Privacy Policy

Privacy Policy and Personal Data Protection

We respect the privacy and personal data protection rights of our customers and visitors to our online store. We are committed to processing personal data securely, transparently and solely for lawful purposes, in accordance with applicable legislation.

This Privacy Policy explains which categories of personal data we collect, the purposes for which we use them, the circumstances in which they may be disclosed to other recipients, and the rights available to data subjects.

Personal data is processed in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), applicable Romanian legislation, including Law No. 190/2018 and, where applicable, Law No. 506/2004, as well as other applicable legal provisions.

1. Personal Data We Collect

Depending on how you interact with our online store, we may collect and process the following categories of personal data:

First name and last name;
Delivery and billing addresses;
Email address;
Telephone number;
Information required to process orders and payments, as well as details of completed transactions;
Information voluntarily provided through contact forms or communications with our store representatives;
Technical data and online identifiers, such as IP addresses, device and browser information, cookies and information about interactions with our online store, depending on the technologies used and the consent choices expressed.

Personal data may be collected through the following sections and methods:

Creating and managing a customer account;
Placing and managing orders;
Completing the contact form;
Subscribing to our newsletter;
Email communications, including orders or enquiries submitted by email;
Interactions with our online store through cookies and similar technologies, in accordance with applicable legislation.

2. Purposes and Legal Bases for Processing Personal Data

Personal data is processed for activities necessary to operate our online store and to fulfil contractual and legal obligations, particularly for the following purposes:

Receiving, confirming, processing and managing orders;
Delivering ordered products;
Issuing invoices and other tax and accounting documents;
Processing payments and managing transactions;
Creating and managing customer accounts;
Communicating with customers regarding orders, deliveries, returns, warranties, statutory guarantees or other enquiries;
Handling complaints and fulfilling legal obligations;
Periodically sending commercial information, offers and updates to individuals who have chosen to subscribe to our newsletter;
Promoting our products, evaluating advertising campaign performance and, where applicable, personalising advertisements and conducting remarketing activities in accordance with applicable legislation;
Ensuring the security and proper functioning of our online store.

Depending on the specific purpose of processing, the applicable legal bases may include:

Performance of a contract or taking steps prior to entering into a contract – for processing orders, deliveries, managing customer accounts and communications necessary for the performance of a contract;
Compliance with legal obligations – for invoicing, tax and accounting records, obligations relating to guarantees and other legal requirements;
Consent of the data subject – for newsletters and processing activities that require consent, including certain forms of personalised advertising and the use of tracking technologies;
Legitimate interests – where applicable and justified, for protecting the security of our online store, preventing misuse and protecting legitimate rights and interests, while respecting the rights of data subjects.

Providing the personal data required to place and process an order is necessary for the performance of the relevant contract. Without the essential information, we may be unable to process or deliver your order.

Subscribing to our newsletter is optional and is based on the individual's consent. Consent may be withdrawn at any time, including by using the unsubscribe option provided in our marketing communications.

3. Confidentiality and Disclosure of Personal Data to Third Parties

We do not sell or rent our customers' personal data to third parties.

Personal data may be disclosed, to the extent necessary and in accordance with applicable legislation, to service providers involved in operating our online store, including:

Courier companies and transport providers for the delivery of orders;
Payment service providers and financial institutions for processing and verifying transactions;
IT service providers, hosting providers and technical administrators of our e-commerce platform;
Invoicing, accounting and other service providers necessary for fulfilling legal obligations;
Newsletter distribution service providers, where such services are used;
Online advertising, analytics and campaign performance measurement providers, including Google and Meta, under the conditions and for the purposes described in this Privacy Policy.

The disclosure of personal data is limited to the information necessary to achieve the relevant processing purposes and is carried out in compliance with applicable confidentiality and data protection requirements.

Depending on the services provided, recipients may act as data processors, independent data controllers or joint controllers, in accordance with their respective roles and responsibilities under applicable legislation.

Personal data may also be disclosed to competent public authorities, including law enforcement agencies, public prosecutors, courts or other authorised bodies, where required by law or in response to requests made in accordance with applicable legal provisions.

4. Retention of Personal Data

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected and processed, or to comply with applicable legal obligations.

Retention periods may vary depending on the nature of the data, the purpose of processing and any applicable legal obligations relating to tax, accounting, contractual or product guarantee documentation.

Personal data processed for sending newsletters is used for this purpose until consent is withdrawn or the relevant processing activity ends, without prejudice to any applicable legal retention obligations.

Once the need for processing has ended and no other legal basis exists for retaining the data, it will be deleted or anonymised, as appropriate.

5. Rights of Data Subjects

Under Regulation (EU) 2016/679, individuals whose personal data is processed are entitled to the following rights, subject to the conditions and limitations established by applicable legislation:

Right to be informed – the right to receive clear information about the collection and processing of personal data.
Right of access – the right to obtain confirmation as to whether personal data concerning you is being processed and to access that data.
Right to rectification – the right to request the correction of inaccurate personal data or the completion of incomplete data.
Right to erasure – the right to request the deletion of personal data under the conditions established by the GDPR.
Right to restriction of processing – the right to request restrictions on the processing of personal data in the circumstances provided by law.
Right to data portability – the right to receive personal data in a structured, commonly used and machine-readable format and, where the legal conditions are met, to request its transmission to another controller.
Right to object – the right to object to the processing of personal data in the circumstances established by the GDPR, including processing for direct marketing purposes.
Right to withdraw consent – where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
Rights relating to automated individual decision-making – the rights provided under Article 22 of the GDPR, where applicable.
Right to lodge a complaint – the right to lodge a complaint with a competent data protection supervisory authority, including the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).
Right to an effective judicial remedy – the right to pursue the judicial remedies available under applicable legislation.

6. Exercising Your Data Protection Rights

To exercise your rights regarding personal data, you may submit a request by email to:

contact@kaskadda.com

Where we have reasonable doubts concerning the identity of the person submitting a request, we may ask for additional information necessary to confirm their identity, in accordance with Article 12(6) of the GDPR.

Requests are reviewed and handled within the time limits established by applicable legislation. As a general rule, information regarding the action taken will be provided within one month of receiving the request. Where necessary, this period may be extended by up to a further two months, taking into account the complexity and number of requests, provided that the applicant is informed in accordance with the GDPR.

Exercising data protection rights is generally free of charge. Where requests are manifestly unfounded or excessive, the measures provided under Article 12(5) of the GDPR may be applied.

7. Circumstances in Which Personal Data Cannot Be Deleted Immediately

The right to erasure of personal data is not absolute. In certain circumstances, retaining specific personal data may be necessary or mandatory under applicable legislation.

Such circumstances may include:

Orders in progress – where certain data is necessary for the performance of a contract, including processing, delivering and invoicing orders.
Guarantees, warranties and complaints – where retaining certain information is necessary to fulfil legal obligations, respond to requests or establish, exercise or defend legal claims.
Tax and accounting documents – where retaining transaction-related data is mandatory under applicable tax and accounting legislation.

In these circumstances, personal data will be retained only to the extent that a valid legal basis exists for continued processing. Requests for erasure will be assessed in accordance with the obligations and exceptions established by the GDPR.

8. Security of Personal Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or unauthorised disclosure.

In the event of a personal data breach, we will assess the risks to the rights and freedoms of affected individuals and take the necessary measures to limit the consequences of the incident.

Where notification to the competent supervisory authority is required by law, it will be made without undue delay and, where feasible, no later than 72 hours after becoming aware of the personal data breach.

Affected individuals will be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms, subject to the exceptions provided under applicable legislation.

Depending on the nature of the incident, the measures taken may include:

Assessing potential consequences and limiting the impact of the incident;
Informing affected individuals and, where necessary, providing specific recommendations to protect their accounts and personal data;
Implementing additional technical and organisational measures to prevent similar incidents;
Documenting the incident and the measures taken in accordance with applicable legal obligations.

9. Online Advertising, Cookies and Google and Meta Services

Our online store uses advertising and campaign performance analysis services provided by Google and Meta (Facebook and Instagram).

These services allow us to promote our products, evaluate the effectiveness of advertising campaigns and, depending on users' choices and the tools implemented, display relevant advertisements to individuals who have previously interacted with our online store.

For these purposes, we may use tools such as Google Ads, Meta Pixel, cookies and other similar technologies. These tools may process information including:

Pages visited and products viewed;
Interactions with our online store;
Products added to the shopping cart and the initiation of the checkout process;
Completed orders and conversion events;
Online identifiers and technical information about devices or browsers.

Depending on the services used, technical settings and users' consent choices, certain information may be shared with Google and Meta for conversion measurement, advertising campaign performance analysis, the creation of advertising audiences and remarketing.

Cookies and similar technologies that require consent, as well as the processing of personal data for personalised advertising, are used only under the conditions established by applicable legislation.

Users can accept or reject cookies and similar technologies that require consent through the cookie banner displayed when visiting the website.

Non-essential advertising cookies and technologies for which consent is legally required are used only after such consent has been obtained.

Rejecting advertising cookies does not prevent customers from placing orders or using the essential features of our online store.

For further information about how these service providers process personal data, please refer to:

10. Updates to This Privacy Policy

This Privacy Policy may be amended or updated to reflect changes in legislation, technology or our organisational practices.

The updated version will be published on this page and, where required by law, data subjects will be informed through appropriate means.

11. Contact

If you have any questions regarding this Privacy Policy, the processing of personal data or the exercise of your rights under the GDPR, you may contact us:

Through the contact form available in the Contact section of our online store;
By email at contact@kaskadda.com.