Informative translation; the Romanian version prevails. This English text is provided for convenience. In case of any discrepancy, the Romanian version of this page applies.
Last updated: 3 November 2026
This policy explains what personal data we process when you use evostore.ro or contact us, why, on what legal basis, for how long and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR), Law no. 190/2018 and Law no. 506/2004.
1. The data controller
EVOSTORE SRL, Str. Mihail Sebastian nr. 62-88, sector 5, Bucharest, CUI RO19123284, J40/16756/2006.
Data protection contact: comenzi@evostore.ro, phone 0725 697 694, or by post at the address above.
We have not appointed a data protection officer (DPO), as we do not fall within the cases provided for in art. 37 GDPR.
2. What data we process, for what purpose and on what basis
| Situation | Data | Purpose | Legal basis (art. 6 GDPR) |
|---|---|---|---|
| Order (with or without an account) | name, e-mail, phone, delivery and billing address, customer type (individual/company), for companies: name, CUI, Trade Register no.; products ordered, amounts, payment and delivery method, notes, the moment the terms were accepted, the IP address when the order was placed | conclusion and performance of the contract, delivery, invoicing, communications about the order (confirmation, status changes) | performance of the contract — art. 6(1)(b); legal obligation (invoicing, accounting) — art. 6(1)(c); IP address: legitimate interest in preventing fraud — art. 6(1)(f) |
| Customer account | name, e-mail, phone, password (stored only irreversibly encrypted — hash), date of e-mail confirmation, saved addresses, favourites, notification preferences | account management | performance of the contract / steps taken at your request — art. 6(1)(b) |
| Return / withdrawal | order number, products, reason (optional), details, uploaded photos, IBAN and account holder (for orders paid cash on delivery) | handling the withdrawal and the refund | legal obligation (GEO no. 34/2014) — art. 6(1)(c); performance of the contract — art. 6(1)(b) |
| Warranty and service | name, e-mail, phone, brand, model, serial number of the product, date of purchase, description of the fault, photos/attachments, messages exchanged | resolving warranty and repair requests | performance of the contract / legal obligation (GEO no. 140/2021) — art. 6(1)(b) and (c) |
| Contact form | name, e-mail, phone (optional), subject, message | answering the request | legitimate interest in replying — art. 6(1)(f); pre-contractual steps — art. 6(1)(b) |
| Reviews | name displayed in short form (e.g. „Andrei M.”), rating, text, link to the order (for the „Verified buyer” label) | publishing opinions about products, moderation | consent given by submitting the review — art. 6(1)(a) |
| Newsletter | e-mail, name (optional), subscription source, text of the consent accepted, date of consent and of confirmation, IP address and browser (user agent) at subscription | sending news and offers; proof of consent | consent — art. 6(1)(a), with double confirmation („double opt-in”); proof of consent — art. 7(1) GDPR |
| Stock and price alerts („Notify me”) | e-mail, the product, the alert type (back in stock / price drop), the price at the time of subscription and, optionally, the desired price; for visitors without an account: IP address and time of confirmation; for customers with an account: the link to the account and, if you have enabled notifications for favourites, to the favourite products | sending a single e-mail when the product is back in stock or the price drops | consent — art. 6(1)(a), with double confirmation for visitors without an account |
| Product questions | the name displayed, the e-mail (not published), the text of the question, the product, an irreversibly encrypted fingerprint (hash) of the IP address | publishing the question and the answer after moderation; notifying you by e-mail when the question is answered; preventing abuse | consent given by submitting the question — art. 6(1)(a); IP fingerprint: legitimate interest in preventing abuse — art. 6(1)(f) |
| Undeliverable e-mails | the e-mail address, the rejection reason given by the recipient's server, the date | stopping newsletters and alerts from being sent to non-existent or invalid addresses (e-mails about orders and the account are still sent) | legitimate interest in using the e-mail service properly — art. 6(1)(f) |
| Pre-filling company details | the CUI entered | querying the ANAF public web service for the company name and address | pre-contractual steps — art. 6(1)(b) |
| Security and operation | session identifier, CSRF token, technical server logs (IP, date/time, page accessed, browser) | operation of the website, security, preventing abuse | legitimate interest — art. 6(1)(f) |
We do not take decisions based solely on automated processing that produce legal effects concerning you and we do not create marketing profiles. The website does not use traffic analytics or advertising tools (for example, tracking pixels).
The website is not aimed at children under 16.
3. Providing your data
The data marked as mandatory in the forms is necessary to conclude the contract or resolve the request; without it we cannot process the order or the request. Newsletter subscription, stock and price alerts, product questions and reviews are optional.
4. Who we share data with
We do not sell or rent personal data. We only share it with:
- Courier companies (FAN Courier, Sameday) — name, phone, delivery address, cash-on-delivery amount — for delivery.
- The payment processor PlatiOnline — only when card payment is available and you choose it; card details are entered directly with the processor.
- ANAF — only the CUI entered, at your request, for pre-filling; and invoice data, through the RO e-Factura system, as required by law.
- Manufacturers / authorised service centres — the data needed to resolve a warranty claim, if the product has to be sent to the manufacturer.
- Public authorities — when the law requires us to (ANAF, ANPC, courts, criminal investigation bodies).
- Our advisers (accountant, lawyer) — under an obligation of confidentiality.
- WhatsApp (Meta Platforms Ireland) — only if you press the WhatsApp button and write to us; WhatsApp processes the data according to its own policy, including possible transfers outside the EEA.
Hosting and e-mail: the website, the database and the e-mail server run on servers managed by EvoStore. Transactional e-mails are sent through our own e-mail server. Backups are encrypted.
5. Transfers outside the EEA
We do not transfer data outside the European Economic Area, except where you choose to contact us via WhatsApp (see above).
6. How long we keep the data
| Data | Duration |
|---|---|
| Orders, invoices and supporting documents | for the period required by financial and accounting legislation (Accounting Law no. 82/1991, currently 10 years) |
| Customer account | for as long as the account is active; on deletion (from the account, with „Delete account”, or on request), the account data is anonymised, and the data in orders and invoices is kept only for legal obligations |
| Returns (including IBAN) | for the duration of handling the return and then for the general limitation period of 3 years; the IBAN is stored encrypted |
| Service / warranty | for the duration of the warranty and then for the general limitation period of 3 years |
| Messages sent through the contact form | for as long as necessary to resolve the request |
| Newsletter | until you unsubscribe; after that we keep the proof of consent and of its withdrawal for the general limitation period of 3 years. Unconfirmed subscriptions are deleted automatically after 30 days; the confirmation link expires after 7 days |
| Stock and price alerts | until the alert is sent or you unsubscribe; unconfirmed alerts are deleted after 7 days, sent ones after 180 days |
| Product questions | for as long as the product is displayed or until a deletion request |
| „Download my data” archive | deleted automatically after 7 days |
| Undeliverable e-mail addresses | until the address is removed from the list (at your request or when the address becomes valid again) |
| Reviews | for as long as the product is displayed or until a deletion request |
| Browsing session | the session expires after 120 minutes of inactivity |
| Technical web server logs | 14 days (automatic daily rotation) |
| Backups | up to 8 weeks (automatic rotation), after which they are deleted |
7. Your rights
Under art. 15–22 GDPR you have the right: of access to the data; to rectification; to erasure („the right to be forgotten”), within the limits of our legal retention obligations; to restriction of processing; to data portability; to object to processing based on legitimate interest; to withdraw your consent at any time (without affecting earlier processing); not to be subject to a decision based solely on automated processing.
How to exercise them: you can change much of your data directly in your account („Personal details”, „Addresses”, „Notifications”). On the My account → Personal details page you will also find:
- „Download my data” — an archive with the data associated with the account (profile, addresses, orders, reviews, questions, alerts, newsletter subscription, service and return requests), in an easy-to-read format and in JSON format. We send you the download link by e-mail; the archive is deleted automatically after 7 days. This corresponds to the right of access and the right to portability.
- „Delete account” — permanent deletion of the account: the account data is deleted or anonymised, and orders and invoices are kept only for the period required by law. If you have orders, returns or service requests in progress, the account can be deleted after they are completed.
You can unsubscribe from the newsletter through the link in each e-mail or from your account („Notifications”). Stock and price alerts are stopped through the unsubscribe link in each alert e-mail or from your account („Notifications”). For any other request — or if you prefer not to use these options (for example, for a copy of the data or deleting the account) — write to us at comenzi@evostore.ro. We reply within one month at most (art. 12 GDPR), which may be extended by a further two months for complex requests, in which case we will inform you.
You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, anspdcp@dataprotection.ro.
8. Security
We use an encrypted HTTPS connection, passwords stored only as hashes, encryption of IBANs in the database, access to private files (invoices, attachments) only for the holder and authorised staff, two-step authentication for administrators, an audit log of administrative actions and encrypted backups.
9. Accounts transferred from the old website
When the new website was launched, the accounts of existing customers on the old evostore.ro were transferred, for the continuity of the contractual relationship. You can sign in with the password you used on the old website; at your first sign-in, it is automatically stored using a current encryption algorithm and the old form is deleted. You can set a new password at any time through „Forgot your password”. Newsletter subscriptions from the old website were not transferred. If you no longer want the account, you can ask us to delete it.
10. Cookies
We only use strictly necessary cookies and local storage. Details in the Cookie policy.
11. Changes
We may update this policy; the current version and the date of the last update are shown on this page. For important changes we will inform you by e-mail or by a message on the website.
