Privacy policy

Effective date: 14 August 2025

1. WHO WE ARE
   This Privacy Policy explains how SC RUFF UNIT SRL processes personal data in connection with the website shop.hvnds.com, orders, accounts, newsletter subscriptions, customer support, and marketing activities.

2. WHEN THIS POLICY APPLIES
   It applies to individuals who visit our site, place orders, subscribe to our newsletter, interact with us via forms or messages, or otherwise use our services.

3. WHAT IS PERSONAL DATA
   Personal data means any information that identifies or can identify a person. Examples: name and surname, phone number, email, delivery details, order history, payment identifiers, device and browser information, IP address, cookie identifiers, interactions with the site.

4. CATEGORIES OF DATA WE PROCESS

* Identity and contact data (e.g., name, phone, email).
* Order and delivery data (e.g., products purchased, billing and delivery details, tracking info).
* Payment data processed by our payment partners (we do not store full card numbers).
* Account and communication data (e.g., login details, messages, support requests).
* Technical and usage data (e.g., IP, device IDs, browser type, pages visited, actions on the site, cookies).
* Marketing preferences (newsletter opt-in/opt-out, cookie choices).

5. PURPOSES AND LEGAL BASES
   A. Contractual and pre-contractual purposes (to process and deliver orders, issue invoices, provide customer support, manage returns/warranty): Art. 6(1)(b) GDPR.
   B. Legal obligations (accounting, tax, consumer protection): Art. 6(1)(c) GDPR.
   C. Legitimate interests (fraud prevention and security, service improvements, ensuring the proper functioning of the site): Art. 6(1)(f) GDPR.
   D. Consent (analytics, marketing cookies, newsletters, personalized ads): Art. 6(1)(a) GDPR. You may withdraw consent at any time via cookie settings or unsubscribe links.

6. HOW WE COLLECT DATA

* Directly from you (checkout, contact forms, account, newsletter).
* Automatically via cookies and similar technologies.
* From service providers that help us operate the site (e.g., analytics, payment, delivery).

7. COOKIES AND SIMILAR TECHNOLOGIES
   We use necessary cookies for the site to work, and with your consent, analytics/marketing cookies to measure performance and personalize content/ads. You can manage your preferences anytime via the cookie banner/preferences link.

8. WHO WE SHARE DATA WITH

* Delivery/courier companies (to ship orders).
* Payment processors (e.g., Viva Wallet) to securely process payments.
* E-commerce and hosting providers (including Shopify and related infrastructure).
* Analytics and advertising partners (e.g., platforms that measure traffic or help run ads).
* Professional service providers (IT, accounting, legal).
* Public authorities when required by law.

9. INTERNATIONAL TRANSFERS
   Some providers may process data outside the EEA. When this happens, we rely on GDPR-compliant safeguards (e.g., Standard Contractual Clauses and additional measures, where needed).

10. DATA RETENTION
    We keep personal data only as long as necessary for the purposes above:

* Orders, invoicing and accounting records: retained for the period required by law (for example, up to 10 years under accounting rules).
* Contract/claims records: retained for the applicable limitation period.
* Account data: retained while the account remains active.
* Marketing data: retained until you withdraw consent or object.
  After expiry, data is deleted or anonymized.

11. DATA SECURITY
    We use appropriate technical and organizational measures to protect data against unauthorized access, alteration, loss, or disclosure. No system is 100% secure, but we continuously improve our safeguards.

12. YOUR RIGHTS
    Subject to legal conditions, you can request: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. You may withdraw consent at any time for processing based on consent. You also have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP).

13. MINORS
    Our services are intended for adults. We do not knowingly collect data from persons under 16. If we become aware of such processing, we will stop it.

14. AUTOMATED DECISIONS
    We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated fraud-prevention checks may occur to protect our customers and business.

15. DATA BREACHES
    If a personal data breach occurs that creates a risk to your rights and freedoms, we will notify the competent authority within the required timeframe and inform affected individuals when required.

16. HOW TO CONTACT US
    For any privacy request (rights requests, questions), please use the contact form on our website or your account settings/preferences.

17. CHANGES TO THIS POLICY
    We may update this Privacy Policy from time to time. The latest version will always be available on our website and will indicate the effective date.