For an order's data you can also go straight to the shop you bought from.
You can also complain to Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP): B-dul G-ral. Gheorghe Magheru 28-30, sector 1, postcode 010336, Bucharest; anspdcp@dataprotection.ro; phone +40.318.059.211 or +40.318.059.212; www.dataprotection.ro.
6. How we protect it
- All traffic uses encrypted connections (HTTPS), and browsers are told not to use the site any other way.
- There are no passwords to steal: you sign in with one-time codes, valid for 10 minutes, with at most 5 attempts and limits on repeated requests.
- Sign-in cookies are signed, cannot be read by scripts on the page and work only on the domain you signed in on.
- Each shop sees only its own data, and in a shop's back office each person has only the rights of their role.
- The database and the search engine are not reachable directly from the internet.
- Vindesto team access to a shop's back office shows in that shop's change log.
If an incident still puts your data at risk, we notify ANSPDCP without undue delay and, where feasible, within 72 hours, and we tell you when the risk to you is high (GDPR Articles 33 and 34).
7. Children
The platform is not aimed at children under 16, and we do not knowingly hold their data. If you learn that a child has created an account, write to us and we will delete it.
8. Cookies
What we keep in your browser and why is explained in the cookie policy. You can change your choice at any time from “Cookie settings” in the page footer.
9. Changes
When we change this policy, we update the date at the top. If a change matters to you (for example, a new purpose or a new provider), we tell you beforehand, on the site or by e-mail.