PRIVACY POLICY

This policy describes how Alexandru Vlad ("the Controller", "we", "us") collects, uses and protects the personal data of users of https://www.alexandruvlad.com, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

By using this website, you agree to the terms of this policy. If you do not agree, please do not use the website.

1. Controller identity

Controller: VLAD V.A. ALEXANDRU PERSOANĂ FIZICĂ AUTORIZATĂ (sole trader)

Tax ID (CUI): 46604692  ·  Trade Register: F12/1231/05.08.2022

Registered address: Str. Poet Grigore Alexandrescu nr. 49, bloc D29, sc. 1, parter, ap. 2, Cluj-Napoca, Cluj, Romania

Phone: +40 769 379 868

Electronic contact: secure contact form

Website: https://www.alexandruvlad.com

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, password (stored encrypted), newsletter preferences — when creating an account.
• Order data: name, email, shipping/billing address, products ordered, amount paid, company VAT number (optional) — when placing an order.
• Contact data: name, email, subject, message content — when using the contact form.
• Newsletter data: email address — when subscribing.
• Technical data: IP address, browser type, pages visited — collected automatically for security and anonymous statistics.

We do not collect sensitive data (racial origin, health data, biometric data, etc.).

3. Purpose and legal basis for processing

• Performance of a contract (Art. 6(1)(b) GDPR): processing orders, delivering products, managing your account.
• Consent (Art. 6(1)(a) GDPR): sending the newsletter. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f) GDPR): website security, fraud prevention, service improvement.
• Legal obligation (Art. 6(1)(c) GDPR): issuing invoices and keeping accounting records.

4. How long we retain data

• Account data: for the lifetime of the account, plus a 30-day grace period after a deletion request.
• Order and invoice data: 10 years, as required by Romanian accounting law.
• Newsletter data: until unsubscription.
• Contact messages: up to 2 years.
• Technical data (IP, logs): up to 90 days.

The 30-day grace period. When you request account deletion from Profile → Delete account, the account is not erased immediately: it is flagged for deletion and deactivated, and all active sessions are closed. For 30 calendar days you can change your mind — write through our secure contact form using the account's email address and we will restore the account with its data intact.

Once the 30 days have passed, account data — name, email address, password, saved addresses and newsletter preferences — is deleted permanently and irreversibly. From that point we can neither restore the account nor provide you with a copy of its data.

Data we are legally required to keep is the exception: orders, invoices and accounting records are retained for 10 years under Romanian tax law, even after the account is deleted. They remain in our accounting records without being linked to an active account.

5. Who we share data with

We do not sell your data. We share data only with:

• NETOPIA FINANCIAL SERVICES S.A. — payment processor for shop orders. NETOPIA processes your card data directly, on its own pages; we never store or see card details. NETOPIA Privacy Policy →
• Stripe, Inc. — payment processor for the monthly support subscriptions only. Not involved in shop orders. Stripe Privacy Policy →
• Supabase, Inc. — database (hosted in the EU or under standard contractual clauses).
• Email services (Resend) — for sending transactional emails.
• Courier services — shipping address only, for parcel delivery.
• Public authorities — if legally required.

6. Your rights

Under GDPR, you have the following rights:

• Right of access: you may request a copy of your data.
• Right to rectification: you may correct inaccurate data from your account or by email.
• Right to erasure ("right to be forgotten"): you may request deletion of your data, except data we are legally required to retain.
• Right to restriction: you may request limited processing under certain conditions.
• Right to data portability: you may receive your data in a structured, machine-readable format.
• Right to object: you may object to processing based on legitimate interests.
• Right to withdraw consent: for newsletter — unsubscribe from any email or from your account.

To exercise your rights, use our secure contact form. We will respond within 30 days. See our GDPR Rights page for details on each right.

You have the right to lodge a complaint with the Romanian supervisory authority: ANSPDCP — www.dataprotection.ro.

7. Data security

We implement appropriate technical and organisational measures: HTTPS/TLS communication, encrypted passwords (bcrypt), restricted data access, secure sessions. However, no method of transmission over the internet is 100% secure.

8. Cookies

The website uses functional (session) cookies. See our Cookie Policy for details.

9. Changes to this policy

This policy may be updated. Registered users will be notified by email of significant changes. The date of the last update is indicated at the top of this document.

10. Contact

For questions about the processing of your personal data, use our secure contact form.