PRIVACY POLICY AND GDPR

Concept à Trois – shop.conceptatrois.ro
Last updated: October 2026

This policy describes how TCONCEPT INDUSTRIES SRL collects, uses and protects your personal data when you visit the website or make a purchase, in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian legislation.

1. DATA CONTROLLER

TCONCEPT INDUSTRIES SRL
Registered office: Șos. Ștefan cel Mare și Sfânt no. 41, ground floor, room 2, Iași 700498, Iași County, Romania
VAT ID: RO40073834
Registration number in the Trade Register: J2018002896224
Email: conceptatrois@gmail.com
Phone: 0727 367 366

2. WHAT DATA WE COLLECT

• Identification and contact data: name, surname, email address, phone number, delivery/billing address.
• Order data: products purchased, order history, correspondence regarding returns, complaints or support requests.
• Payment data: online card payments are processed securely by the payment service provider; card data does not reach our servers and is not stored by us.
• Technical data: IP address, device and browser type, pages visited (through cookies and similar technologies).

3. PURPOSES AND LEGAL BASES FOR PROCESSING

• Contract performance: processing and delivery of orders, billing, returns and refunds, customer support.
• Legal obligations: retention of accounting and tax documents in accordance with applicable legislation.
• Legitimate interest: fraud prevention, website security, service improvements.
• Consent: newsletter and marketing communications (you may withdraw your consent at any time, free of charge, via the unsubscribe link or by email).

4. WHO WE SHARE DATA WITH

We do not sell or share your data with third parties for marketing purposes. Data is communicated strictly to the extent necessary to:

• Courier company (Fan Courier) – for package delivery (name, phone, address).
• Online payment service provider (NETOPIA Payments) – for secure payment processing.
• E-commerce platform Shopify (Shopify Inc., Canada) – for hosting and operating the online store; international data transfers are protected by GDPR mechanisms.
• Public authorities – when required by law.

5. HOW LONG WE RETAIN DATA

We retain personal data only for as long as necessary to fulfil the purposes above: order and invoice data are retained in accordance with accounting and tax legal terms; marketing data until withdrawal of consent; correspondence for the duration necessary to resolve requests.

6. YOUR RIGHTS

Under GDPR, you are entitled to: the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection, as well as the right not to be subject to a decision based solely on automated processing.

To exercise these rights you can contact us at conceptatrois@gmail.com. We will respond within a maximum of one month from receipt of your request.

You have the right to lodge a complaint with the National Authority for Supervision of Personal Data Processing (ANSPDCP) – www.dataprotection.ro.

7. DATA SECURITY

The website uses a secure HTTPS connection (SSL certificate). We apply appropriate technical and organizational measures to protect data against unauthorized access, loss or destruction.

8. MINORS

The website and our services are not intended for minors under 16 years of age. We do not knowingly collect data of minors.

9. POLICY CHANGES

This policy may be updated periodically; the version in force is the one published on this page.