Privacy policy.

1. Introduction

The purpose of this policy is to explain what data we collect, why we collect it and how we use it. We take your privacy seriously and never sell your data to third parties.

We are fully aware that your personal information belongs to you and we do everything possible to store it securely and process it with care.

2. Who we are

CAVVAS LIMITED SRL, with registered office at Str. Fermei Nr. 7, Gilău 407310, Cluj county, Romania, registered at the Cluj Trade Register Office with unique registration code RO30117828, is the personal data controller.

According to law, we are responsible for processing your personal data that we collect directly from you or from other legitimate sources.

3. Our commitment

We commit to respecting the following principles:

• Legality, fairness and transparency: we process your data legally and fairly, informing you clearly about what we do
• Control: we offer you the possibility to view, modify or delete your personal data
• Data integrity: we use data only for declared purposes
• Security: we implement technical and organizational measures to protect your information

4. What data we collect

Depending on your interaction with the site, we may collect:

Identification and contact data

• First and last name
• Email address
• Phone number
• Delivery and billing address

Fiscal data (for companies)

• Company name
• VAT ID
• Trade registry number

Order data

• Order history and purchased products
• Chosen payment method
• Observations provided at ordering

Technical data (via cookies)

• IP address
• Browser type
• Pages visited on the site
• Date and time of access

Details about cookies can be found in the Cookie Policy.

5. Why we collect this data

We collect your data for specific and legitimate purposes:

• For processing and delivering your orders
• For invoicing and fulfilling fiscal obligations
• For answering your questions and requests
• For improving our products and services
• For diagnosing or fixing technical problems on the site
• For marketing purposes, only with your prior consent
• For complying with applicable legislation

6. Legal basis for processing

We process your data based on the following legal grounds:

• Contract performance: for processing orders and delivering products
• Legal obligation: for invoicing and keeping accounting records (legal period: 10 years)
• Legitimate interest: for improving the site and security
• Consent: for marketing communications and optional cookies

7. Who we share your data with

We may transmit your data to third parties, with whom we have data processing contracts according to GDPR:

• Courier companies (for order delivery)
• Payment service providers (if applicable)
• Technical service providers (hosting, backup, email)
• Accountants and fiscal consultants
• Public authorities, if required by law

Your data is never sold to third parties for external advertising purposes.

8. How long we keep data

Your data is kept for different periods, depending on the processing purpose:

• Orders and invoices: 10 years (legal accounting obligation)
• Contact data: 5 years from last interaction
• Marketing data: until withdrawal of consent
• Technical data (cookies): according to the cookie policy

Upon expiration of the period, data is deleted, anonymized or archived according to law.

9. Your rights

According to GDPR, you have the following rights:

Right of access

You can request information about what data we hold about you and how we use it.

Right to rectification

You can request that we correct incorrect or incomplete data.

Right to erasure (“right to be forgotten”)

You can request the deletion of your personal data under certain conditions. Invoices and accounting documents cannot be deleted before the expiration of the legal retention period (10 years).

Right to restriction of processing

You can request that we restrict the processing of your data in certain situations.

Right to data portability

You can request that we transmit your data in a structured format, or transfer it to another controller.

Right of objection

You can object to the processing of your data for direct marketing or for legitimate interest.

Right to withdraw consent

You can withdraw your consent for marketing or cookies at any time, without affecting the legality of previous processing.

Right to lodge a complaint

You can file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP):

• Address: Bucharest, B-dul G-ral Gheorghe Magheru no. 28-30, sector 1, code 010336
• Website: dataprotection.ro
• Email: anspdcp@dataprotection.ro
• Phone: +40 318 059 211 / +40 318 059 212

10. Data security

We implement technical and organizational measures to protect your data:

• HTTPS encrypted connection across the entire site
• Secured database with restricted access
• Strong password authentication for administrators
• Periodic backups
• Personnel training on data protection

In case of a security breach, we will notify you as soon as possible, according to GDPR obligations.

11. How to contact us

For any question related to your personal data or to exercise your rights, you can contact us at:

• Email: contact@cavvas.com
• Post: Str. Fermei Nr. 7, Gilău 407310, Cluj
• Phone: +40 733 087 960

We will respond to your requests within a maximum of 30 days from receipt.

12. Changes to this policy

This policy may be updated periodically to reflect legislative changes or changes to our practices. Changes are published on this page. We encourage you to check periodically.