Privacy Policy

1. Identity of the data controller
The data controller of personal data processed through the ARTIZAAR online store is ARTIZAAR SRL, with its registered office in Volovăț, no. 124, Suceava County, Romania. For questions regarding personal data protection or to exercise your rights provided by applicable law, you can contact us in the contact section. For the purposes of applicable data protection legislation, ARTIZAAR SRL acts as the controller for the processing described in this policy.

2. Scope of application
This policy applies to all individuals who access the website, place orders, create an account, request information through the contact form, communicate with us regarding products, deliveries, returns, warranties, or promotional campaigns, as well as individuals who request to join the ARTIZAAR Club. The website is intended for individuals who have the legal capacity to enter into legal acts, and placing orders implies acceptance of the applicable Terms and Conditions.

3. Categories of data processed
Depending on how you interact with the website and our services, we may process the following categories of data: first name, last name, email address, phone number, delivery address, billing address, county, city, postal code, billing data for legal entities, data regarding the account created on the website, order history, purchase preferences, viewed products, products added to cart or favorites, data regarding returns or complaints, data transmitted through the contact form or other communications with us, as well as technical data such as IP address, browser information, device, and website usage. In the case of requests regarding the ARTIZAAR Club, we may also process the information you choose to communicate to us about your workshop, store, or activity. The data requested during the ordering process and marked as necessary are indispensable for receiving, confirming, invoicing, and delivering the order; refusal to provide them may make it impossible to conclude or execute the contract.

4. Purposes and legal bases of processing
We process personal data, as applicable, for the following purposes: processing and confirming orders; managing the customer account; issuing tax documents; collecting and confirming payments; organizing delivery; resolving returns, complaints, and warranties; communicating regarding orders, products, or requests; organizing and administering promotional campaigns; preventing fraud and securing the website; defending our legitimate rights and interests; complying with legal obligations in tax, accounting, commercial, and consumer protection matters; sending commercial communications when we have your consent or when the law allows it; as well as analyzing how the website is used to improve services. The legal bases used are, as applicable: performance of the contract or taking steps at the request of the data subject prior to entering into a contract, fulfillment of a legal obligation, the legitimate interest of the controller, and the consent of the data subject.

5. Commercial communications, newsletter and ARTIZAAR Club
If you subscribe to the newsletter, participate in promotional campaigns that stipulate this condition, or request commercial information from us, we may use your contact details to send you offers, news, discounts, and other marketing communications by email and, where applicable, through other channels permitted by law. You can withdraw your consent at any time or object to processing for direct marketing purposes, without affecting the legality of processing carried out prior to withdrawal. In the case of the ARTIZAAR Club, the data submitted through the contact form or within the collaboration request may be used for eligibility analysis, commercial relationship management, and granting club benefits.

6. Recipients of personal data
Data may be disclosed, strictly to the extent necessary, to: the provider of the e-commerce platform and technical infrastructure used for operating the store; payment processors and institutions involved in authorizing and confirming transactions; banks or entities involved in managing payments or potential fraud; courier companies and logistics partners involved in product delivery; IT, hosting, storage, support, analysis, or marketing service providers; consultants, lawyers, accountants, or auditors, when necessary; public authorities and institutions, courts, or other authorized bodies, when there is a legal obligation or a justified legitimate interest. In accordance with the Terms and Conditions of the website, the card data used for online payment are not collected or processed in any way by ARTIZAAR SRL, but by specialized providers involved in payment processing. For delivery, customer data is communicated to carriers and, where applicable, their collaborators, exclusively for the purpose of shipping and delivering orders.

7. Shopify and other third-party services
The online store is powered by Shopify, and certain data transmitted through the website may be communicated to Shopify for hosting, operation, and improvement of services, including for managing orders, payments, security, and certain personalization or advertising features. To the extent that certain processing is performed by Shopify on its own behalf, this will also be governed by Shopify's privacy policy. The website may also contain links to third-party services and platforms; for these, the respective operators' own policies apply.

8. Cookies and automatically collected data
The website uses cookies and similar technologies for the technical functioning of the store, retaining user preferences, security, analysis, traffic measurement, and, where applicable, personalizing content or commercial communications. Automatically collected data may include IP address, online identifiers, device type, browser used, operating system, pages visited, actions performed on the site, and times of interaction with our services. To the extent that certain cookies or similar technologies are not strictly necessary, they will be used based on your choices expressed through the consent mechanisms available on the site.

9. Data storage duration
Personal data is stored for the period necessary to fulfill the purposes for which it was collected, and thereafter, as long as there are legal archiving obligations, tax or accounting obligations, applicable statute of limitations periods, or a legitimate interest in establishing, exercising, or defending a right. Data associated with the customer account is retained as long as the account remains active or as long as necessary for managing the commercial relationship. Data used for marketing purposes is retained until consent is withdrawn or an objection is made, as applicable. Data regarding requests, complaints, or disputes may be retained until their final resolution and the expiration of relevant legal terms.

10. International data transfers
To the extent that, through the use of Shopify or other providers, your data is transferred outside the European Economic Area, such transfers will only take place under the conditions and with the guarantees permitted by applicable law, including through the use of recognized transfer mechanisms, such as standard contractual clauses adopted by the European Commission or other appropriate safeguards.

11. Data subject rights
Under the conditions provided by Regulation (EU) 2016/679, you benefit from the right to information, the right to access data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability, the right to object, including to processing for direct marketing purposes, the right to withdraw consent when processing is based on it, the right not to be subject to a decision based solely on automated processing under the conditions provided by law, as well as the right to lodge a complaint with the competent authority and to address the courts. The exercise of rights can be done by submitting a request to the contact details indicated in this policy. To protect the data and rights of data subjects, we reserve the right to request additional information to verify the identity of the applicant.

12. Data of minors
The website and the services offered through it are not intended for minors, and ARTIZAAR SRL does not knowingly seek or collect personal data from minors for placing orders. If we find that a minor's data has been provided in violation of the applicable conditions, we will take reasonable measures necessary to delete it or limit processing, as appropriate.

13. Complaints and contact
For any questions regarding this policy or to exercise your rights, you can contact us in the contact section contact. If you believe that the processing of personal data violates applicable law, you have the right to lodge a complaint with the competent national data protection authority and to address the competent courts.

14. Policy changes
ARTIZAAR SRL reserves the right to periodically update this Privacy Policy to reflect legislative, technical, commercial, or operational changes. The updated version will be published on the website, along with the date of the last update.

Useful note: the current T&Cs refer to both GEO no. 34/2017 and GEO no. 34/2014 regarding withdrawal/return; for legal consistency, it is worth unifying the text to GEO no. 34/2014, which is the relevant act concerning consumer rights in contracts concluded with professionals.