Privacy Policy
Last updated: 17 September 2026
1. Data controller
TOP GUIDE S.R.L., CIF 54815518, Trade Reg. No.: J2026036188000, Str. Calea Roșiori, Nr. 104, Sat Văcărești, Comuna Drăgănești de Vede, Teleorman, 147130, Romania, is the controller of your personal data.
Email: comanda@pozacruce.ro · Phone: +40 779 243 541
Data are processed in accordance with Regulation (EU) 2016/679 (GDPR), Law no. 190/2018 and Law no. 506/2004.
2. What data we collect
We collect the following personal data needed to process orders:
- First and last name;
- Delivery address (county, locality, street, postal code);
- Phone number;
- Email address;
- Images uploaded to personalise the product.
3. Purposes of processing
- Processing and delivering orders;
- Communicating with the customer about the order status;
- Sending the order confirmation by email;
- Fulfilling legal obligations (invoicing, accounting);
- Direct marketing and promotion to existing customers (offers, new products, personalised ads).
4. Legal basis
Processing is based on the performance of a contract (placing the order) under Art. 6(1)(b) GDPR and on legal obligations under Art. 6(1)(c) GDPR.
For direct marketing to existing customers — including showing personalised ads via customer lists (Customer Match) — processing is based on legitimate interest under Art. 6(1)(f) GDPR. You can object to this processing at any time.
5. Storage period
Personal data are stored for as long as necessary to fulfil the purposes mentioned, but no longer than 3 years from the last order, except for data that must be kept under legal obligations (invoices — 10 years).
| Data category | Storage period |
|---|---|
| Order and contact data | Maximum 3 years from the last order |
| Invoices and accounting documents | 10 years (legal obligation) |
| Images uploaded for personalisation | Maximum 12 months from completion of the order |
Unfinished orders
So that you do not lose your photograph and the data you have entered if the page is closed accidentally, we temporarily save the data filled in on the order form (name, phone, email, address, uploaded photograph), even if you have not submitted the order. We use them only to help you complete the order, if you left us a phone number or an email address, and we delete them automatically after 30 days. The legal basis is Article 6(1)(b) and (f) GDPR — steps prior to entering into a contract and our legitimate interest in facilitating the order you initiated. You may object at any time at comanda@pozacruce.ro.
6. Recipients
Data may be shared with:
- Courier services (FanCourier, Sameday, including easybox) — to deliver orders;
- Hosting and storage services (Vercel, Supabase, Cloudflare) — to operate the website;
- Email services (Resend) — for notifications;
- Stripe Payments Europe, Ltd. (Ireland) — for online card payments. Card details are entered directly on Stripe's secure payment page; we do not see or store them;
- Invoicing services (FGO) — to issue invoices;
- Analytics services (Google Analytics 4) — for website usage statistics;
- Advertising platforms (Google — Google Ads; Meta — Facebook/Instagram; TikTok) — to measure conversions and show relevant ads. Contact data are shared exclusively in encrypted (hashed) form.
Transfers outside the European Economic Area
Some of the providers above (Vercel, Cloudflare, Google, Meta, TikTok) are companies headquartered in the United States or process data outside the EEA. These transfers are carried out on the basis of the Standard Contractual Clauses approved by the European Commission and/or the EU-U.S. Data Privacy Framework, which ensure an adequate level of data protection.
Images you upload
The photographs you upload to personalise the product are stored on Cloudflare R2 and are used exclusively to produce your order. We keep them for a maximum of 12 months from completion of the order (for possible re-orders or complaints), after which they are deleted. You can ask for them to be deleted at any time by writing to us at comanda@pozacruce.ro.
7. Marketing and advertising audiences (Customer Match)
We may use your email address and/or phone number, transmitted in irreversibly encrypted form (SHA-256 hashing), to advertising platforms such as Google (Google Ads) and Meta (Facebook/Instagram), in order to:
- show you relevant ads for our products;
- create lookalike audiences (people with a profile similar to our customers);
- exclude you from certain campaigns (for example, so as not to show you ads for products you have already bought).
The data transmitted are encrypted, are not sold and are not used by these platforms for purposes other than those above. The legal basis is legitimate interest (Art. 6(1)(f) GDPR). You can object at any time by writing to comanda@pozacruce.ro, or manage your ad preferences directly in your Google or Facebook account.
8. Your rights
Under the GDPR, you have the right to:
- Access your personal data;
- Rectification of inaccurate data;
- Erasure of data (the “right to be forgotten”);
- Restriction of processing;
- Data portability;
- Object to processing.
To exercise these rights, contact us at comanda@pozacruce.ro or +40 779 243 541.
9. Complaints
You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — dataprotection.ro.
For consumer disputes you can also contact the Romanian National Authority for Consumer Protection (ANPC) or use the European online dispute resolution platform: consumer-redress.ec.europa.eu.
10. Exercising your rights
The detailed procedure for exercising your rights, the response times and the details of the supervisory authority are described in the GDPR policy.
11. Security
We implement appropriate technical and organisational measures to protect personal data, including SSL/TLS encryption, restricted access and secure storage.